Appointing a Domestic Representative under Korea's PIPA — the 2025 restriction, the deadline that has passed, and the 11 September 2026 expansion

Key points. Since 2 October 2025, PIPA art. 31-2(2) has required a foreign processor that has a Korean corporation it established, or a Korean corporation over which it exercises dominant influence, to appoint its domestic representative from among those corporations. Law firms and consultancies no longer qualify for such processors. The six-month transitional period under art. 2 of the Addenda to Act No. 20897 expired on 1 April 2026. Appointing in breach carries an administrative fine of up to KRW 20 million (art. 75(3)(3)). The same amendment added a supervision duty (art. 31-2(3); up to KRW 20 million under art. 75(3)(4)) and a privacy-policy disclosure duty (art. 31-2(4); up to KRW 10 million under art. 75(4)(9-2)). Since 11 September 2026 the representative's statutory remit has covered the new art. 34(2) notification of the likelihood of a breach, and the implementing Decree (Presidential Decree No. 36671, promulgated 10 September 2026) defines that term.

Open the Korean privacy policy of a foreign company that has a subsidiary in Korea, and you will sometimes find a law firm or a consultancy named as the domestic representative.

That used to be an ordinary arrangement. When the domestic representative regime was first introduced there was no restriction on who could be appointed.

The restriction now exists, and the time allowed to fix existing appointments has run out.

Are we in scope at all?

Two conditions have to be satisfied together.

The first is in the opening words of PIPA art. 31-2(1): the obligation attaches to a personal information controller that has no address or place of business in Korea. Having a Korean subsidiary does not by itself remove the parent from this description. Where the entity that decides the purposes and means of processing is the overseas headquarters, the headquarters can be the processor for these purposes even though a separate Korean company exists.

The second is the size threshold in art. 32-3(1) of the Enforcement Decree. One of the following must apply:

1. Total revenue of KRW 1 trillion or more in the preceding year (preceding business year, for a corporation). Revenue is converted into Korean won using the preceding year's average exchange rate (Decree art. 32-3(2)).
2. A daily average of 1 million or more Korean data subjects whose personal data was stored or managed during the three months immediately preceding the end of the preceding year.
3. A party that has been required to submit materials under art. 63(1) of the Act and that the Personal Information Protection Commission ("PIPC") has resolved needs a domestic representative.

The third limb is worth noting because it is not a size test at all. It turns a regulatory information request into an appointment obligation, at the Commission's discretion.

We have no Korean entity and no office in Korea. Do we still have to appoint, and whom can we appoint?

Having no address or place of business in Korea is not an exemption. Under art. 31-2(1) it is the condition that brings a processor within the article. Such a processor must appoint a representative if it meets one of the thresholds above. If it meets none, it has no appointment duty under this article.

The first sentence of art. 31-2(2) sets one requirement for the representative: it must have an address or place of business in Korea. The second sentence confines the choice to two kinds of Korean corporation: a corporation the processor established, and a corporation over which it exercises dominant influence as prescribed by Presidential Decree. That limit applies only where the processor has such a corporation. A processor that has neither is outside that limit; the first-sentence requirement still applies to whoever it appoints. Article 31-2(4) asks for the representative's name or, for a corporation, its name and that of its representative, so it contemplates an individual as well as a corporation. The appointment must be in writing, and the privacy policy must carry the art. 31-2(4) details.

Our representative is a law firm. Is that still permitted?

Not if you have a qualifying Korean corporation.

Act No. 20897, promulgated on 1 April 2025 and in force from 2 October 2025, added a second sentence to art. 31-2(2):

In such cases, a personal information controller that has a corporation falling under any of the following shall designate the domestic representative from among those corporations —

1. a domestic corporation established by the personal information controller;
2. a domestic corporation over which the personal information controller exercises dominant influence in matters such as the composition of officers or the operation of the business, being a corporation prescribed by Presidential Decree.

The effect is narrow but decisive. If either category exists, the choice collapses to those entities. An external service provider is no longer an available option, whatever the commercial reasons for using one.

Appointing in breach of art. 31-2(2) is subject to an administrative fine of up to KRW 20 million (art. 75(3)(3)). Failing to appoint at all remains subject to the same ceiling (art. 75(3)(2)).

The provision is enforced. In May 2025 the PIPC's decision against Whaleco Technology Limited, the operator of Temu, listed art. 31-2 among the provisions breached; see how the Commission has looked at the representative in practice below.

What counts as "dominant influence"?

Article 32-3(3) of the Enforcement Decree, added on 23 September 2025, gives two limbs:

1. a corporation in which the processor appoints or dismisses the representative director, or appoints or may appoint 50% or more of the officers; or
2. a corporation in which the processor has contributed 30% or more of the total number of issued shares or the total contributions.

The second limb is the one that catches people out. A 30% equity holding is well below the consolidation and control thresholds most groups apply internally, so a Korean joint venture or a minority-held affiliate can fall inside art. 31-2(2) even though the group does not treat it as a controlled subsidiary. The test is applied entity by entity, not at group level.

The deadline has passed. What does that change?

Article 2 of the Addenda to Act No. 20897 allowed a processor that had already appointed a domestic representative under the previous rules six months from entry into force to re-appoint from among the qualifying corporations. Counting from 2 October 2025, that period ended on 1 April 2026.

There is no longer a transitional position to rely on. A non-compliant appointment that is still in place is a continuing breach rather than a pending remediation, which changes both the internal urgency and the way the position reads if the PIPC asks.

Three things follow in practice. The appointment itself must be in writing — the second sentence of art. 31-2(1) says so expressly. The privacy policy has to carry the representative's name (and, for a corporation, its name and the name of its representative), address (for a corporation, the location of its place of business), telephone number and email address (art. 31-2(4)). And the supervision cycle described below has to actually start.

What is the supervision duty, and what does it require?

Article 31-2(3), added by the same amendment, requires a processor that has appointed a domestic representative to educate the representative and inspect the status of its work so that it performs its duties faithfully, in the manner prescribed by Presidential Decree.

Article 32-3(4) of the Enforcement Decree sets out what that means:

1. providing training on the domestic representative's duties at least once a year; and
2. inspecting whether the representative (a) has established a plan for performing its duties, (b) has carried that plan out, and (c) has remedied any items identified as needing improvement by the inspection under (b).

Failure to supervise carries an administrative fine of up to KRW 20 million (art. 75(3)(4)).

This is a documentation obligation as much as a substantive one. Annual training that leaves no record, and an inspection with no written plan to inspect against, are difficult to evidence after the fact.

Appointed on paper, working in practice: what the PIPC has actually found

中文版（本节）：/zh/domestic-representative/

Most guidance on this regime stops at the appointment: who may be named, and what the privacy policy must say. The Commission's own findings look at something else. In the decisions below, the PIPC looked at whether the representative, and the channels around it, actually worked when a Korean user made contact.

Unless noted otherwise, the measure on the points discussed here was an improvement recommendation, not a penalty surcharge or an administrative fine.

The 2020 names are brand names as the PIPC gave them in its press release; the release did not identify the contracting legal entities.

2020: the representative review. In September 2020 the Commission reviewed how appointed domestic representatives were operating. Two kinds of gap came out of it. Some representatives were not dealing with complaints, and some privacy policies did not name the representative at all. The second gap has since become a standalone duty with its own administrative fine, under art. 31-2(4) as described above.

2025: Whaleco. The Whaleco decision mentioned earlier found that Whaleco met the user-number threshold but had not appointed a domestic representative until 18 March 2024, a breach of art. 31-2(1). It appointed one on 19 March 2024, while the investigation was under way, and added the details to its privacy policy on 22 March 2024. That breach was one of the two bases of the administrative fine in the decision. The Commission's improvement recommendations then went further. It asked Whaleco to "designate its Korean corporation as the domestic representative in accordance with the amended Act (in force 2 October 2025) and make substantive efforts in operating it for the protection of personal information", and in particular to "devise and implement specific measures for handling complaints and providing redress in connection with the processing of personal information" (our translation). That recommendation was dated May 2025, several months before the in-house requirement took effect. So the Commission tied the choice of entity to an expectation about how the role would be run, before the new rule even applied.

2026: testing the channel from the outside. The September 2026 findings came from a follow-up check on businesses that had been rated inadequate in the Commission's 2025 evaluation of privacy policies. The PIPC resolved on the recommendations at its plenary meeting on 9 September 2026 and announced them on 16 September.

On the representative side, the Commission found that OpenAI and Nike each gave callers a separate email address, and that inquiries sent to that address went unanswered. It recommended that both businesses strengthen their management and supervision so that grievances and consultations through the domestic representative are handled properly. That wording closely tracks the supervision duty in art. 31-2(3), although the press release does not cite the article.

DeepSeek appears under a different heading. The Commission grouped it with rights-request channels, not with representative operation. DeepSeek answered a Korean user's inquiry in Chinese. In the same group, Tesla Korea Limited answered in English and the Korean AI service Wrtn (뤼튼테크놀로지스) did not answer. The Commission recommended that all three improve their arrangements so that rights requests from Korean data subjects are received and processed properly. The press release does not say which channel the DeepSeek inquiry went through. The published materials also do not set out a rule that replies must be in Korean. Even so, the Commission treated a reply in a foreign language as something to improve.

The same release also described what counted as improvement. Some overseas businesses had switched their rights guidance from English to Korean, and some had reorganised the representative's complaint-handling procedure.

Every one of the 2026 findings above could have been observed by anyone who contacted the business from Korea. It therefore seems sensible for the annual inspection under Decree art. 32-3(4) to include a test of each published channel, by telephone and by email, checking whether the inquiry is answered and whether the answer is in Korean. A dated record of those test inquiries is also the kind of evidence that is otherwise hard to produce under the supervision duty.

Why the in-house move raises the stakes rather than lowering them

Article 31-2(5) provides that where the domestic representative violates the Act in connection with the matters listed in art. 31-2(1), the personal information controller is deemed to have committed the act.

That attribution rule existed before the 2025 amendment. What the amendment changed is who sits in the role. Moving the function from an external provider to a group company does not dilute the attribution — it relocates the operational risk inside the group while the legal consequence continues to land on the overseas processor. The supervision duty in art. 31-2(3) is the counterpart to that: the legislature tightened who may hold the role and, in the same breath, required the processor to keep watching the representative.

What changed on 11 September 2026?

Act No. 21445, promulgated on 10 March 2026, amended art. 31-2(1) with effect from 11 September 2026. Two changes matter.

The remit widened. Item 2 of art. 31-2(1) read, until 10 September 2026, "notification and reporting of a personal data breach under art. 34(1) and (3)". Since 11 September 2026 it reads "notification under art. 34(1) and (2) and reporting of a breach under art. 34(4)".

The reference to art. 34(2) is the substantive point. Article 34(2), newly inserted by the same Act, applies where a processor becomes aware of a likelihood of a breach of a kind prescribed by Presidential Decree, having regard to the type of personal data, the effect on data subjects and the degree of risk. In that case the processor must notify all data subjects potentially affected, without delay, of the matters prescribed by Presidential Decree, including information to minimise harm.

So since 11 September 2026 the domestic representative's statutory functions have included a notification that is triggered before a breach is confirmed.

The definition is now fixed by the Decree. Article 34(2) delegates both the triggering circumstances and the content of the notification to the Enforcement Decree, and the amending Decree (Presidential Decree No. 36671, promulgated 10 September 2026) supplies them. Read the triggering circumstances and the notification content from the Decree text before writing a group process against art. 34(2).

A cross-reference moves. Item 1 of art. 31-2(1) changed from art. 31(3)(3) to art. 31(4)(5). The substance — handling complaints and providing redress in connection with the processing of personal data — is unchanged; the underlying provision on the privacy officer was renumbered. If your appointment document or privacy policy quotes the old sub-article, it will be citing a provision that no longer says what you are pointing at.

Which other Korean statutes require a domestic representative?

PIPA is not the only Korean statute that asks an overseas business to put someone in Korea. The table sets out six others. Each has its own trigger, its own regulator and its own appointment document. Satisfying one does not satisfy another, and only some of them carry the PIPA rule that a Korean group company must be chosen where one exists.

Three things in this table are easy to miss.

The game threshold is low. One thousand installs a day on Korean phones is a mid-sized title, not a global hit, so a studio that would never meet the KRW 1 trillion test can still be caught.

The Radio Waves Act has no threshold at all. A device maker selling a Bluetooth or other wireless product into Korea needs a Korean representative for the conformity assessment whatever its size. That is a separate question from whether the app that comes with the device is in scope of PIPA or the Location Information Act.

The Electronic Commerce Act rule is not yet in force. Article 20-5 was added by Act No. 21312, promulgated on 20 January 2026, and its addendum brings it into force one year after promulgation. The Korean-group-company rule comes with it, so a marketplace with a Korean subsidiary should plan for that subsidiary to take the role.

Some Korean regimes that overseas businesses meet have no representative mechanism at all. The Location Information Act is the clearest example: a business providing location-based services to Korean users reports to the Korea Media and Communications Commission itself (art. 9(1)), with or without a Korean presence, and operating without the report is a criminal offence (art. 40, item 2). What to do when a monitoring letter about this arrives is covered in a location-data monitoring letter from Korea. The Korean-language note on the AI Framework Act's thresholds is here.

A short checklist

• Identify whether the overseas entity meets the art. 32-3(1) threshold — revenue, Korean data subject numbers, or a PIPC resolution following a materials request.
• If the overseas processor has no Korean corporation falling within art. 31-2(2), confirm the appointed representative itself has an address or place of business in Korea (first sentence of art. 31-2(2)).
• List every Korean corporation the group established or in which it holds 30% or more, or where it appoints the representative director or half the officers. Apply the test entity by entity.
• If any such corporation exists, confirm the domestic representative is one of them. If it is an external firm, the position has been non-compliant since 2 April 2026.
• Keep the appointment in writing, and check the privacy policy carries all four data points required by art. 31-2(4).
• Put the annual training and the three-part inspection into the compliance calendar, with records that can be produced.
• Since 11 September 2026 the representative's remit extends to the art. 34(2) notification; the triggering circumstances are in Presidential Decree No. 36671.

The fines attached to these duties are fixed amounts in Table 2 of the Enforcement Decree, not turnover-based. How Korean privacy fines are calculated sets out those amounts and the separate surcharge formula.

Frequently asked questions

Is our company in scope for the domestic representative requirement at all?

Two conditions must both be met. First, the processor must have no address or place of business in Korea (PIPA art. 31-2(1)). Second, it must fall within one of the thresholds in art. 32-3(1) of the Enforcement Decree: total revenue of KRW 1 trillion or more in the preceding year; a daily average of 1 million or more Korean data subjects whose personal data was stored or managed during the three months immediately preceding the end of the preceding year; or a party that has been required to submit materials under art. 63(1) of the Act and that the Personal Information Protection Commission has resolved needs a domestic representative. Revenue is converted into Korean won at the preceding year's average exchange rate (Decree art. 32-3(2)).

We have no Korean entity and no office in Korea. Do we still need a domestic representative, and whom can we appoint?

Yes, if you meet one of the Enforcement Decree thresholds. Having no address or place of business in Korea is the condition for the duty under PIPA art. 31-2(1), not an exemption from it. The representative must have an address or place of business in Korea (first sentence of art. 31-2(2)). The requirement in the second sentence of art. 31-2(2) to appoint from among Korean corporations binds only a processor that has a Korean corporation it established or one over which it exercises dominant influence as prescribed by Presidential Decree; a processor with neither is outside that requirement.

We already appointed a Korean law firm as our domestic representative. Can we leave it in place?

Not if you have a qualifying Korean corporation. The second sentence of PIPA art. 31-2(2), added by Act No. 20897 and in force since 2 October 2025, requires a processor that has either a Korean corporation it established or a Korean corporation over which it exercises dominant influence as defined by the Enforcement Decree to appoint the domestic representative from among those corporations. Appointing someone else in breach of art. 31-2(2) carries an administrative fine of up to KRW 20 million (art. 75(3)(3)). Article 2 of the Addenda to Act No. 20897 allowed six months from entry into force to re-appoint, and that period ended on 1 April 2026.

What does 'dominant influence' mean in practice?

Article 32-3(3) of the Enforcement Decree, added on 23 September 2025, defines it as a Korean corporation in which the processor either (i) appoints or dismisses the representative director, or appoints or may appoint 50% or more of the officers, or (ii) has contributed 30% or more of the total number of issued shares or total contributions. The 30% equity limb is lower than the control thresholds many groups use internally, so joint ventures and minority-held Korean entities can fall inside the rule even where the group does not treat them as controlled subsidiaries.

If our Korean corporation is appointed as domestic representative, is that enough?

The appointment is necessary, but the PIPC's findings look at operation as well. In May 2025 it fined Whaleco Technology Limited (Temu) for having had no representative until March 2024, and its improvement recommendation asked for the Korean corporation to be designated and for specific complaint-handling and redress measures to be devised and implemented. On 9 September 2026 it recommended that OpenAI and Nike strengthen supervision of their representatives after inquiries sent to the email address given to callers went unanswered, and recommended that DeepSeek improve how it receives and processes rights requests after it answered a Korean user in Chinese. The 2026 measures were improvement recommendations, not penalty surcharges or administrative fines.

This note is a general summary of Korean law for readers outside Korea and is not legal advice; how these provisions apply turns on the facts of a particular group structure and requires individual review. Statutory references follow the Ministry of Government Legislation's English translation of the Personal Information Protection Act where one exists. All English translations of Korean statutes are unofficial and carry no legal effect; the Korean text governs.

Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile — the page opens in Korean; use the ENG switch at the top right for the English version). The Korean-language article on the same subject is at 한국에 자회사가 있는데 국내대리인은 로펌입니다, and other English summaries are collected at English summaries.