We are acquiring a Korean company. Does customer data need notice or fresh consent at due diligence, and again at closing?

Key points. In an acquisition of a Korean business, customer data crosses at two moments, and Korea's Personal Information Protection Act ("PIPA") governs them with different provisions. Data room disclosure before closing is provision to a third party under article 17(1), and article 17(1)(ii) does not reach data collected on consent or for contract performance, which covers most customer records. Once a business transfer or merger actually moves the data, article 27 asks for notice, not consent, from the seller (article 27(1)) and separately from the buyer (article 27(2)); the buyer's duty falls away only if the seller has already notified. The PIPC fined both sides of one hospital transfer on the same day in November 2022. A share purchase ordinarily does not trigger article 27, but later group integration needs its own basis. The September 2026 amendment did not change these provisions.

The data room for a Korean target often contains a sample of the customer database or transaction histories. In many deals nobody asks what legal basis the seller has for providing that data, and when someone does, both sides tend to point to the business transfer provision.

That answer covers only half of the deal. Article 27 regulates the closing, when personal information is actually transferred, and the diligence stage before it has to be explained under a different provision.

Which provision applies at which stage of the deal?

The table below is the short version. Each row is explained in the sections that follow.

Does a data room disclosure need customer consent?

Article 27(1) is written for the case where a personal information controller transfers personal information to another person "due to the transfer of all or part of its business, a merger or similar". Article 27(3) then governs what the transferee may do with the data afterwards. All three paragraphs assume that the transfer has happened or is happening. If the deal fails, no transfer under article 27 ever occurs, yet the buyer already holds what it saw in the data room, and article 27 says nothing about that.

The seller therefore has to fall back on article 17(1). A controller may provide personal information to a third party in two cases: where the data subject has consented (article 17(1)(i)), or where the data is provided within the purpose for which it was collected under article 15(1)(ii), (iii) and (v) to (vii) (article 17(1)(ii)). Consent is rarely workable here. The seller would have to tell every customer that the business is being sold and ask for agreement, which collides with the confidentiality of the deal.

The second ground is narrower than it looks. Article 17(1)(ii) lists only some of the collection grounds in article 15(1). Data collected on consent (article 15(1)(i)) and data collected to perform a contract with the data subject (article 15(1)(iv)) are not on the list. Member sign-up data and service records fall into exactly those two categories, and they are the records most often requested in diligence.

What remains is article 17(4). It allows provision without consent within a range reasonably related to the original purpose of collection, in accordance with the Enforcement Decree. Article 14-2(1) of the Decree lists four factors: whether the provision is related to the original purpose; whether it was foreseeable in light of how the data was collected or how it is usually processed; whether it unfairly infringes the data subject's interests; and whether safeguards such as pseudonymisation or encryption were applied. In our reading, the first two factors carry the most weight on these facts; the Decree itself does not rank them. It is difficult to say that a customer who signed up for a service foresaw that the data would go to a prospective acquirer, and in our view strong security measures under the fourth factor are unlikely to make up for weakness on the first two.

Does pseudonymisation solve the problem?

Pseudonymisation is a weak basis to rely on here. Article 28-2(1) permits processing of pseudonymised information without consent for statistics, scientific research, archiving in the public interest "and similar" purposes. The list is open, but it is difficult to see acquisition diligence as a purpose of that kind.

The provision that removes the question is article 58-2: PIPA does not apply to information that, taking reasonable account of time, cost and technology, no longer identifies an individual even when combined with other information.

The first diligence question should therefore be what the buyer needs. Much of it is aggregate: member counts, distribution by consent type, records held past retention, data categories transferred abroad. Where a point can only be checked at record level, such as whether consent history matches the consent screen, deal teams consider inspection under the target's control instead of export. Inspection reduces what leaves the target, but if the buyer's reviewers see identifiable records, the question of a ground for provision may remain; and where those reviewers view the records from abroad, the "is viewed" language of article 28-8(1), discussed below, also comes into play. Our Korean note on the diligence request list lists the documents to request, including the privacy policy entries under article 30(1)(iii-2) and the transfer-basis documents under article 28-8(1).

What follows if the disclosure had no basis?

Data obtained in diligence stays with the buyer whether or not the deal closes. If the disclosure had no basis, the seller answers for an article 17 breach regardless of the outcome of the deal, and the buyer has to be able to explain why it still holds the data.

The statute attaches heavy consequences to that breach. Article 64-2(1)(i) lists processing in breach of article 17(1) among the grounds for a penalty surcharge of up to 3% of total revenue. Article 71(i) separately makes it an offence, punishable by up to five years' imprisonment or a fine of up to KRW 50 million, to provide personal information to a third party without consent where article 17(1)(ii) does not apply, and it extends that offence to a person who receives the data knowing those circumstances. How these apply to a given data room depends on what was disclosed and on which ground, but the criminal provision addresses the recipient as well as the provider.

Does a share deal trigger article 27 at all?

In a share purchase the target keeps its legal personality. The entity that holds the customer data does not change, so the article 27 transfer notice is ordinarily not engaged. The same holds where the target becomes a wholly owned subsidiary through a comprehensive share exchange or a small-scale share exchange under the Korean Commercial Act.

The question returns after closing, and two kinds of integration should be distinguished. Where the parent or another group company simply gains access to, or receives, the target's customer data while the target keeps running the business, that step is not governed by article 27. It is provision to a third party under article 17 or entrustment of processing (outsourcing) under article 26, and the group needs a basis for it. Where the integration instead moves the service or business itself to another group company, article 27 may apply, together with article 28-8 if that company is abroad, as discussed in the section on headquarters below. Where the receiving company is abroad, article 28-8 applies as well, and article 28-8(1) expressly treats data that "is viewed" from abroad as provided abroad. The integration plan should be reviewed before headquarters is given access to the target's systems.

Article 27(1) names a merger expressly, so mergers and business transfers sit in the closing layer described next. An asset deal sits there when it amounts to a transfer of all or part of a business; whether a purchase of the customer database alone does so is discussed further below.

What does article 27 require at closing, and from whom?

From the moment personal information actually moves, article 27 applies, and it divides the duty into two.

Article 27(1) is the seller's duty. A controller that transfers personal information to another person through a transfer of all or part of its business, a merger or similar must notify the data subjects in advance of three things:

1. the fact that the personal information is to be transferred;
2. the name (for a legal entity, its corporate name), address, telephone number and other contact details of the transferee; and
3. the method and procedure by which a data subject who does not want the transfer can act.

Article 27(2) is the buyer's duty. The transferee must notify the data subjects without delay once it has received the personal information. A proviso follows, which in an unofficial rendering reads: "This shall not apply where the personal information controller has already notified the fact of the transfer under paragraph (1)."

This proviso is the point most often misread. The buyer's duty is not waived in general. It falls away only on condition that the seller has performed its own duty. If the seller does not notify, or notifies without one of the three required items, the condition is not met and the buyer's duty remains.

Notice is given in writing or by a similar method (Decree article 29(1)). A seller that cannot use that method without fault must post the information on its website for at least 30 days, and only where website posting is impossible for a justified reason may it post at its premises for 30 days or publish in a newspaper (Decree article 29(2)). A breach of article 27(1) or (2) is subject to an administrative fine of up to KRW 10 million (article 75(4)(vi)).

Two points matter for headquarters. First, article 27 asks for notice, not fresh consent: the data subject receives information and a way to object. Second, under article 27(3) the transferee may use or provide the data only for the original purpose at the time of transfer, and is treated as the controller. Use for a new purpose would need its own basis, and article 71(ii) lists use or provision in breach of article 27(3) among the criminal offences.

When should the notice go out?

The PIPC's Integrated Guide on Processing Personal Information (July 2025) treats the time for notice as the point at which the decision is made, such as contract signing, rather than when the database physically moves. The notice belongs on the signing timetable, not the IT migration timetable.

Press coverage does not replace it. In the Facebook decision discussed below, the PIPC held that an expectation that users would learn of the change from press reports was irrelevant to whether the company had performed its duty.

Does a sale of the customer database alone count as a business transfer?

Some deals buy only the customer database as an asset, which raises the question whether article 27 applies at all.

Korean courts have divided on it. In a case where a marriage brokerage firm transferred its premium members' database and contracts, the court of first instance found insufficient evidence that the physical and human organisation had been transferred as a whole while keeping its identity, and declined to treat the deal as a business transfer under the Commercial Act or under article 27 (Seoul Central District Court, judgment of 30 April 2025, Case No. 2025Gadan74405). The appellate court disagreed. It held that the transfer agreement fell within "the transfer of all or part of a business, a merger or similar" to which article 27 applies (Seoul Central District Court, appellate judgment of 5 December 2025, Case No. 2025Na7191). Whether that judgment is final has not been confirmed.

The safer course is to review article 27 first even where only the database is bought; an omitted notice cannot be undone if a higher court takes the other view.

The same appellate court rejected the data subject's claim for consolation damages: even assuming a breach of the buyer's notice duty, the buyer had used the contact details only to ask about re-registration and the person had not asked for deletion. Breach and loss are separate questions, and the absence of civil damages does not prevent an administrative sanction. Per-person awards in Korean data cases are collected on the damages page.

What have sellers and buyers been sanctioned for?

The decisions below all concern the closing layer. They can be read alongside the full set of published decisions on the PIPC enforcement tracker.

Both sides of one hospital transfer, fined on the same day. On 16 November 2022, at its 18th plenary meeting, the PIPC decided two cases arising from the transfer of a Korean medicine hospital and its customers' personal information. The transferor had not given advance notice under article 27(1) and was fined KRW 1 million. The transferee had not given notice under article 27(2) and was fined KRW 1 million (Decision Nos. 2022-018-146 and 2022-018-147; respondents not named). The decision against the transferee records that the transferor had not notified under article 27(1) either, which is why the proviso did not relieve the buyer. The transferee later corrected the breach by text message. The two cases were decided under different versions of the Act, but paragraphs (1) and (2) had the same structure as today.

A seller fined although the buyer had emailed members. A provider of lecture services for public service examinations signed a transfer agreement with a transferee on 10 March 2020 without telling users in advance that their data would be transferred. The decision records that the transferee had notified members by email. The PIPC nonetheless found that the transferor had breached article 26(1) of the former Act on Promotion of Information and Communications Network Utilization and Information Protection (the "Network Act") and imposed an administrative fine (Decision No. 2022-007-045, decided 27 April 2022). The former Network Act split the duties between transferor and transferee as article 27 does now. The buyer's notice did not satisfy the seller's advance notice duty.

A buyer that did not notify after taking over a rental business. A camper van rental operator that acquired a business and did not notify data subjects without delay that it had received their data was among the findings in Decision No. 2024-007-181 (decided 24 April 2024). That decision also covered resident registration number processing, security measures and late breach notification and reporting, so its total fine cannot be attributed to the notice failure alone.

A change of contracting entity without notice. From 14 July 2018 Facebook changed the entity providing its service to Korean users from Facebook Ireland Limited to Facebook, Inc., without notifying users of the legally required matters. The PIPC treated this as a breach of article 26(1) and (2) of the former Network Act and fined each of the two companies KRW 6 million (Decision No. 2021-013-101, decided 25 August 2021). It is a former-law case, and the decision does not show whether there was a business transfer agreement.

The amounts are small, but a missing notice is visible on the face of the deal file and, as the camper van case shows, tends to sit alongside other findings. How Korean fines and surcharges are calculated is on the fine calculator page.

Moving the service to headquarters abroad: is article 27 notice enough?

Where moving a service from the Korean subsidiary to headquarters is a business transfer or merger involving a cross-border transfer, the PIPC's position is that both article 27 and article 28-8 apply. The Integrated Guide's question-and-answer section states that there is no reason to treat article 27 as a special rule displacing article 28-8. The article 27 notice therefore does not by itself supply a ground for the transfer abroad.

The Guide distinguishes two cases. Where the data stays in Korea and the transferee later moves it abroad, the transfer can be made under article 28-8(1)(iii) by disclosure in the privacy policy, if that item applies. Where the seller transfers the data directly to an overseas transferee, the Guide says only that this may be a cross-border transfer in the form of provision, without naming the item of article 28-8(1).

Our view is that a direct transfer of that kind needs separate consent under article 28-8(1)(i). Item (iii) covers entrustment of processing or storage needed to conclude and perform a contract with the data subject, which does not fit provision. If the direct transfer is provision, and neither a special provision of law or treaty (item (ii)) nor certification or an adequacy recognition (items (iv) and (v)) applies, the remaining ground is consent. Consent must be preceded by the five disclosures in article 28-8(2), including the destination country and the effect of refusal. We have found no interpretation, decision or judgment on this point, and the outcome can differ with the facts.

In our view article 27 also reaches a change of contracting entity made without a transfer agreement, since the Guide extends article 27 to arrangements with an effect similar in substance to a business transfer. Headquarters should also check that the privacy policy states the ground for the cross-border transfer (Decree article 31(1)(ii)) and whether it must designate a domestic representative under article 31-2. The certification and contract layers of a transfer to headquarters are covered in the certification note and the transfer contract note.

Did the September 2026 amendment change any of this?

The amended PIPA in force since 11 September 2026 (Act No. 21445) did not change the wording of articles 15(1), 17, 27, 28-2, 28-8 or 58-2, or of article 75(4)(vi). We compared them against the previous version (Act No. 20897) article by article.

What did change is article 64-2. A new paragraph (2) raises the surcharge ceiling to 10% of total revenue in three cases: a repeat breach of the same item within three years of a surcharge decision, limited to intentional or grossly negligent conduct; an intentional or grossly negligent breach where 10 million or more data subjects are affected; and a breach involving a leak or similar event that results from failure to comply with a corrective order under article 64(1). The former paragraph (2), which excludes revenue unrelated to the violation from the base, is now paragraph (3). For a buyer, the date and item of any past surcharge decision against the target should be pinned down, because only decisions on violations occurring after the amendment took effect can start the repeat-breach clock.

Checklist by deal stage

Each row pairs a requirement with the document that proves it. The last column should be filled by the end of the stage named in the first column: due diligence items before data room access closes, signing items at signing, closing items at closing, and integration items before the integration step is carried out.

On the representation row, two Supreme Court decisions from a single acquisition dispute are relevant; they concerned a cartel surcharge imposed by the Korea Fair Trade Commission, not a privacy sanction. The agreement contained representations of the type that the target had not violated administrative laws and was not under investigation. The Court held that a seller's inaccurate representation gives rise to a kind of liability for non-performance, decided under the representation and indemnity clauses where the agreement has them, and that, absent special circumstances, contingent liabilities arising for the target from causes before the transfer of control are the buyer's loss, setting aside a lower court that had refused to count the surcharge, fine and litigation costs (Supreme Court Decision 2017Da6108, 12 October 2018). In the earlier appeal in the same dispute, it held that the buyer's knowledge of the violation did not bar the claim on good-faith grounds where the agreement contained no clause excluding a knowing buyer, while leaving room for special circumstances (Supreme Court Decision 2012Da64253, 15 October 2015). Whether a privacy sanction is recoverable depends on the wording of the particular agreement. See our Korean note on representations and warranties.

Related

• Korea PIPC Enforcement Tracker: every published decision, searchable by article and amount
• Our headquarters is certified. Is that a transfer ground under Korean law?: the five grounds for cross-border transfer
• We signed the group DPA. What does Korean law separately require the transfer contract to contain?: the contract layer of a transfer to headquarters
• Your group DPA calls us a processor. Korean law has no such slot: why the DPA label does not fix the Korean entity's position after integration
• How Korean privacy fines are calculated: administrative fines and penalty surcharges
• M&A에서 고객 개인정보는 두 번 넘어갑니다 (Korean): the full version of this note

Frequently asked questions

Q. Can the seller rely on the business transfer provision, article 27, to share customer data in the data room?

Q. We are buying shares, not the business. Do customers have to be notified at closing?

Q. Is it enough for the seller to send the notice, or must the buyer notify customers as well?

Q. What have sellers and buyers actually been sanctioned for?

Sources

• Personal Information Protection Act (Act No. 21445, in force 11 September 2026), articles 15(1), 17, 21, 26, 27, 28-2, 28-8, 30(1), 31-2, 58-2, 64-2, 71 and 75: Korean text
• Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 36671, in force 11 September 2026), articles 14-2, 29 and 31(1): Korean text
• PIPC press release on sanctions against ten businesses (16 November 2022; 18th plenary meeting): Korean text. The decisions against the transferor and transferee (Nos. 2022-018-146 and 2022-018-147, respondents not named) are not on the PIPC decision board and are available as committee decisions in the National Law Information Center.
• PIPC Decision No. 2024-007-181 (24 April 2024), full text
• PIPC Decision No. 2022-007-045 (27 April 2022), former Network Act article 26(1), full text
• PIPC Decision No. 2021-013-101 (25 August 2021), Facebook, Inc. and Facebook Ireland Limited, former Network Act article 26(1) and (2), full text
• Seoul Central District Court, judgment of 30 April 2025, Case No. 2025Gadan74405 (first instance); Seoul Central District Court, appellate judgment of 5 December 2025, Case No. 2025Na7191
• Supreme Court Decision 2017Da6108 (12 October 2018); Supreme Court Decision 2012Da64253 (15 October 2015)
• PIPC, Integrated Guide on Processing Personal Information (July 2025), chapter VII on article 27: Korean text

This note is a general summary of Korean law for readers outside Korea and is not legal advice; what a particular acquisition requires turns on the deal structure, the data involved and the facts, and requires individual review. All English renderings of Korean statutes, decisions and guidance on this page are unofficial and carry no legal effect; the Korean text governs.

Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile; the page opens in Korean, with an ENG switch at the top right). Questions about this page can be sent through the contact page.