Key points. Korea's Personal Information Protection Act ("PIPA") does not bar a chief privacy officer ("CPO") from holding another post. Where the Network Act restricts the chief information security officer ("CISO") from other roles, it lists the CPO's duties as a permitted role, and since 11 September 2026 that permission refers to article 31(4) of PIPA, which now includes securing budget and staff and reporting to the representative and the board. The person chosen must come from the categories in article 32(2)(ii) of the Enforcement Decree: the owner or representative, or an officer of the Korean entity. A regional DPO who does not execute the Korean entity's business in such a position is likely to fall outside those categories. For controllers above the article 32(3) threshold, the CPO also needs four years of combined experience including two years in personal information protection, and each designation, change or removal needs a filing with the PIPC and, for a corporation, a board resolution. Three administrative fines of up to KRW 30 million each have applied to these duties since 11 September 2026.
The question usually arrives in one of two forms. Either the Korean entity has a CISO who reports into group security, and headquarters asks whether that person can also be the Korean CPO. Or the group privacy office has listed its Asia-Pacific DPO as the CPO in the Korean privacy policy, and someone asks whether that still works after 11 September 2026.
Whether a CISO may hold the CPO role is mainly a Network Act question. Whether a particular person may be designated is a question under article 31 of PIPA and article 32 of its Enforcement Decree. This note takes them in that order and then turns to the duties that follow.
Which rules answer which question?
| Question | Provision to check first | Changed on 11 September 2026? |
|---|---|---|
| May the CISO also act as CPO? | Network Act article 45-3(3) and (4)(ii)(d) | The cross-reference in item (d) was corrected to PIPA article 31(4) |
| Who may be designated as CPO? | Enforcement Decree article 32(2)(ii) | The same categories existed before; the officer category now refers to the Commercial Act |
| Does the CPO need specific experience? | Enforcement Decree article 32(2), second sentence, and Attached Table 1 | The revenue threshold moved from KRW 150 billion or more to more than KRW 180 billion |
| Is a board resolution or filing required? | PIPA article 31(3); Enforcement Decree article 32(3) and (4) | New |
| What sanctions apply? | PIPA article 75(2)(xiv-2) to (xiv-4) | New; the former fine for non-designation was up to KRW 10 million |
The Korean text of the changed provisions, with an unofficial English translation, is on the amendment text page.
Can the CISO also act as the CPO?
Article 31 of PIPA sets out who designates a CPO, what the CPO does and how the CPO's independence is protected. It contains no rule against combining the role with other functions. For most companies, therefore, the real question is whether the person meets the designation requirements discussed below.
The Network Act adds a restriction for some companies. Article 45-3(3) of the Network Act bars the CISO of certain information and communications service providers from holding roles other than those listed in article 45-3(4). The Enforcement Decree of the Network Act, in article 36-7(5), sets the threshold at total assets of KRW 5 trillion or more at the end of the preceding business year, or total assets of KRW 500 billion or more for providers that must obtain ISMS certification. For those companies, item (d) of article 45-3(4)(ii) is the only route by which the CISO can also act as CPO, because it lists the CPO's duties under PIPA among the permitted roles.
What changed for a CISO-CPO on 11 September 2026?
Before 11 September 2026, item (d) referred to the CPO's duties under "article 31(2)" of PIPA. That reference was accurate when the Network Act provision was drafted, because article 31(2) then listed the CPO's duties. A 2023 amendment (Act No. 19234) restructured article 31. In the version in force from 15 March 2024, article 31(2) became a deeming rule: where a small controller does not designate a CPO, the owner or representative is treated as the CPO. The list of duties moved to article 31(3). The Network Act was not amended at the same time, so for about two and a half years item (d) pointed to the deeming rule rather than to the list of duties.
Act No. 21445, which took effect on 11 September 2026, corrected the reference. Article 4(2) of its addenda amends item (d) so that it refers to "article 31(4)" of PIPA. The duties had moved again in the amended Act, from paragraph (3) to paragraph (4), and this time the cross-reference followed them.
The corrected reference matters because article 31(4) is longer than the list it replaced. The amended Act added two duties:
- item (ii): the management of the staff needed for personal information protection and the securing of budget; and
- item (iii): reporting on the state of personal information protection and on significant matters to the business owner or representative and to the board.
Item (d) cites article 31(4) as a whole, so a CISO who also acts as CPO now carries these two duties in the CPO capacity.
According to our Korean note, a Network Act amendment in force from 1 October 2026 (Act No. 21500) also added budget and board-reporting duties to the CISO's own role, so a person holding both roles carries them under two statutes.
Does the CISO meet the CPO designation requirements?
Two requirements in article 32 of the Enforcement Decree apply to the person.
The first is the category of person. Article 32(2)(ii) requires a controller other than a public institution to designate its business owner or representative, or an officer. The officer category in item (b) expressly includes persons who executed the company's business under article 401-2(1)(iii) of the Commercial Act and executive officers under article 408-2(1) of that Act. Only where the company has no officers may it designate the head of the department responsible for personal information processing. A CISO who sits below officer level in a company that does have officers would not fall within these categories.
The second is experience, and it applies only to the larger controllers listed in article 32(3). For a company, article 32(3)(i) covers a controller whose annual revenue exceeds KRW 180 billion and which either processes sensitive or unique identifying information of 50,000 or more data subjects, or processes personal information of 1,000,000 or more data subjects. Article 32(2) then requires those controllers to choose a CPO who meets Attached Table 1.
Attached Table 1 requires at least four years of combined experience in personal information protection, information security and information technology, of which at least two years must be in personal information protection. This is where a CISO is most often caught. A long security career counts towards the four years but does not by itself supply the two years of personal information protection experience. Where two kinds of work overlap in the same period, only one is counted. Relevant degrees count for set periods, and the PIPC may recognise further qualifications or training by notice.
Article 2(1) of the addenda to Presidential Decree No. 34309 treated existing designations as meeting the experience requirement for two years from 15 March 2024. On its terms, that period has run, so a designation that relied on it should be reviewed against Attached Table 1.
Can headquarters' regional DPO be the Korean CPO?
The same article 32(2)(ii) answers the second question. The categories are the business owner or representative and an officer, with the department head available only where there are no officers. In our reading, "officer" means an officer of the controller that makes the designation. Where the Korean entity is the controller, that is the Korean entity.
Because item (b) reaches beyond registered directors, the absence of a board seat or an executive officer appointment does not by itself decide the point. A regional DPO employed by headquarters who does not execute the Korean entity's business in an officer position or under such a title is, in our reading, likely to fall outside these categories. The rule is not new. The same categories were in the Decree before 11 September 2026, as article 32(3)(ii). What the amendment added was the express reference to the Commercial Act in the officer category, and the sanctions described below.
The Commercial Act references also work in the other direction. A Korean entity that looked only at its register of directors, found no officers and designated a department head should check that conclusion against the wider wording now in item (b). Which persons those provisions cover in a given structure turns on the appointment and the authority actually exercised, and this page does not go into it.
In practice, a group that wants its regional DPO to lead Korean privacy compliance has two broad arrangements to consider. One is to make the regional DPO an officer of the Korean entity, so that the designation can fall within item (b). The other is to designate a Korean officer as CPO and to give the regional DPO a defined supporting role. Which arrangement fits depends on the group's governance, and for a controller above the article 32(3) threshold either choice now passes through a board resolution and a filing.
A domestic representative under article 31-2 is a different appointment. It applies to controllers with no address or place of business in Korea, covers grievance handling under article 31(4)(v), breach notification and the submission of materials, and does not replace a CPO; the domestic representative page covers it. Separately, article 26(8) applies article 31 to entrustees, so a Korean entity that processes personal information on headquarters' instruction carries the designation duties in its own name, as described in the processor note.
What did 11 September 2026 add to the designation itself?
Sanctions. Article 75(2) now contains three items on the CPO, each with an administrative fine of up to KRW 30 million:
| Item | Conduct |
|---|---|
| 14-2 | Failing to designate a CPO under article 31(1), or designating a person who does not meet the qualification requirements under article 31(10) |
| 14-3 | Designating, changing or removing a CPO without a board resolution under article 31(3)(i) |
| 14-4 | Failing to file the designation, change or removal under article 31(3)(ii) |
Before 11 September 2026, the only fine was up to KRW 10 million for failing to designate a CPO, under former article 75(4)(ix). That item was deleted by the amendment. Each new item states that it includes cases where the duty applies through article 26(8), which brings entrustees within it. Item 14-2 refers to the qualification requirements under article 31(10), which delegates both qualifications and other matters to the Decree. Whether a designation outside the article 32(2)(ii) categories is treated as a designation of a person lacking the qualifications is a reading that the PIPC has not, to our knowledge, set out in a published decision; the safer course is to assume that it may be.
Board resolution and filing. Article 31(3) requires controllers that meet the Decree criteria to obtain a board resolution, where the controller is a corporation, whenever a CPO is designated, changed or removed, and to file the designation, change or removal with the PIPC. The criteria are the same list in article 32(3) that triggers the experience requirement. The fine table and how fines are set are on the fine calculation page.
Deadline. Article 32(4) of the Decree requires the filing within six months from the day the reason for it arises, using a form set by PIPC notice. Where an unavoidable reason prevents filing in time, such as difficulty in convening the board for business reasons, the PIPC may extend the period by up to one year at the controller's request. Our Korean note records that the form is in PIPC Notice No. 2026-11, in force from 11 September 2026, and that the PIPC's FAQ of 10 September 2026 directs filings to the "CPO 신고" menu on the privacy portal (www.privacy.go.kr).
Existing designations. The Act's own addenda contain no transitional provision on article 31. Article 2 of the addenda to Presidential Decree No. 36671 fills the gap. A controller that meets the article 32(3) criteria and designated its CPO before 11 September 2026 must file that designation within six months from the date the Decree took effect (addenda article 2). The provision requires a filing and does not require the board to resolve the existing designation again. Our Korean note reports that the PIPC's FAQ of 10 September 2026 (Q5) gives the same answer, and that the same FAQ treats the CPO of the controller that appointed a domestic representative, rather than the domestic representative itself, as the person to be filed.
For a Korean entity that meets the article 32(3) criteria and keeps its current CPO, the addenda therefore call for a filing and not for a fresh board resolution. A Korean entity outside those criteria has neither duty. In both cases, keeping the current CPO does not end the review: the person still has to fall within the article 32(2)(ii) categories and, for controllers within article 32(3), meet Attached Table 1. Replacing a regional DPO with a Korean officer is a change of CPO after 11 September 2026; for a controller meeting the criteria it needs a filing, and a board resolution first where the controller is a corporation. Appointing the same regional DPO as an officer of the Korean entity is different, because the person designated does not change. The text does not settle whether that change of position alone calls for a resolution, and the conservative course is to take a board resolution and file. Where the board meets quarterly and needs headquarters approval, the board slot should be scheduled early.
Reporting lines and budget when headquarters holds both
Article 31(4)(iii) of the Act makes reporting on the state of personal information protection and significant matters to the business owner or representative and to the board one of the CPO's duties. The Act names both recipients.
The Decree adds a separate requirement on the controller. Article 32(7)(ii), which has applied since 2024 in an earlier numbering, requires the controller to set up a system through which the CPO can report regularly and directly on the privacy plan and its results; the Decree's wording here is "to the representative or the board". A CPO who reports only to the global privacy office, with the Korean representative informed afterwards, does not appear to meet either provision.
The budget duty works in the same way. Article 30-3, new on 11 September 2026, makes the owner or representative the final person responsible for the safe processing of personal information and requires them to provide the staff and sufficient budget needed. Article 31(4)(ii) gives the CPO the duty to manage staff and secure budget. Article 32(7)(iii) of the Decree requires the controller to provide the CPO with an organisation and resources suited to the work. Read together, these provisions do not appear to require that the CPO hold budget authority. They point to a CPO who estimates what is needed, requests it, confirms what was allocated and reports any shortfall. Where headquarters sets the budget, a record that identifies the share allocated to Korea is, in our view, the clearest way to show this.
Neither article 31(4)(ii) nor (iii) carries an administrative fine, and article 31 is not among the grounds for a penalty surcharge in article 64-2(1). The records still matter. Article 64-2(6) requires the PIPC to reduce a penalty surcharge where the company has invested in budget, staff and equipment for personal information protection, unless the violation was intentional or grossly negligent, and article 60-2(5) of the Decree lists among the factors the owner's or representative's discharge of article 30-3 and the role, organisation and staffing of the CPO. For a CISO who is also the CPO, we therefore recommend recording the security budget and the personal information protection budget separately. No provision requires this; it is a record-keeping practice that makes the privacy share identifiable. The CPO's records are also examined in investigations, as the next section shows.
What has the PIPC asked about CPOs in recent decisions?
Two 2026 decisions, as read in our Korean note, show how the PIPC treats CPO governance.
In the KT decision (Resolution No. 2026-015-093, 29 July 2026), the PIPC imposed a penalty surcharge of KRW 53,979 million for a breach of the duty to take safety measures. Its corrective order also required KT to define clearly the responsibilities and role of the CPO so that the CPO oversees personal information processing across the company, and to build and improve a governance structure that allows protective measures to be carried out quickly.
In the Lotte Card decision (case No. 2025조일0053-01, 11 March 2026), the PIPC imposed a penalty surcharge of KRW 9,620 million for a breach of the restrictions on processing resident registration numbers. The corrective order required Lotte Card to improve its privacy governance, including by strengthening the CPO's accountability and independence. In the investigation, the CPO and a developer could not locate any decision record for the logging practice in question, and the decision counted that gap as weak compliance monitoring when it assessed the violation as very serious.
Both show the PIPC asking the CPO what was decided and on what record.
Checklist: designation and evidence
The table pairs each item with a record that would show it. Most rows rest on a provision; the last row is a recommended practice and is marked as such. If the last column is empty, the review is not finished.
| Item | Provision | What to confirm | Record to keep |
|---|---|---|---|
| Category of person | Decree art. 32(2)(ii) | The CPO is the owner or representative, or an officer of the Korean entity; a department head only if there are no officers | Appointment documents; register of directors and executive officers |
| Experience | Decree art. 32(2), Attached Table 1 | For controllers within art. 32(3): four years combined, two years in personal information protection, overlaps counted once | Career summary mapped to the three categories, with dates |
| Threshold | Decree art. 32(3) | Revenue above KRW 180 billion, together with the data subject counts | Revenue figure and data subject counts at a fixed reference date |
| Board resolution | PIPA art. 31(3)(i) | Only for a corporation meeting the art. 32(3) criteria: resolution for any designation, change or removal after 11 September 2026 | Board minutes |
| Filing | PIPA art. 31(3)(ii); Decree art. 32(4); Decree addenda art. 2 | Only for controllers meeting the art. 32(3) criteria: filing within six months; for existing designations, within six months from 11 September 2026 | Filing receipt |
| CISO combination | Network Act art. 45-3(3), (4)(ii)(d) | Whether the company is subject to the CISO restriction, and that the CPO role is the permitted one | Note of the threshold check |
| Reporting line | PIPA art. 31(4)(iii); Decree art. 32(7)(ii) | Reports to the representative and the board (Act); a system for regular, direct reports (Decree) | Board agenda and reports |
| Budget and staff | PIPA arts. 30-3, 31(4)(ii); Decree art. 32(7)(iii) | Requests, allocation to Korea, shortfall reports. Recommended practice, not a statutory requirement: privacy budget recorded separately from security budget | Annual request, allocation notice, intra-group cost allocation |
Whether a particular structure meets these requirements depends on the facts, and the answer can differ between Korean entities.
Related
- Korea's PIPA: 2027 changes and the AI exception (unofficial translation): article 31, Decree article 32 and Attached Table 1 in Korean and English
- Appointing a domestic representative: a separate appointment for controllers without a Korean address
- How Korean privacy fines are calculated: the surcharge formula and the administrative fine table
- Your group DPA calls us a processor: how article 26(8) applies the CPO duties to entrustees
- Korean privacy and IT law: what takes effect when: the dates of the 2026 and 2027 changes
- CISO가 CPO를 겸할 수 있나요? (Korean): the full version of the CISO section of this note
- 본사 APAC DPO를 한국 CPO로 올려 두었습니다 (Korean): designation, filing and the KT and Lotte Card orders
- 본사가 예산을 쥔 한국법인의 CPO (Korean): budget and reporting duties where headquarters sets the budget
Frequently asked questions
Q. Can the CISO of our Korean entity also serve as its chief privacy officer?
Q. Can headquarters' regional DPO be designated as the Korean entity's chief privacy officer?
Q. We designated our CPO before 11 September 2026. Do we need a new board resolution?
Q. What are the sanctions for getting the CPO designation wrong?
Sources
- Personal Information Protection Act (Act No. 21445, promulgated 10 March 2026, in force 11 September 2026), articles 26(8), 30-3, 31, 31-2, 64-2(1) and (6) and 75(2), and article 4 of the addenda: Korean text
- Personal Information Protection Act (Act No. 20897, in force 2 October 2025 to 10 September 2026), articles 31 and 75(4)(ix)
- Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 36671, promulgated 10 September 2026, in force 11 September 2026), articles 32 and 60-2(5), Attached Table 1, and article 2 of the addenda: Korean text
- Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, promulgated 12 March 2024, in force 15 March 2024), article 2 of the addenda
- Act on Promotion of Information and Communications Network Utilization and Information Protection ("Network Act"), article 45-3(3) and (4), and its Enforcement Decree, article 36-7(5) (versions in force on 2 October 2026)
- PIPC FAQ on filing the designation of a chief privacy officer (10 September 2026), Q5, as described in the Korean notes linked above
- PIPC Resolution No. 2026-015-093 (29 July 2026, KT) and PIPC decision in case No. 2025조일0053-01 (11 March 2026, Lotte Card), as read in the Korean note linked above
This note is a general summary of Korean law for readers outside Korea and is not legal advice; whether a particular person can be designated, and what a particular group structure needs, turns on the appointment documents and the facts, and requires individual review. All English renderings of Korean statutes on this page are unofficial and carry no legal effect; the Korean text governs.
Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile; the page opens in Korean, with an ENG switch at the top right). Questions about this page can be sent through the contact page.