The South Korean Personal Information Protection Commission (PIPC) has issued clarifications on the obligations to be respected when using external survey tools for the processing of personal data.

This communication recalls the authority's past actions, including the imposition of fines in December 2021, April 2022, and December 2022 on data controllers for misconfiguration of form publication options. The PIPC also developed a guide in December 2024 aimed at organizers of online promotional events and issued a note to public bodies in April 2026 on precautions to be taken. The authority emphasizes that entities using these tools remain responsible for the processing and must ensure compliance with the principles of data minimization, prohibition of publication settings, and deletion of data after the purpose is achieved. It specifies that a subsequent subcontracting relationship is not established between the user organization and tool providers such as Google Forms.

The PIPC announces its intention to supplement its guide with concrete examples to better support public bodies in their compliance efforts.