Portrait of Hyunsub Lee

I am a Korean-qualified lawyer and a partner at SEUM Law in Seoul. Since 2013 I have advised technology companies on Korean data protection law — start-ups, the Korean subsidiaries of foreign groups, and listed companies.

What I work on

  • Breach response. The first 72 hours, notification and reporting under art. 34, and what the record of those hours does later in an investigation or a claim.
  • PIPC investigations and enforcement. Responding to materials requests, prior notice and opinion submissions, and the surcharge calculation itself.
  • Cross-border transfers and structure. Art. 28-8 transfer grounds, what a group DPA does and does not cover under Korean law, domestic representative appointment, and chief privacy officer requirements for a Korean subsidiary.
  • Privacy policies and notices. Drafting and revising the Korean privacy policy against the mandatory contents in art. 30, and keeping the Korean and English versions as a matched pair. The English text is what a foreign parent actually reads, and the two drift apart quickly once local teams start editing one of them.
  • Consent design. Separating mandatory from optional consent, the separate consent that sensitive data (art. 23) and unique identifiers (art. 24) require, and the consent screens themselves. The defect is more often in the flow than in the wording.
  • Outsourcing arrangements (what a group DPA calls a processor). Whether a given arrangement is outsourcing or a third-party provision under Korean law — that classification drives the paperwork, not the other way round — and the art. 26 documentation and disclosure that follow.
  • CCTV and location data. Workplace and premises CCTV under arts. 25 and 25-2, and registration, reporting and terms of service under the Location Information Act.
  • Disputes after an incident. Who bears what between the company and its entrustee (the processor, in GDPR terms), and how recourse is actually calculated.
  • Investment and M&A. Privacy findings in diligence, and how they are carried into representations, warranties and covenants.

If you are writing from outside Korea

Two situations bring a company outside Korea to a Korean privacy lawyer.

A Korean counterparty asks for an independent opinion. Their legal team wants a Korean-law opinion on your product or service before it goes in. I write an English memo that their Korean in-house counsel can check. Each conclusion is tied to the statute and to published PIPC guidance. A conclusion that depends on a fact, such as how equipment is installed, is stated as conditional. Conclusions, factual assumptions, recommended changes and open points are kept separate. If the arrangement does not work under Korean law, the memo says so and sets out an alternative.

A Korean regulator writes to you. You have no Korean entity, and a letter arrives from the Korea Internet & Security Agency or another Korean authority, about your privacy policy or about registration or reporting under the Location Information Act. I check the reply deadline, ask for an extension where needed, work out whether the requirement applies, and file the reply in Korean.

The contact page sets out what to send.

Why this site exists

Most of what I write here is in Korean, because the primary readers are Korean legal and privacy teams. The material is built from primary sources — decisions, statutes and notices read in the original — and the underlying tables are published alongside the writing so a reader can check the basis rather than take the summary on trust.

For readers outside Korea there is a smaller set of English pages:

Background

  • Partner, SEUM Law (2013–present)
  • Member, IT and Blockchain Committee, Korean Bar Association (2019–2021)
  • Expert adviser, Korea Creative Content Agency (2023–2025)
  • Yonsei University Law School; KAIST, Industrial and Systems Engineering
  • Author, Legal Strategy for Startup Growth (Dasan, 2025) and co-author, What Makes a Winning Law Firm (Parkyoung, 2022)

Contact

Write in English or Korean; I answer in either. The contact page sets out what I work on, what happens after you write, and how long a reply takes.

한국어 소개는 이쪽입니다.

Everything on this site is general information, not legal advice, and reading it does not create a lawyer-client relationship. English translations of Korean legislation are unofficial and carry no legal effect; the Korean text governs.