Key points. A company that receives a mediation proposal from the Personal Information Dispute Mediation Committee has 15 days to say whether it accepts. If it says nothing, the Personal Information Protection Act treats the company as having accepted (article 47(3)). Once the parties have accepted, including by this deemed acceptance, the mediation has the same effect as a judicial settlement (article 47(4) and (5)). This has been the rule since 15 September 2023. Before that date the same provision treated silence as rejection. The same amendment made participation compulsory for personal information controllers once they are notified of an application, unless there is a special reason (article 43(3)). A breach can also produce a second proposal from the Korea Consumer Agency under a different statute, with its own 15-day rule.
The question this page answers is a narrow one, but the answer has changed. A legal team that last looked at Korean mediation before 2023, or that relies on an English summary written before then, may expect an unanswered proposal to lapse. Under the current Act the company's silence counts as acceptance on the company's side. Whether the mediation is concluded also depends on the applicant accepting. The Korean-language version of this analysis, with more detail on damages and on the 2026 amendment, is here.
Silence has counted as acceptance since 15 September 2023
Article 47 of the Personal Information Protection Act ("PIPA") sets out the mediation step by step. The Committee prepares a proposal, which may include stopping the infringing conduct, restitution, damages or other relief, and measures to prevent recurrence (article 47(1)). It must present the proposal to each party without delay (article 47(2)). Article 47(3) then provides, in our translation:
A party presented with a mediation proposal under paragraph (2) that does not give notice of whether it accepts within 15 days from the date it was presented shall be deemed to have accepted the mediation.
Two further paragraphs give that deemed acceptance its weight. Article 47(4) requires the Committee to draw up a mediation record once the parties accept, and its parenthesis states that this includes the case where acceptance is deemed under paragraph (3). In that case the parties' names, seals and signatures may be omitted. Article 47(5) gives the content of the mediation the same effect as a judicial settlement. Under article 220 of the Civil Procedure Act, a settlement entered in the court record has the same effect as a final and conclusive judgment. Accordingly, once the other party has also accepted, a mediation record can come into existence without anyone at the company having signed it.
The rule is recent. Act No. 19234, promulgated on 14 March 2023 and in force from 15 September 2023, rewrote article 47(3). The version in force before that date (as it stood after Act No. 16930) said that a party that did not answer within 15 days was deemed to have rejected the mediation, and article 47(4) then required the parties' seals for a record. The two versions use the same 15 days and reach opposite results.
We have seen English-language answers to this question that describe silence as rejection. We have not compared each English source against the Korean text, so we do not say which of them are wrong. Some English material may still reflect the pre-2023 wording. Where the answer matters, the safer course is to check the current Korean text of article 47(3) on the National Law Information Center.
A controller must take part unless it gives a special reason within 10 days
Article 43(2) requires the Committee, on receiving an application from one party, to inform the other party of it. Article 43(3), in its current form, then provides that a personal information controller that has received that notice must respond to the mediation unless there is a special reason. Before 15 September 2023 the same paragraph imposed the duty only on public institutions. A private company could simply decline, and the mediation ended there. Under article 51-2 of the Enforcement Decree, a controller that has a special reason and does not intend to take part must notify the Committee of that intention, stating the reason, within 10 days of receiving the notice.
The Personal Information Protection Commission ("PIPC") has published figures suggesting that the two changes altered outcomes. It reported that the rate at which mediation was concluded rose from 66.9% to 90.7% across the reform, and that in 2024 the Committee handled 806 cases, 21% more than in the previous year. Over the same year the average amount paid in damages and settlements was KRW 570,000, against KRW 280,000 the year before. These figures are consistent with more companies staying in the process, although the PIPC figures alone do not show the cause.
The sequence and its deadlines
| Step (PIPA, unless stated) | Provision | Deadline | If the company does nothing |
|---|---|---|---|
| Application filed; Committee informs the other party | art. 43(1), (2) | none stated | |
| Controller responds to the mediation | art. 43(3); Enforcement Decree art. 51-2 | 10 days from the notice, to decline with reasons | Duty to respond applies unless there is a special reason, which must be stated within the 10 days |
| Committee prepares the proposal (individual mediation) | art. 44(1) | 60 days from the application; extendable by resolution | Collective mediation runs instead for 60 days from the day after the public notice ends, extendable (art. 49(7)) |
| Committee presents the proposal to each party | art. 47(2) | without delay | |
| Party states whether it accepts | art. 47(3) | 15 days from presentation | Deemed acceptance |
| How to reject | Enforcement Decree art. 51-4(2) | within the same 15 days | Rejection must be notified to the Committee in person, by registered mail or by email; the Committee must state the deemed-acceptance rule when it presents the proposal (art. 51-4(1)) |
| Mediation record drawn up and served | art. 47(4) | without delay | Seals and signatures may be omitted for deemed acceptance |
| Effect of the accepted mediation | art. 47(5) | Same effect as a judicial settlement |
The 15 days in article 47(3) run from the date on which the party was presented with the proposal. Where the respondent is a Korean company, that company's date of presentation is the starting point. The Act does not tie the period to the date on which the proposal reaches the person in the group who can decide on it.
Where a foreign group tends to lose the 15 days
The provisions quoted above say who must be informed and when the period starts. The period belongs to the party that was presented with the proposal, so the first question is which entity in the group is the respondent. In our view three practical points follow, although the answer for a particular group depends on its facts.
- The respondent's mailroom is not the legal team. Where the respondent is the Korean subsidiary, the 15 days run from the subsidiary's date of presentation, even while the document is being forwarded within the group. A domestic representative or local office may also be the address that data subjects and the Committee use in practice. Article 31-2(1) lists the representative's tasks as handling complaints and redress, breach notification and reporting, and submitting materials, and it does not mention receiving mediation notices, so we do not treat delivery to a representative as starting the period. A group should decide in advance who in Korea logs the date a proposal is received and who is authorised to answer.
- Escalation to headquarters takes time the Act does not give. An approval path that runs through a regional office and then a global committee can take longer than 15 days. Article 51-4(2) of the Enforcement Decree provides only for a notice of rejection within the 15 days. A reply saying that the proposal is still under review is not provided for, and we do not read it as stopping the period. A company that has not decided to accept should therefore state its rejection within the 15 days.
- The mediation step follows the breach notice. Since 11 September 2026, a breach notice to data subjects must also tell them about their rights to damages and statutory damages and to dispute mediation, and how to exercise them (article 34(1)(6); see breach notification). The company's own notice therefore points data subjects towards this process.
For the appointment and remit of a domestic representative, see domestic representative.
Collective mediation and the second track at the Korea Consumer Agency
A breach affecting many people can reach mediation in collective form. Article 49 of PIPA provides for collective mediation where many data subjects suffer the same or similar kind of harm. The Framework Act on Consumers has a parallel procedure at the Korea Consumer Agency's Consumer Dispute Mediation Commission (article 68). The two procedures are close in structure, but they rest on different statutes. This note does not cover how an outcome in one procedure affects the other.
| Personal Information Dispute Mediation Committee | Consumer Dispute Mediation Commission (Korea Consumer Agency) | |
|---|---|---|
| Statute | PIPA art. 49 | Framework Act on Consumers art. 68 |
| Reply period | 15 days (PIPA art. 47(3)) | 15 days (art. 67(2)) |
| No reply | Deemed acceptance | Deemed acceptance |
| Effect of acceptance | Same effect as a judicial settlement (PIPA art. 47(5)) | Same effect as a judicial settlement (art. 67(4)) |
| Processing period | 60 days from the day after the public notice ends, extendable (PIPA art. 49(7)) | 30 days from the day after the public notice ends, extendable twice by 30 days each (art. 68(7)) |
| Some claimants sue | Procedure continues; those claimants are excluded (PIPA art. 49(6)) | Same (art. 68(6)) |
| Compensation plan for non-parties | May be recommended (PIPA art. 49(5)) | May be recommended (art. 68(5)) |
Both tracks have been used against the same company for the same incident. In the SK Telecom breach of April 2025, the Personal Information Dispute Mediation Committee decided on 3 November 2025 on KRW 300,000 in damages per applicant, which SK Telecom did not accept (reported in November 2025), while the Consumer Dispute Mediation Commission decided on 18 December 2025 on a KRW 50,000 reduction in phone charges plus 50,000 T-plus points per person. On 30 January 2026 SK Telecom declined to accept the consumer decision. In the Coupang breach made public in November 2025, the consumer commission's decision, announced on 31 July 2026, set KRW 100,000 per person, in cash or Coupang Cash. Coupang told the commission in September 2026 that it did not accept (reported on 16 September 2026). The 31 July date is the announcement; the date on which the proposal was presented to the parties is not public, and the 15 days run from that date. The claimants then said they would pursue a joint lawsuit with the Korea Consumer Agency's litigation support. The Personal Information Dispute Mediation Committee's collective cases on the same breach, paused until the PIPC's June 2026 sanction decision, were merged and resumed, and were still open as of the last reports we checked. These amounts reflect the facts of each case and are not a guide to other cases.
The cost of accepting can also be larger than the amount multiplied by the number of applicants. Under PIPA article 49(5) and article 68(5) of the Framework Act on Consumers, once a business accepts a collective mediation the body may recommend that it prepare a compensation plan for people who were harmed but were not parties. Article 60 of the Enforcement Decree of the Framework Act on Consumers gives the business 15 days from the recommendation to say whether it accepts. In the SK Telecom decision the consumer commission had 58 applicants. It estimated that, if compensation were extended to all of the roughly 23 million affected people, the total would reach about KRW 2.3 trillion. That figure is the commission's estimate for full compensation; acceptance alone does not create an obligation to pay it, since a compensation plan follows only on a recommendation. For court awards in breach cases, see damages.
Three possible answers, and why silence is the weakest
A company holding a proposal has three courses open to it. It can accept, in which case, once the applicants have also accepted, the mediation has the same effect as a judicial settlement and, in collective mediation, a compensation plan recommendation may follow. It can reject, in which case the mediation does not conclude and the applicants may go to court. Or it can do nothing, and after 15 days it is in the same position as if it had accepted. We think the third course is the least favourable to the company, because it removes the chance to compare the first two.
The Committee's casebooks also suggest that a proposal is not the only point at which a case ends. In the casebook cases this site has organised at the case level (290 cases from the 2023 to 2025 editions), 131 ended in an agreement between the parties before any proposal was made. Of the 69 cases that reached a proposal with the outcome recorded, 30 were concluded and 39 were not. The casebooks contain cases the Committee selected for commentary, so these counts are not a settlement rate and cannot be compared with the PIPC figures above. Even so, they indicate that a company should prepare for negotiation before the proposal stage as well as for the 15-day reply.
Related
- Breach notification, covering the 72-hour clocks and the notice items, including the mediation item added in 2026
- Damages, covering what Korean courts have awarded per person in breach cases
- Domestic representative, covering who must appoint one and what the appointment carries
- PIPC enforcement decisions, the administrative track that runs alongside mediation
- English notes, the rest of the English material
Frequently asked questions
Q. What happens if we do not respond to a mediation proposal from Korea's Personal Information Dispute Mediation Committee?
You are treated as having accepted it. Under article 47(3) of the Personal Information Protection Act, a party that does not give notice of whether it accepts within 15 days from the date the proposal was presented is deemed to have accepted the mediation. Once the parties have accepted, with article 47(4) expressly including the deemed-acceptance case, the content of the mediation has the same effect as a judicial settlement (article 47(5)). To reject, a party must notify the Committee within the 15 days in person, by registered mail or by email (Enforcement Decree art. 51-4(2)). This rule has applied since 15 September 2023.
Q. Is it true that silence means rejection under Korean dispute mediation rules?
Not under the current Act. The version of article 47(3) in force before 15 September 2023 treated a party that did not answer within 15 days as having rejected the mediation. Act No. 19234, promulgated on 14 March 2023, reversed the rule, and silence has counted as acceptance since 15 September 2023. Some English-language material may still reflect the earlier wording, so the current Korean text is the one to check.
Q. Can a personal information controller refuse to take part in mediation before Korea's Personal Information Dispute Mediation Committee?
Only with a special reason. Article 43(3) of the Personal Information Protection Act provides that a personal information controller that has received notice of a mediation application must respond to the mediation unless there is a special reason. A controller with such a reason must notify the Committee within 10 days of the notice, stating the reason (Enforcement Decree art. 51-2). Before 15 September 2023 this duty applied only to public institutions.
Q. The same breach has produced mediation applications at two bodies. Can they be combined?
They run separately because they rest on different statutes. Collective mediation at the Personal Information Dispute Mediation Committee is governed by article 49 of the Personal Information Protection Act, and collective mediation at the Korea Consumer Agency's Consumer Dispute Mediation Commission by article 68 of the Framework Act on Consumers. Both apply a 15-day deemed-acceptance rule, but the processing periods differ: 60 days from the day after the public notice ends, extendable by resolution, under article 49(7), and 30 days, extendable twice by 30 days each, under article 68(7).
Sources
- Personal Information Protection Act (Act No. 21445, in force 11 September 2026), articles 34, 43, 44, 47 and 49
- Enforcement Decree of the Personal Information Protection Act, articles 51-2 and 51-4 · Civil Procedure Act, article 220
- Personal Information Protection Act as amended by Act No. 19234 (promulgated 14 March 2023, in force 15 September 2023), articles 43(3) and 47(3) and (4); earlier text as amended by Act No. 16930, articles 43(3) and 47(3) and (4)
- Framework Act on Consumers (Act No. 21444), articles 67 and 68; Enforcement Decree, article 60
- Korea Consumer Agency press releases on the Coupang decision (31 July 2026) and the SK Telecom decision (21 December 2025)
- PIPC press releases (27 May, 4 September and 4 November 2025); dispute mediation results for 2024 (11 February 2025) and 2023 (28 March 2024)
- Personal Information Dispute Mediation Committee notice (18 August 2026); Korean dispute mediation case table
This page is general information on Korean law and is not legal advice; whether to accept a particular proposal depends on its facts and on any parallel proceedings. Korean is the governing language of the statutes cited, and the English renderings here are unofficial. The casebook counts are read from the data behind this site and change when the data is updated.