EDPB adopts statement on review of the Republic of Korea adequacy, processor BCR recommendations, and selects topic for 2027 coordinated enforcement action

12 November 2026

During its latest plenary, the European Data Protection Board (EDPB) has adopted a statement on the first review of the functioning of the adequacy decision of the Republic of Korea and the final version of the recommendations on the application for approval and on the elements and principles to be found in Processor Binding Corporate Rules (BCR-P).

In addition, the Board selected the topic for its sixth coordinated enforcement action (CEF).

The EDPB statement on the first review of the Republic of Korea adequacy decision focuses mainly on the assessment of amendments to the Korean data protection legal framework, both on the commercial aspects and concerning access and use of personal data by Korean public authorities.

“The mutual recognition of equivalent data protection standards between the EU and the Republic of Korea in 2025 represented a major step confirming the growing alignment between both regulatory frameworks.

We welcome amendments in the Korean data protection legislation that have increased the level of protection of individuals and facilitated the processing of data by controllers while maintaining a level of protection essentially equivalent to that of the GDPR," said EDPB Chair, Anu Talus.

Read more here