In a nutshell - The Personal Information Protection Law

​Basically in the following cases:

• Consent, or
• Consent is not required.

​Accurate and complete information to the individual about the following:

• Identity of the data processor;
• The methods and purposes of the data processing; and
• Indication of the rights of the persons concerned regarding the processing and deletion of the data.

​Generally not, unless one of the following conditions is met:

• Existence of a security assessment carried out by the competent authority;
• Existence of a certification by a state-recognized institution confirming the lawful protection of personal data;
• Existence of an effective contract with the data recipient abroad, regulating the rights and obligations of both parties in accordance with the standard contract published by the competent authority; or
• Other conditions established by laws, administrative regulations or the state cyberspace authority.

Notwithstanding the foregoing, it should be noted that the first condition is a mandatory requirement if the data processor falls within the definition of "operator of critical information infrastructure" or the amount of personal data processed reaches certain thresholds set by the competent governmental authority.

Regardless of the existence of any of the above conditions, the individual must have expressly consented to a data transfer in advance.