Cross-Border EAP Data Transfers from Korea: Questions Global HR Should Ask
Cross-Border EAP Data Transfers from Korea: Questions Global HR Should Ask
Cross-border EAP data transfers from Korea should be reviewed before global HR, a regional hub, or an overseas vendor can receive or remotely access employee data. Under Korea’s Personal Information Protection Act (PIPA), a cross-border transfer can include provision, outsourced processing, storage, and overseas access or inquiry—not only moving a database to a foreign server.
Start by mapping exactly what EAP data leaves Korea, who can access it, and why. Then identify the PIPA legal basis for the transfer, separately assess any sensitive information, verify the employee notice or consent requirements, map subprocessors and onward transfers, and put the required safeguards into the contract and operating controls. Do not assume that a global privacy policy, GDPR compliance, or a vendor’s standard DPA automatically resolves the Korean transfer analysis.
🗺️ Start with a data map, not a vendor questionnaire
EAP programs often combine several different data layers. Treating all of them as one dataset makes it harder to decide what actually needs to cross borders and what the employer should see.
| Data layer | Examples | Cross-border question | Global HR visibility |
|---|---|---|---|
| Eligibility and access data | Employee ID, work email, employer, eligibility status | Does an overseas platform, regional admin, or support team receive or remotely access it? | Limit to what is needed for administration |
| Appointment and service administration | Booking status, channel, date, remaining sessions | Where is it stored and who supports the platform? | Use the minimum needed for operations |
| Counseling or health-related content | Presenting concerns, session notes, clinical or health information | Can it remain segregated in Korea? Is sensitive-information processing separately justified? | Individual counseling content should not be a routine HR reporting field |
| Employer reporting | Utilization rate, broad categories, aggregated trends | Can reporting be aggregated or de-identified before any overseas access? | Prefer aggregated operational reporting where possible |
🌐 Question 1 — Is this a cross-border transfer under Korean PIPA?
PIPA Article 28-8 uses a broad concept of overseas transfer. The law covers the overseas provision of personal information, including access or inquiry, outsourced processing, and storage. This means server location is only one part of the analysis. An overseas service desk, regional administrator, group privacy team, or vendor support engineer with remote access can bring a data flow into the cross-border review even when the primary database remains in Korea.
- Where are the primary and backup environments located?
- From which countries can support, security, HR, or vendor staff access the data?
- Does “view-only” access expose identifiable employee information?
- Do exports, tickets, logs, analytics, or screenshots create a second overseas data path?
⚖️ Question 2 — What PIPA legal basis supports the transfer?
Separate consent is one route, but it is not the only route in Article 28-8. The correct basis depends on the actual data flow, purpose, contractual relationship, and recipient. Global HR should ask the Korean privacy owner or counsel to identify the basis for each transfer rather than label the entire EAP arrangement as “consent-based” or “vendor processing.”
| Article 28-8 route | What global HR should verify |
|---|---|
| Separate consent of the data subject | Is consent truly separate, informed, and specific to the overseas transfer items required by Korean law? |
| Statute, treaty, or international agreement | What exact legal instrument authorizes the transfer? |
| Entrusted processing or storage necessary to conclude or perform a contract with the data subject | Why is overseas processing/storage necessary, and were the required transfer details disclosed in the privacy policy or notified by the prescribed method? |
| PIPC-recognized certification route | Does the recipient actually hold a qualifying certification and are the required protective measures in place? |
| PIPC-recognized country or international organization | Has the Personal Information Protection Commission formally recognized an equivalent level of protection for the relevant destination? |
🔐 Question 3 — Does the EAP dataset contain sensitive information?
Korean PIPA Article 23 restricts the processing of sensitive information, including health information. Not every EAP administration field is automatically health information, but counseling records and some presenting-concern or clinical fields may contain health or other sensitive information depending on their content.
That creates a two-layer review: first, whether processing the sensitive information is permitted; second, whether the overseas transfer is permitted. A valid overseas-transfer route does not by itself answer every question about sensitive-information processing.
Ask the vendor to separate fields by sensitivity
Request a field-level inventory showing which data is identity/eligibility data, appointment data, counseling content, health-related information, incident or crisis data, and employer reporting data. The answer should be more specific than “EAP data.”
Ask whether counseling content can be technically segregated
A global platform may need authentication and scheduling data without needing session notes. Role-based access, separate databases, tokenized identifiers, or a Korea-only counseling record layer can reduce unnecessary cross-border exposure where the operating model allows it.
📣 Question 4 — What must employees be told when consent is the basis?
Where separate consent is used, Article 28-8 requires specific information to be disclosed. The form should match the real transfer rather than use broad wording such as “data may be transferred to affiliates worldwide.”
| Required disclosure area | Question to ask before launch |
|---|---|
| Items of personal information transferred | Can we name the actual fields or clear categories instead of “all service data”? |
| Country, timing, and method of transfer | Are storage, remote access, API transmission, and support access accurately described? |
| Recipient name and contact information | Are the legal entity and a usable contact point identified? |
| Recipient purpose and retention/use period | Is the overseas recipient’s role clear, and is the retention period specific enough to operate? |
| How to refuse and the effect of refusal | Can the employee understand what service impact, if any, follows from refusal? |
🔗 Question 5 — Who can receive the data after the first vendor?
The first EAP vendor is rarely the whole map. Cloud hosting, ticketing, communications, interpretation, analytics, security monitoring, and regional support can introduce subprocessors or additional countries. PIPA also addresses onward overseas transfers, so the review should continue beyond the primary vendor.
- List each overseas recipient, subprocessor, affiliate, and access country.
- Document the purpose and dataset available to each party.
- Identify whether the recipient can make a further overseas transfer.
- Require a change-notification and approval process for material subprocessor changes.
🛡️ Question 6 — What should the contract and security controls cover?
The PIPA Enforcement Decree requires protective measures for overseas transfers, including security measures and measures for handling grievances and disputes, and requires the controller to agree relevant matters with the overseas recipient in advance and reflect them in a contract or similar instrument.
Contract questions
- Does the contract identify transfer purposes, permitted processing, countries, retention, deletion, and return?
- Does it restrict onward transfers and require notice before subprocessor changes?
- Are security duties, incident notification, cooperation with data-subject requests, and audit evidence addressed?
- Can the Korean controller verify deletion from active systems and backups according to the agreed retention model?
Operational questions
- Is access role-based and logged by user, country, and purpose?
- Are privileged support sessions time-limited and reviewable?
- Can counseling content be excluded from support tickets and analytics?
- Is there a Korea-specific escalation path for privacy complaints or a PIPC inquiry?
✅ Global HR pre-launch checklist
| Check | Status |
|---|---|
| We have a field-level EAP data inventory, not just a system diagram. | □ |
| We know every country from which identifiable data can be accessed. | □ |
| We mapped primary vendors, subprocessors, affiliates, and onward-transfer paths. | □ |
| Each cross-border flow has an identified Article 28-8 legal basis. | □ |
| If consent is used, the required transfer information is stated specifically. | □ |
| If the contract-necessary entrustment/storage route is used, necessity and disclosure/notice requirements were reviewed. | □ |
| Potential health or other sensitive information has a separate Article 23 review. | □ |
| Global HR access is limited to what is necessary for the business purpose. | □ |
| Counseling content is segregated from routine employer reporting where possible. | □ |
| The contract reflects overseas security, complaint handling, incident, and deletion duties. | □ |
| Remote support and privileged access are logged and periodically reviewed. | □ |
| Subprocessor and country changes trigger a privacy review before implementation. | □ |
| Data-subject requests can be handled even when data is held by an overseas recipient. | □ |
| The Korean privacy notice and employee-facing EAP notice match the live architecture. | □ |
🔄 A practical EAP data-flow model to discuss with your vendor
This is not a mandatory localization model, but it is a useful minimization pattern to test during design:
- Keep eligibility and authentication fields to the minimum required to let employees enter the service.
- Separate counseling records from employer-facing administration and reporting.
- Give overseas operational teams access only to the dataset needed for their role and only under the chosen Korean transfer basis.
- Provide the employer with aggregated or otherwise minimized reporting instead of routine individual counseling details.
- Apply documented retention, deletion, backup, incident, and onward-transfer rules to every recipient in the chain.
⚠️ Common mistakes in global EAP rollouts
- “The vendor is GDPR compliant, so Korea is covered.” Korean PIPA has its own transfer bases and required controls.
- “The server is in Seoul, so there is no overseas transfer.” Overseas access or inquiry can still matter.
- “Consent is always required.” Article 28-8 provides several possible routes; the applicable route must fit the real processing.
- “EAP utilization data is never sensitive.” Sensitivity depends on the field and content; counseling or health-related data needs closer review.
- “Our first vendor is the only recipient.” Hosting, support, analytics, and subprocessors can create additional transfer paths.
🔗 Related Nudge EAP articles
❓ FAQ
Q1. Is employee consent always required for an EAP transfer from Korea?
No. Separate consent is one Article 28-8 route, but the law lists other routes. Which one is available depends on the purpose, recipient, contractual structure, and transfer architecture. Do not select a basis by convenience; document why it applies to the specific flow.
Q2. Can remote access from a U.S. or regional support team count as an overseas transfer?
It can. Article 28-8 expressly includes overseas provision that occurs through access or inquiry. Map support and administrator access countries even when the underlying server is located in Korea.
Q3. Can global HR receive individual counseling notes if employees consent?
Consent does not remove the need to examine purpose, necessity, sensitive-information rules, EAP confidentiality, access controls, and the employer’s legitimate operational need. For routine employer reporting, a minimized or aggregated report is generally a safer design question to explore than individual counseling content.
Q4. What if the EAP vendor adds a new cloud or support subprocessor after launch?
Treat that as a potential change to the transfer map. Review the new recipient, country, purpose, dataset, onward-transfer path, notices or consent impact, and contractual safeguards before assuming the existing assessment still covers it.
Q5. Is an English global privacy notice enough for employees in Korea?
The key issue is whether the Korean PIPA requirements that apply to the selected transfer basis are actually satisfied and the live data flow is accurately described. Global templates should be localized and reviewed against Korean notice, consent, and privacy-policy requirements rather than used unchanged.
👉 Next step
If your organization is launching or consolidating EAP services in Korea, review the data flow, employee-facing notice, vendor roles, and confidentiality model together before go-live.
Discuss an EAP operating model →📚 Official sources and legal note
- National Law Information Center (Korea) · PIPA Article 28-8, overseas transfer, in force September 11, 2026
- PIPA Enforcement Decree · Article 29-10, measures for overseas transfers
- Personal Information Protection Act · Article 23, sensitive information
- Korea Legislation Research Institute · English translation of PIPA
- Personal Information Protection Commission · English enforcement notice concerning cross-border transfer requirements
- National Law Information Center (Korea) · PIPA Articles 28-8 through 28-11, including onward transfers
This article is general information, not legal advice. The correct PIPA basis and employee notice/consent process depend on the actual EAP architecture, the parties’ legal roles, the data fields involved, and the destination/recipient chain. Have Korean privacy counsel or your DPO review the live data flow before implementation. Law checked: September 16, 2026.