Korea urges call centers to mask customer data after inspection
- South Korea’s PIPC inspected five service providers and four call center operators.
- The operators were MetaM, Ubase, transcosmos Korea and Hunect.
- The inspection followed a March case involving an outsourced Baemin call center counselor.
- The PIPC issued four action rules, including masking standards for key personal data.
SEOUL, SOUTH KOREA — South Korea’s privacy regulator wants call centers to mask customers’ personal details and tighten who can look them up, after an inspection found counselors could pull up detailed addresses by entering just a name or phone number. The review covered five major service providers and four call center operators, including transcosmos Korea.
An outsourced agent’s crime set it off
The Personal Information Protection Commission (PIPC) reviewed the results of a preliminary inspection and recommended corrective measures at a plenary meeting on Oct. 28, Chosun Biz reported on Oct. 29. The inspection was prompted by a case in March in which an outsourced call center counselor for Baemin unlawfully accessed customer data and used it for a retaliatory crime.
The service providers, from online shopping and delivery, home shopping and fixed-line telecommunications, were Coupang, Great Imagination, CJ ENM, Gmarket and SK Broadband. The call center operators were MetaM, Ubase, transcosmos Korea and Hunect.
Gaps in access and logging
One company did not apply secure authentication methods, such as certificates or security tokens, when its customer information system was accessed from outside. Others left required items out of personal information access logs or kept records for one year, shorter than the two-year statutory retention period.
Some outsourced personal information processing without disclosing the entrusted work and the subcontractors. The regulator also found names, phone numbers and addresses shown on counseling screens without masking, and warned such cases could lead to misuse or abuse of personal information.
Four rules for call centers
Based on the results, the PIPC drew up four action rules for call center personal information protection, including recommended masking standards for key personal information. Call centers should display and query only the data a task needs, limit access rights to the staff who need them, retain and review query logs, and strengthen oversight of counselors and call center operators.
The commission will verify whether its recommendations are being carried out. It also plans publicity for the rules and briefings for related industries to spread the principle of minimal querying and use of personal information across call center operations.
What it means for buyers
The rules reach past the operators to the brands that hire them, since the inspection covered both service providers and call center operators. For companies that outsource support in South Korea, the masking and access controls on a vendor’s agent screens are now under regulator scrutiny.
Buyers reviewing call center or customer service contracts can compare providers on OA’s list of the top BPO companies worldwide.
Related news
- Ireland fines Coinbase unit $3.6Mn over outsourcing oversight · 27 Oct 2026
- South Korea’s Ubase acquires Return Zero to complete its AICC stack · 1 Jun 2026
- South Korea to inspect call centers after major data breach · 11 Apr 2026
Disclosure: Outsource Accelerator uses AI tools in the backend of its editorial workflow. Every article is reviewed and verified by a human editor before publication.
Stay ahead of the outsourcing industry. Join thousands of business leaders who rely on Outsource Accelerator for the news, trends, and expert insights that matter. Subscribe to our free newsletter and never miss an update.
