South Korea’s Personal Information Protection Commission said on Thursday that the average score in its 2025 assessment of privacy policies across seven areas closely tied to daily life rose to 71, up from 57.9 a year earlier.

Introduced in 2024, the privacy policy assessment scheme evaluates policies established and disclosed by personal information handlers to strengthen transparency and accountability in personal information processing. The 2025 assessment covered 50 representative services in seven fields that use new technologies or process large volumes of personal information: connected cars, edtech, smart homes, generative artificial intelligence, telecommunications, booking and customer management services, and health management apps.

The assessment criteria consisted of whether required items under the Personal Information Protection Act were properly reflected in the policy (adequacy), how easily users could understand the content from an actual user perspective (readability), and how easily it could be found (accessibility).

An expert evaluation committee conducted the adequacy assessment. Readability and accessibility were assessed by a user panel of 100 members of the public.

Samsung C&T’s HomNiq service in the smart-home category received the highest rating for the quality of privacy policy disclosures from both the evaluation committee and the user panel. Domestic connected-car operators such as Kia and Hyundai Motor scored highest in adequacy, as they described processing standards such as the collection and use, provision and outsourcing of personal information relatively clearly and showed efforts to guarantee data subjects’ rights.

In contrast, some overseas operators used names other than the standardised term “privacy policy” or provided guidance on exercising data subject rights only in English. They received lower ratings, particularly on readability and accessibility compared with domestic firms. The latest assessment again found cases in which policies were limited to formalistic drafting.

First, the match rate between the purposes, items and retention periods for personal information disclosed during actual service use and those stated in the policy was only 53 percent. In handling personal information complaints, phone inquiries were processed quickly, while email inquiries were found to face delayed responses or no response at all. Some operators in particular provided only automated replies and offered no further response. Some mobile apps required login or at least three steps to check the policy, leading to an assessment that access paths need to be simplified.

Yang Cheong-sam, the commission’s secretary general, said, “A privacy policy is a key mechanism that transparently shows a company’s personal information processing and guarantees data subjects’ rights.” He added, “This assessment confirmed that companies’ efforts to review and improve their policies are gradually spreading.”