South Korea’s Personal Information Protection Act (PIPA)
With the rapid global movement of data, foreign companies operating in the Republic of Korea that collect or process personal information of Korean individuals are increasingly subject to local regulations.
Under South Korea’s Personal Information Protection Act (PIPA), certain foreign entities are now legally required to designate a domestic representative—and even for those who are not yet required, doing is a wise strategic choice. Pureum Law Office (PLO) is here to explain PIPA and is actively representing foreign firms operating in Korea as a Domestic Agent.
What Is a Domestic Representative Under PIPA?
A domestic representative (국내대리인) is a local agent designated by a foreign company to act on its behalf in South Korea regarding privacy-related matters.
This requirement applies to foreign companies that:
- Do not have a business address or office in Korea, but
- Collect or process personal data of Korean individuals, and
- Meet certain thresholds in terms of revenue or data volume, as defined by Presidential Decree.
The domestic representative acts as the point of contact for South Korean authorities and data subjects (individuals), and ensures compliance with Korean privacy laws.
PIPA to be amended from October 2, 2025
Under the amended Article 31-2 of PIPA, effective October 2, 2025, the domestic representative’s role will be further formalized and expanded:
1. Mandatory Responsibilities
The representative will be legally responsible for:
- Handling complaints and remedy requests from data subjects
- Notifying both data subjects and the Personal Information Protection Commission (PIPC) in the event of a data breach
- Submitting documents or materials requested by the PIPC
2. Who Can Be a Representative?
The domestic representative must:
- Have a physical address or business office in Korea
- Be one of the following:
- A Korean entity established by the foreign company
- A Korean entity under the significant control of the foreign company (e.g. board influence, capital ties)
3. Supervision Obligation
Foreign companies must train, oversee, and monitor their domestic representatives, and are fully liable for the representative’s actions under Korean law.
4. Privacy Policy Disclosure
Companies must disclose the following details of their representative in their privacy policies:
- Full name (or company name and representative)
- Physical address in Korea
- Phone number and email address
We Are Already Representing Global Clients
PLO already serves as domestic representatives for numerous companies around the world—from technology startups to global e-commerce brands.
We offer practical, responsive, and fully compliant services tailored to Korean privacy law.
If your company needs a domestic representative—or even if you’re unsure whether you meet the legal threshold—please don’t hesitate to reach out. We can evaluate your situation and recommend the best next steps.
Why You Might Need Legal Representation
Even if your business is not formally obligated under the current rules, recent incidents such as the SK Telecom USIM data leak show just how vulnerable personal data can be—even through third-party vendors or cloud services.
Designating a domestic representative proactively not only demonstrates responsibility to customers and partners—it also provides a crucial line of defense in the event of a privacy incident.
Get in Touch Today
To discuss how we can support your compliance strategy for Korea’s Personal Information Protection Act (PIPA) or serve as your official domestic representative, get in touch with us today.
Let us help.
Data moves fast—your legal response should too.
