Three Years Since Korea Abolished the Personal Data Validity Period — When Is Data From Unused Accounts Destroyed?

Tech Explainer October 19, 2026

In October, data of Hollys members who signed up before February 2020 was leaked That means data from accounts more than six years old was still on the servers

There used to be a personal data validity period rule (개인정보 유효기간제) that required separating or destroying data from accounts unused for a year The rule was abolished on September 15, 2023

Concept shot of long-neglected account data piling up on servers — Source: concept shot · self-generated with agy

What the validity period rule was

Timeline of the validity period rule from its 2012 introduction to its 2023 abolition — Source: self-rendered based on the Korea Law Information Center

The validity period rule required destroying or separately storing the data of people who hadn’t used an online service for one year Users had to be told what would be destroyed, and which items, at least 30 days before the period ended

It was first introduced in the Information and Communications Network Act in 2012 with a three-year threshold, and shortened to one year in 2015 In August 2020, it was moved into the special provision of Article 39-6 of the Personal Information Protection Act

Because of this rule, many sites switched members who hadn’t logged in for a year to dormant members and stored their data separately The dormancy release notice that popped up when you logged in is a trace of this rule

Why it was abolished and what changed

The basis is the Personal Information Protection Act (Act No. 19234), promulgated on March 14, 2023 It deleted Articles 39-3 through 39-8, the special provisions for information and communications service providers

The amendment was meant to resolve the problem of different rules applying to online and offline businesses for the same conduct

The validity period rule was among these special provisions and was abolished along with them

Item	Before abolition	After abolition
Handling after 1 year of non-use	Destroy or store separately	No obligation
Notice 30 days before	Required	None
When to destroy	1 year of non-use, purpose achieved	Retention period elapsed, purpose achieved
Dormancy policy	Legal obligation	Up to each business

The basic standard for destroying personal data now is Article 21 of the Personal Information Protection Act Data must be destroyed without delay when the retention period has passed or the processing purpose has been achieved and it is no longer needed

While the membership relationship continues, the purpose can be seen as not yet finished The difference after abolition is that an account you haven't deleted can remain even if you haven't used it for a long time

After the abolition, some sites dropped their dormancy policies and some keep them under their own rules Even for the same service, you have to check the retention period item in its privacy policy to know its storage policy

The annual notice that took its place

Thresholds of data subjects that trigger the duty to notify of use and provision history — Source: self-rendered based on the Enforcement Decree of the Personal Information Protection Act

The same amendment created notice of use and provision history (Article 20-2) as a general rule for personal data processors Covered businesses must tell users, at least once a year, for what purposes they used personal data and to whom they provided it

It covers those processing ordinary personal data of 1 million or more people, or sensitive or unique identifying data of 50,000 or more The count is the daily average over the three months before the end of the previous year

The notice comes by one of mail, email, text message, or app notification The “personal data usage notice” email you get every year is this notice, so it becomes a clue to sites you forgot you signed up for

Businesses below the threshold, such as small online shops or neighborhood store apps, have no duty to notify

How to find forgotten accounts

Lookup periods by verification method in the Personal Information Portal’s website account deletion support service — Source: Personal Information Protection Commission

The Personal Information Protection Commission’s Personal Information Portal offers free lookups of identity verification history and account deletion requests You verify your identity with one of a joint certificate, i-PIN, mobile phone, credit card, or social login

The lookup range differs by verification method Mobile phone covers the last 1 year, credit card the last 2 years, and resident registration number or i-PIN the last 5 years

Steps for using the Personal Information Portal’s identity verification history lookup — Source: Personal Information Protection Commission

So accounts signed up more than six years ago, like the Hollys ones, may not show up in this list!! Sites you joined with only an ID and password, without identity verification, are also excluded from deletion support

The results may also include sites where you only verified your identity without signing up Requests can be refused where points or payment balances remain and deleting the account would cause a financial loss

🔗 Link - https://www.privacy.go.kr/front/contents/cntntsView.do?contsNo=192

🔐 Checking for leaked passwords

You can check whether your ID and password are on a leak list at Find My Leaked Info (털린 내 정보 찾기)

Since a January 29, 2026 overhaul, you can also look up by email address It says the account details you enter are not stored in plain text

🔗 Link - https://kidc.eprivacy.go.kr

What to do now

Five steps to clean up unused accounts — Source: self-rendered based on the Personal Information Protection Act and Personal Information Portal guidance

Old accounts not on the portal list have to be deleted directly on each site Deleting an app does not count as deleting your account, so your data is destroyed only after going through the delete account menu in the app

I covered the scope of the Hollys leak and what affected members should do separately

Hollys Hacked — Passwords and Addresses of Pre-2020 Members Leaked