MyAIDevelopment · Product · Operations notes

Terms · Privacy · E-Commerce

This is general information, not legal or tax advice. Rules change often, so verify with the official source or a licensed tax accountant (semusa) or lawyer before acting.

An online service creates three legal relationships the moment it launches.

Relationship Main law Output
Terms of use Act on the Regulation of Terms and Conditions Terms of service
Handling personal data Personal Information Protection Act (PIPA) Privacy policy, consent screens
Online sales and subscriptions Act on Consumer Protection in Electronic Commerce (E-Commerce Act) Operator identity display, withdrawal notices, checkout screens

Terms of Service

Standard terms are contract terms a business prepares in advance to contract with many customers.

Bad example:

We copied another service's terms and only changed the company name. The refund clause did not match our billing.

Good example:

Starting from the standard terms, we reflected our real plans, cancellation and refund method, and data retention periods, and kept a change history.

Privacy Policy

A personal information controller must set a privacy policy and publish it so data subjects can easily check it (PIPA Article 30).

The items the policy must contain are set by Article 30(1) of the Act and Article 31(1) of the Enforcement Decree. "If applicable" items are written only when you do that processing.

Required item When to include
Purpose of processing personal data Always
Personal data items processed Always
Processing and retention period Always
Provision to third parties If applicable
Outsourcing of processing If applicable
Cross-border transfer (legal ground, items, country, recipient, etc.) If applicable
Destruction procedure and method (with the legal ground and items if a law requires retention) Always
Whether sensitive data may become public and how to choose non-disclosure (Act Article 30(1) item 4-2, related to Article 23(3), effective 2024-03-15) If applicable
Rights and duties of data subjects and legal guardians, and how to exercise them Always
Security safeguards Always
Installation, operation and refusal of automatic collection tools (cookies, analytics and ad SDKs, etc.) If applicable
Name of the chief privacy officer, or the responsible department and contact details Always
Department that receives and handles access requests Recommended by the drafting guidelines (statutory basis needs verification)
Remedies for infringement of data subjects' rights Recommended by the drafting guidelines (statutory basis needs verification)

The Personal Information Protection Commission (PIPC) publishes Privacy Policy Drafting Guidelines. A revised edition was released in April 2025, so write from the latest edition.

Commonly Missed Points in Data Handling

Situation Article to check Key point
Data stored in overseas cloud or SaaS Article 28-8, cross-border transfer One of the legal grounds, such as separate consent, is required
Users under 14 Article 22-2, protection of children's data Legal guardian consent and verification of that consent
Appointing an officer Article 31, chief privacy officer Required in principle, with exceptions below certain thresholds
Analytics and ad SDKs Article 30 policy, outsourcing vs provision Inventory what each SDK collects
Personal data breach Article 34, breach notification and reporting Notify data subjects within 72 hours of learning of it. If 1,000 or more people, sensitive or unique identifying data, or unlawful outside access is involved, report to the PIPC or KISA within 72 hours 
flowchart TD
    A[Does the new feature use personal data] -->|No| Z[Just record it]
    A -->|Yes| B{Is each item necessary for the purpose}
    B -->|No| C[Do not collect]
    B -->|Yes| D{Does an outside vendor process it}
    D -->|Yes| E[Classify as outsourcing or provision and update the policy]
    D -->|No| F{Is it transferred abroad}
    E --> F
    F -->|Yes| G[Check cross-border transfer requirements]
    F -->|No| H[Define retention period and destruction]
    G --> H

Extra Checks If You Ship an App

Mobile apps carry a few more legal duties than web services.

Duty Article Who it applies to
Location-based service business report Location Information Act Article 9, special rule for small businesses Article 9-2 Businesses offering location-based services using personal location data report to the Korea Media and Communications Commission. Small business owners and one-person creative companies may start without reporting, but must report to continue past 1 month after starting
App access permission notice and consent Network Act Article 22-2 Apps that access device data or functions such as camera, location or contacts. Separate required and optional permissions, explain them and get consent, and do not refuse service because an optional permission was declined
Sending advertising information (push marketing) Network Act Article 50 Anyone sending commercial ads by app push, text or email. Explicit prior consent, separate consent for sending between 9 p.m. and 8 a.m., and periodic confirmation of consent
Game rating classification Game Industry Promotion Act Articles 21 and 21-2 Anyone distributing or offering a game. Get a rating from the Game Rating and Administration Committee or a self-rating business (such as an app market)
Harmful-to-minors media labeling Youth Protection Act Article 13 When offering content classified as harmful to minors. Harmful-to-minors label and age verification measures
Personal data breach notification and reporting PIPA Article 34, Enforcement Decree Articles 39 and 40 Every personal information controller. Notify data subjects within 72 hours, and report to the PIPC or KISA within 72 hours when the conditions apply (fine for not reporting)

E-Commerce Act Duties

Operator Identity Display

An online mall operator must display the trade name, representative's name, business address, phone number, email address, business registration number, terms of use and more on the initial screen (E-Commerce Act Article 10). A mail-order business shows its report number and other identity details in its advertising.

Withdrawal of Orders

Subscription Billing and Dark Patterns

The amended E-Commerce Act promulgated on 2024-02-13 took effect on 2025-02-14 and directly regulates six types of dark patterns.

Regulated practice Article Meaning for a subscription SaaS
Raising a recurring charge, or converting free to paid Article 13(6) Under the Enforcement Decree, obtain consumer consent within 30 days before the change and explain how to cancel
Showing only part of the price instead of the total Article 21-2(1)1 Show the real total on the pricing screen
Pre-selecting options Article 21-2(1)2 Do not pre-check paid options
False hierarchy Article 21-2(1)3 Do not grey out only the "cancel" button
Obstructing cancellation or account deletion Article 21-2(1)4 Cancellation as easy as sign-up
Nagging Article 21-2(1)5 No repeated pop-ups after a refusal

Bad example:

We silently moved users to an annual plan when the free trial ended.

Good example:

Before the trial ended we asked for consent to the paid plan, and the consent screen showed the cancellation method and the charge.

Pre-Launch Checklist

References