K-PIPA vs EN 1090
K-PIPA
South Korea's stringent regulation for personal data protection
EN 1090
EU standard for execution of steel and aluminium structures
Quick Verdict
K-PIPA enforces strict data privacy for Korean operations via consent and CPOs, while EN 1090 mandates CE marking for EU structural steel/aluminium through FPC and welding controls. Companies adopt K-PIPA for compliance in Korea, EN 1090 for market access.
K-PIPA
Personal Information Protection Act (PIPA)
Key Features
- Mandates independent Chief Privacy Officers for all handlers
- Requires granular explicit consent for sensitive data transfers
- Enforces 72-hour breach notifications to subjects and regulators
- Applies extraterritorially to foreign entities targeting Koreans
- Imposes fines up to 3% of annual global revenue
EN 1090
EN 1090 Execution of steel and aluminium structures
Key Features
- Risk-based Execution Classes (EXC1-EXC4)
- Factory Production Control (FPC) certification
- CE marking and Declaration of Performance
- Welding coordination per ISO 3834
- Material traceability and NDT inspection
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
K-PIPA Details
What It Is
K-PIPA (Personal Information Protection Act) is South Korea's comprehensive data privacy regulation, enacted in 2011 with major amendments in 2020, 2023, and 2024. It governs collection, use, storage, transfer, and destruction of personal, sensitive, and unique identification information by domestic and foreign entities processing Korean residents' data. Adopting a consent-centric, risk-based approach, it emphasizes transparency, purpose limitation, and data minimization.
Key Components
- Core principles: explicit consent, security safeguards, data subject rights (access, erasure, portability).
- Mandatory CPOs for accountability, technical controls (encryption, access logs) per 2024 Guidelines.
- Breach notifications within 72 hours; cross-border transfer restrictions.
- Enforcement by PIPC with fines up to 3% revenue; no certification but compliance audits.
Why Organizations Use It
Legal mandate for data handlers; mitigates fines (e.g., Google's $50M penalty), builds trust in privacy-sensitive market. Enables EU adequacy data flows, supports AI/innovation via pseudonymization, enhances reputation and market access.
Implementation Overview
Phased: gap analysis, CPO appointment, policy development, technical controls, training, audits. Applies to all sizes/industries targeting Koreans; ongoing via PIPC guidelines, no formal certification required.
EN 1090 Details
What It Is
EN 1090 is a harmonized European standard family for the execution and conformity assessment of structural steel and aluminium components. It implements the EU Construction Products Regulation (CPR), enabling CE marking. The primary scope covers fabrication, assembly, and assessment of load-bearing components for construction works. It uses a risk-based approach via Execution Classes (EXC1–EXC4), scaling requirements by consequence, service, and production categories.
Key Components
- **EN 1090-1Conformity assessment, Factory Production Control (FPC), and Declaration of Performance (DoP).
- **EN 1090-2/-3Technical rules for steel/aluminium execution (welding, tolerances, corrosion protection, inspection).
- Core pillars: material traceability, welding coordination (ISO 3834 alignment), NDT, and tolerances.
- AVCP systems with Notified Body certification and surveillance.
Why Organizations Use It
- Mandatory for EU market access via CE marking.
- Reduces liability, ensures safety, and minimizes rework.
- Builds trust with stakeholders; enables high-risk projects.
- Competitive edge through certified quality and traceability.
Implementation Overview
Phased: gap analysis, FPC design, personnel training, NB certification. Applies to fabricators in construction; 6-12 months typical. Requires audits, welding qualifications, and ongoing surveillance. (178 words)
Key Differences
| Aspect | K-PIPA | EN 1090 |
|---|---|---|
| Scope | Personal data protection and privacy | Structural steel/aluminium fabrication conformity |
| Industry | All sectors handling Korean data | Construction, steel/aluminium manufacturing |
| Nature | Mandatory national privacy law | Harmonized execution standard for CE marking |
| Testing | Security audits, breach simulations | FPC certification, welding NDT, NB audits |
| Penalties | 3% revenue fines, imprisonment | Market exclusion, certificate suspension |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about K-PIPA and EN 1090
K-PIPA FAQ
EN 1090 FAQ
You Might also be Interested in These Articles...
SOC 2 Audit Survival Guide: 10 Red Flags Auditors Flag and Model Answers for Walkthroughs
Master SOC 2 Type 2 audits with our guide: 10 red flags like incomplete logs/vendor gaps, model walkthrough answers, psychology tips. Pass first-time with <5% e
The Service-Oriented SOC: Leveraging Maturity Assessments to Guarantee SLOs and Operational Predictability
Transform your SOC into a service provider using maturity assessments to standardize workflows, guarantee SLOs, and ensure predictability amid turnover and risi
What if the EU would not have made GDPR mandatory...
Explore a world without mandatory GDPR: How would organizations manage data? What data privacy regs would emerge? Uncover impacts on businesses and privacy laws
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Explore More Comparisons
See how K-PIPA and EN 1090 compare against other standards