Korea AgentDirect Check Your Requirements

Personal Information Protection Act

PIPA Domestic Representative in South Korea

PIPA requires certain qualifying foreign personal-information controllers without their own Korean address or place of business to appoint a domestic representative for privacy complaints and damage relief, personal-information breach procedures and PIPC material submissions.

Requirement in force Enhanced rules in force since 2 October 2025 Personal Information Protection Commission (PIPC)
Check Your Requirements Review the scope

Who may be affected?

Foreign controllers without their own Korean address or place of business

Applicability depends on the company’s legal role in processing personal information, whether the relevant processing falls within PIPA, the statutory scale or regulatory trigger, and whether a qualifying Korean corporation must be appointed.

What is a personal-information controller?

Under PIPA, a personal-information controller is a public institution, company, organization or individual that processes personal information, directly or through another person, in order to operate a structured personal-information file for business purposes. In practical terms, this commonly includes a business that decides why and how customer, user, employee, applicant, seller or partner information is collected, stored, used, shared or deleted.

What counts as personal information?

Personal information is information about a living individual that identifies the person, can reasonably be combined with other information to identify the person, or has been pseudonymized as defined by PIPA. Depending on context, this may include names, contact details, account information, device or online identifiers, location data, purchase and usage records, support communications and other information linked to an identifiable person.

Common foreign business profiles

  • Online platforms, social networks and communication services
  • SaaS, cloud, AI and digital-service providers
  • E-commerce businesses, marketplaces and mobile applications
  • Gaming, media, travel, mobility and subscription businesses
  • Other foreign businesses controlling personal information relating to individuals in Korea

Preliminary applicability checklist

  • The foreign company is the relevant personal-information controller for the processing at issue. A company acting only as an outsourced service provider under another controller’s instructions requires separate classification; contractual labels alone are not decisive.
  • The foreign controller itself has no address or place of business in South Korea.
  • At least one of the three alternative statutory triggers below is met.
  • Any Korean corporations established or controlled by the foreign controller have been reviewed before an independent representative is considered.
  • The appointment will be made in writing and the prescribed representative information will be included in the privacy policy.

The three alternative triggers

  • Revenue: Total worldwide revenue in the previous year or previous business year was at least KRW 1 trillion.
  • Data-subject scale: During the three months immediately preceding the end of the previous year, the daily average number of data subjects in Korea whose personal information was stored and managed was at least one million.
  • PIPC trigger: The controller was ordered to submit relevant goods, documents or other materials under PIPA Article 63(1), and the PIPC deliberated and resolved that appointment of a domestic representative was necessary.

The conditions are alternatives. Meeting any one of them can trigger the appointment requirement. Foreign-currency revenue is converted to Korean won using the previous year’s average exchange rate.

When a Korean corporation must be appointed

If the qualifying foreign controller established a Korean corporation, or has a Korean corporation over which it exercises the prescribed controlling influence, it must appoint the representative from among those Korean corporations. The control tests include authority to appoint or dismiss the representative director, authority to appoint or potentially appoint at least 50% of the officers, or ownership of at least 30% of the issued shares or total capital contributions. An independent third-party representative is generally relevant only when no such qualifying Korean corporation exists.

Objective scope matrix

Separate the statutory representative role from the controller’s retained obligations

The appointment covers defined PIPA functions. It does not transfer control of the company’s personal-information processing or its wider privacy and security obligations.

01 · Statutory functions

Functions assigned by PIPA

  • Handle complaints concerning personal-information processing and perform related damage-relief work.
  • Perform the applicable notification to affected data subjects and reporting procedures for personal-information breaches.
  • Submit goods, documents and other materials requested by the PIPC under PIPA Article 63(1).

02 · Proposed Korea Agent Direct scope

Korean coordination framework

  • Act as the written and publicly disclosed domestic representative after eligibility and appointment priority are confirmed.
  • Maintain approved Korean telephone, email and address contact information.
  • Receive, log and escalate covered privacy complaints and damage-relief matters under an agreed identity-verification and response procedure.
  • Coordinate client-approved breach notifications and reports using information and decisions supplied by the controller.
  • Receive and coordinate responses to covered PIPC material-submission requests and maintain activity records.

03 · Optional support

Separately approved services

  • Broader intake coordination for access, correction, deletion, suspension or objection requests.
  • Privacy-policy disclosure coordination and Korean-language administrative support.
  • Incident-response workflow support and coordination with independent Korean privacy counsel or technical specialists.
  • Annual work-plan, training, rehearsal and oversight-documentation support.

04 · Foreign controller

Client-retained responsibilities

  • Remain the personal-information controller and determine the purposes, means and legality of processing.
  • Investigate incidents, determine whether notification or reporting is required, and provide complete and accurate facts.
  • Make substantive complaint, remedy, rights-request, disclosure and regulator-response decisions.
  • Carry out access, correction, deletion, suspension, security, retention and technical remediation actions.
  • Manage and supervise the representative and maintain the required privacy-policy disclosure.

Mandatory management and supervision after appointment

The foreign controller must ensure that the representative performs its work faithfully. The Enforcement Decree requires the controller to provide training on the representative’s duties at least once each year and to check whether the representative has prepared a work plan, implemented that plan and corrected matters identified for improvement. These are continuing controller obligations, not optional features of the appointment.

Appointment does not create a general outsourcing relationship

Designation as domestic representative does not by itself make Korea Agent Direct the controller, processor, data host, security operator or decision-maker for the foreign company’s personal information. Any separate processing of personal information by Korea Agent Direct must be identified, documented and governed under an independently agreed scope.

Administrative-fine exposure

Failure to appoint a required representative, appointment contrary to the mandatory Korean-corporation rule, or failure to manage and supervise the representative may each result in an administrative fine of up to KRW 20 million. Failure to include the prescribed representative information in the privacy policy may result in an administrative fine of up to KRW 10 million. Separate sanctions may apply to the underlying complaint, breach or regulator-response obligations.

Appointment and operation

A documented privacy-representative process

PIPA requires a written appointment and public disclosure in the privacy policy. It does not establish a general advance registration filing merely for designating the representative, although regulator communication may arise in a specific matter.

Typical process

  1. Confirm the foreign company’s controller status and the Korean processing activity to which PIPA may apply.
  2. Test the prior-year revenue, three-month daily-average data-subject count and any PIPC designation trigger.
  3. Review Korean corporations, ownership, officer-appointment rights and mandatory appointment priority.
  4. Define the statutory functions, secure channels, approval authority, escalation contacts, work plan and oversight procedure.
  5. Execute the written appointment and update the privacy policy with the prescribed representative information.
  6. Operate complaint, incident, regulator-response, recordkeeping, annual training and work-status review procedures.

Privacy-policy information that must be disclosed

  • The representative’s name; for a corporate representative, the corporate name and the name of its representative
  • The representative’s Korean address or, for a corporation, the location of its place of business
  • Telephone number
  • Email address

Information normally requested after initial contact

  • Certificate of incorporation and current corporate registry extract
  • Privacy policy and Korean-facing privacy notices
  • High-level description of Korean personal-information categories, purposes, systems and data flows
  • Previous-year total worldwide revenue and supporting calculation
  • Method and records used to calculate the prescribed daily-average number of data subjects in Korea
  • Korean corporation, ownership and officer-appointment information
  • Complaint, damage-relief, rights-request and incident-response procedures
  • Privacy, security, legal and technical escalation contacts
  • Relevant PIPC or Korean authority correspondence, if any

No personal information through the public inquiry form

Do not submit identity documents, credentials, personal-information samples, live data-subject requests, breach details or security evidence through the public form. A separately approved secure exchange method is arranged after initial contact.

Applicable law and sources

Personal Information Protection Act (PIPA)

Key provisions: Act Articles 2, 31-2, 34, 63 and 75; Enforcement Decree Article 32-3

Authority: Personal Information Protection Commission (PIPC)

Regulatory information last verified: 2026-07-22 Primary Korean statutory text controls.

Frequently asked questions

Practical qualification and scope questions

Does every foreign company processing information about Korean users need a PIPA representative?

No. The company must be the relevant personal-information controller, have no address or place of business in Korea, and meet at least one of the statutory revenue, data-subject-scale or PIPC triggers. Processing information about a small number of Korean users does not by itself create the appointment obligation.

Is the one-million threshold based on website visitors or registered accounts?

Not necessarily. The statutory test concerns the daily average number of data subjects in Korea whose personal information was stored and managed during the three months immediately preceding the end of the previous year. The company should document which individuals are counted and avoid treating traffic, downloads or accounts as automatic substitutes.

Can an independent service provider be appointed when the foreign company has a Korean subsidiary?

Not where the Korean corporation falls within the mandatory appointment categories. A qualifying foreign controller that established a Korean corporation, or controls one under the prescribed officer-appointment or 30% ownership tests, must appoint from among those Korean corporations.

Does the representative handle every access, deletion or objection request?

Not automatically. The statutory representative function is focused on complaints concerning personal-information processing and related damage relief, breach procedures and PIPC material submissions. Broader data-subject rights intake or administration may be agreed separately, while the controller remains responsible for decisions and technical action.

Must the appointment be registered with the PIPC?

PIPA requires a written appointment and inclusion of the prescribed representative information in the privacy policy. The Act does not establish a general advance registration filing solely for the appointment. Specific communications or submissions may nevertheless be required in an investigation, breach or other regulatory matter.

Does appointment transfer PIPA responsibility to Korea Agent Direct?

No. The foreign controller remains responsible for compliance and for managing and supervising the representative. Where the representative violates PIPA in performing the assigned statutory functions, the conduct is treated as conduct of the appointing controller.

Preliminary review

Discuss PIPA representative requirements

Share basic company information. Agent Direct will use it for a preliminary non-legal screening and to discuss an appropriate next step.

Do not send sensitive material.

Do not submit credentials, identity documents, breach details, personal-data requests, confidential evidence or files through this form.

Service
Primary servicePIPA Domestic Representative
Interested in another representative service?
Company and contact
Korean activity
Give a high-level description only; do not include confidential or personal data.
Service-specific information Optional
Additional context

Submitting an inquiry does not create an appointment, legal assessment or attorney-client relationship.

Related representative services

One company may face more than one regime