It is reported that Korea imposes an identity requirement for SIM registration. Anyone wanting to purchase a SIM card has to provide their national ID card or a passport in case of foreigners to activate a new prepaid SIM card.

In accordance with Art. 7 of the Ministry of Health and Welfare Notice No. 2023-245 on the Standards for Facilities and Equipment for Managing and Storing Hospital-Generated Electronic Medical Records, cloud servers storing patient electronic medical records created by hospitals must be situated in South Korea. Additionally, Art. 9 mandates that the Ministry of Health and Welfare shall issue an official notification every three years outlining the requirements for servers, including backup servers, used to store these records. Currently, these servers must be physically located in South Korea, and accessing medical records from outside the country is prohibited.

In January 2023, the Korean Ministry of Science and Technology Information and Communication issued a notice of implementation and adopted an amendment to the Cloud Security Assurance Program (CSAP). Under the amendment, it is reported that, to obtain CSAP certification from the Korea Internet and Security Agency (KISA), a service provider’s cloud computing infrastructure, associated data, backup systems, as well as management and operational personnel, must all be located within Korea.

Art. 16 of Act on the Establishment, Management of Spatial Data provides that geographical data related to maps or photos produced for the purpose of a survey cannot be transferred abroad except with the permission of the Minister of Land, Infrastructure and Transport. This provision has been in place since 2014.

Art. 28-8 of the Personal Information Protection Act prohibits any transfer of personal information overseas by a personal information manager unless it is in any of the following cases: (i) where a separate consent for overseas transfer has been obtained from the data subject; (ii) where there exist special provisions in a statute, a treaty or other international conventions to which the Republic of Korea is a party; or (iii) where it is necessary to delegate the processing of, or retain, personal information in order to execute and perform a contract with a data subject, and the matters to be informed to the data subject when obtaining his/her consent to overseas transfer have been informed to the data subject or have been disclosed in the personal information manager privacy policy; (iv) where the recipient of personal information has obtained certification determined and publicly notified by the Personal Information Protection Commission (PIPC) and has implemented certain measures to protect personal information; or (v) where the PIPC has recognised that the country or the international organization to where the personal information is transferred has the personal information protection system, etc. that are substantially equal to the level of those under the Personal Information Protection Act. The personal information manager shall also take certain technical, managerial and physical protection measures.

According to Art. 32 of the Credit Information Act, the credit information provider/user should obtain the prior consent of the customer in writing or by other reliable means each time it provides to a third party or uses personal credit information (including any personally identifiable information) of a customer. When the credit information provider/user obtains consent to the provision (i.e. sharing) and utilisation of personal credit information, it should notify the customer of: the recipient of the information; the purpose of provision; the content of information; the duration of maintenance; and use by the recipient. Furthermore, a separate explanation to the customer is required with respect to the mandatory items of personal data that must be provided for the provision of the services and other optional items of personal data, and consent must be obtained. In such cases, as to the mandatory items, the credit information provider/user must explain their relevance to the service provision. Art. 32 requires the credit information provider/user to notify the customer that they may opt not to consent to the provision of any optional data that may be collected.
The Act established that financial institutions are required to obtain consent of individuals only if the use of personal information "conflict[s] with the original purpose of the collection." Thus, under this regime, a financial institution may "entrust" personal information to a third party but may not "supply" it. Supplying and entrusting are terms of art under the Act. "Supplying" means transferring personal information for the transferee's own purpose, whereas "entrusting" means transferring personal information to a third party to help carry out the purpose of the original data collection.

Korea has ratified the World Intellectual Property Organization (WIPO) Copyright Treaty.

Korea has ratified the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

The Unfair Competition Prevention and Trade Secret Protection Act provides a framework for the effective protection of trade secrets. According to Art.1 of the Act, trade secrets are defined as "information, including a production method, sale method, useful technical or business information for business activity, that is not known publicly, is the subject of considerable effort to maintain its secrecy and has independent economic value. The law (chapter 2) contains provisions for the protection of trade secrets, such as an injunction against infringement, liability for damages, and restoration of reputation.

It is reported that Korea has no obligation for passive infrastructure sharing in the country to deliver telecom services to end users. However, it is practised in both the mobile and fixed sectors based on commercial agreements.

The Telecommunications Business Act regulates licenses for network equipment and creates rules for the fair use of telecom facilities. Per Art. 8, foreign corporations cannot operate facilities-based telecom business in the country. Foreign ownership is allowed only up to 49% of the stock.

Under the Telecommunications Business Act, telecommunications businesses are divided into two categories: namely, facilities-based telecommunications services (FTS) and value-added telecommunications services (VATS). FTS refers to businesses that install telecommunications line equipment and facilities and provide telecom services. VATS are online services using the FTS network, such as cloud computing services, email, e-commerce platforms, and internet search engines. Since 2009, the Act has prohibited foreigners from owning more than 49% of the stock of a telecom enterprise when it comes to FTS (Art. 8).

Korea does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, accounting separation is required in certain cases: According to the Telecommunications Business Act, accounting is mandated for facilities-based telecommunications business operators who possess telecommunication service equipment and whose telecommunications service turnover of the preceding year exceeds 30 billion won (approx. 22.5 million USD), and for facilities-based telecommunications business operators who do not possess telecommunication service equipment and whose telecommunications service turnover of the preceding year exceeds 80 billion won (approx. 60.2 million USD).

Korea has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

It is reported that the Korea Communications Commission, the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.