Question
Our company holds customers’ personal data and intends to use such information to send information about products, services, and promotional programs. May the company use customers’ personal data for advertising purposes? In which cases is the customer’s consent required?
Answer
Since 1 January 2026, the 2025 Law on Personal Data Protection has been effective and establishes specific requirements for the collection, processing, and use of personal data. As a general principle, personal data may only be collected and processed within a specific and clear scope and purpose and in accordance with applicable law.
Under the provisions on consent, consent is valid only when it is given voluntarily and the data subject is clearly informed of the type of personal data being processed, the purpose of processing, the personal data controller or personal data controller and processor, and the data subject’s rights and obligations. Consent must be expressed clearly and specifically and correspond to each processing purpose. Silence or failure to respond does not constitute consent.
In particular, where customers’ personal data is processed for the business of advertising services, the 2025 Law on Personal Data Protection requires the customer’s consent, provided that the customer is informed of the content, method, form, and frequency of product introductions. The enterprise must also provide a mechanism enabling customers to refuse to receive advertising information.
Accordingly, an enterprise should not automatically use all customer data previously collected for advertising purposes where the advertising purpose has not been notified or where there is no appropriate legal basis for such processing.
When implementing marketing activities, an enterprise should:
- Clearly determine the purpose of data use from the time of collection;
- Inform customers that their data will be used for advertising or marketing purposes;
- Obtain clear consent for advertising purposes where required by law;
- Retain evidence of the customer’s consent;
- Establish a mechanism allowing customers to withdraw consent or refuse advertising;
- Stop using personal data for advertising purposes upon a valid request from the customer; and
- Control the sharing or transfer of customer data to third parties for advertising purposes.
In addition to the Law on Personal Data Protection, enterprises must also comply with applicable regulations on advertising and the prevention of spam messages, spam emails, and spam calls when conducting advertising through electronic means. The current Law on Advertising also provides specific requirements for advertising through text messages, emails, and electronic media.
Conclusion
An enterprise may use customers’ personal data for advertising purposes where there is an appropriate legal basis and all applicable personal data protection requirements are satisfied. For advertising activities involving customers’ personal data, enterprises should pay particular attention to consent, transparency regarding the purpose and method of advertising, and mechanisms allowing customers to refuse or stop receiving advertising information.
