The South Korean data protection authority conducted a proactive sectoral investigation in the field of educational technologies, revealing common failures in access rights management, data deletion, and technical security measures, leading to the issuance of corrective recommendations rather than financial penalties.

Facts and context

The South Korean data protection authority (Personal Information Protection Commission, PIPC) published on November 12, 2026, the results of an investigation conducted with several companies in the educational technology sector, including ㈜비상교육, ㈜천재교육, ㈜미리디, ㈜소프트앤 and ㈜리로소프트. This initiative aimed to assess the compliance of digital educational services used in public education.

This preventive inspection was initiated in collaboration with the Ministry of Education following a security incident affecting a company in the same sector, in order to identify and prevent risks of personal data breaches involving students and teaching staff.

Reasons for the decision

The authority identified several breaches of the Personal Information Protection Act, notably regarding consent, retention periods, and security measures.

• Obligation to obtain consent from the legal representative for minors: Company A had not implemented an adequate procedure to obtain consent from legal representatives when collecting personal data of children under 14 years old. The authority considered this process insufficient to guarantee valid consent, although the company corrected this point during the investigation.

• Obligation to delete data after processing ends: It was found that Company B retained personal data of members who had terminated their accounts in its active production database. The authority deemed this practice contrary to the principle of storage limitation, as data must be destroyed once the processing purpose is achieved.

• Obligation of transparency regarding subcontractors: Company B had not disclosed the identity of one of its subcontractors, thus failing its obligation to inform data subjects about the recipients of their data. This deficiency was corrected during the inspection.

• Obligation to implement appropriate security measures (access rights management): Several inspected companies showed weaknesses in managing access rights to their information systems. The authority notably noted that some employees all had administrator rights without justification by their functions, constituting a violation of the obligation to secure data through strict access control.

• Obligation to implement appropriate security measures (vulnerability management): Company B had not applied patches for certain security flaws identified during a vulnerability analysis dating from 2025. The authority concluded that the absence of remediation for known vulnerabilities constituted a breach of the obligation to ensure the security of processing systems.

• Obligation to implement appropriate security measures (intrusion detection and logging): The investigation revealed that Company B had insufficient measures to detect and block unauthorized access attempts and exposed development and test pages on the internet. Moreover, Companies A and B did not retain logs of connections to their personal data processing systems, making any incident analysis impossible.

Decision of the authority

Consequently, the authority issued corrective recommendations to the companies concerned for unresolved breaches during the investigation, emphasizing that most failures were voluntarily corrected by the companies during the inspection.

Lessons learned

This decision reminds that:

• Access rights management must be strictly controlled according to the principle of least privilege, avoiding granting extensive permissions, such as administrator rights, to all employees.

• The effective deletion of personal data of users who have left a service must be a controlled and verifiable technical process, applying to all environments, including production databases.

• An information system security policy must include regular vulnerability analyses, systematic deployment of corresponding patches, and securing all environments, including development and test ones, to prevent their public exposure.