EDPB adopts adequacy declaration for South Korea, final BCR‑ST recommendations and selects AI recruitment for 2027 coordinated enforcement

Qué ocurrió

On 10 November 2026 the European Data Protection Board adopted a declaration confirming the adequacy of South Korea’s data‑protection framework, noting new rights under the Korean PIPA. The Board also approved the final recommendations for binding corporate rules for sub‑processors (BCR‑ST) and announced the 2027 coordinated enforcement theme on automated decision‑making in AI‑assisted recruitment.

Por qué es importante para la confianza y el cumplimiento

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The guidance updates cross‑border transfer rules, strengthens BCR‑ST obligations and signals upcoming EU enforcement focus on AI‑driven hiring decisions.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Confirm access, correction, deletion and opt-out requests are handled within the required time.
3. Review the transfer mechanisms relied on for affected data flows.
4. Inventory AI or automated decision systems in scope and their assessments.
5. Review age assurance and protections for minors' data.