Key points. Since 2 October 2025, PIPA art. 31-2(2) has required a foreign processor that has a Korean corporation it established, or a Korean corporation over which it exercises dominant influence, to appoint its domestic representative from among those corporations. Law firms and consultancies no longer qualify for such processors. The six-month transitional period under art. 2 of the Addenda to Act No. 20897 expired on 2 April 2026. Appointing in breach carries an administrative fine of up to KRW 20 million (art. 75(3)(3)). The same amendment added a supervision duty (art. 31-2(3); up to KRW 20 million under art. 75(3)(4)) and a privacy-policy disclosure duty (art. 31-2(4); up to KRW 10 million under art. 75(4)(9-2)). Since 11 September 2026 the representative’s statutory remit has covered the new art. 34(2) notification of the likelihood of a breach, and the implementing Decree (Presidential Decree No. 36671, promulgated 10 September 2026) defines that term.
Open the Korean privacy policy of a foreign company that has a subsidiary in Korea, and you will sometimes find a law firm or a consultancy named as the domestic representative.
That used to be an ordinary arrangement. When the domestic representative regime was first introduced there was no restriction on who could be appointed.
The restriction now exists, and the time allowed to fix existing appointments has run out.
Are we in scope at all?
Two conditions have to be satisfied together.
The first is in the opening words of PIPA art. 31-2(1): the obligation attaches to a personal information controller that has no address or place of business in Korea. Having a Korean subsidiary does not by itself remove the parent from this description. Where the entity that decides the purposes and means of processing is the overseas headquarters, the headquarters can be the processor for these purposes even though a separate Korean company exists.
The second is the size threshold in art. 32-3(1) of the Enforcement Decree. One of the following must apply:
- Total revenue of KRW 1 trillion or more in the preceding year (preceding business year, for a corporation). Revenue is converted into Korean won using the preceding year’s average exchange rate (Decree art. 32-3(2)).
- A daily average of 1 million or more Korean data subjects whose personal data was stored or managed during the three months immediately preceding the end of the preceding year.
- A party that has been required to submit materials under art. 63(1) of the Act and that the Personal Information Protection Commission ("PIPC") has resolved needs a domestic representative.
The third limb is worth noting because it is not a size test at all. It turns a regulatory information request into an appointment obligation, at the Commission’s discretion.
Our representative is a law firm. Is that still permitted?
Not if you have a qualifying Korean corporation.
Act No. 20897, promulgated on 1 April 2025 and in force from 2 October 2025, added a second sentence to art. 31-2(2):
In such cases, a personal information controller that has a corporation falling under any of the following shall designate the domestic representative from among those corporations —
- a domestic corporation established by the personal information controller;
- a domestic corporation over which the personal information controller exercises dominant influence in matters such as the composition of officers or the operation of the business, being a corporation prescribed by Presidential Decree.
The effect is narrow but decisive. If either category exists, the choice collapses to those entities. An external service provider is no longer an available option, whatever the commercial reasons for using one.
Appointing in breach of art. 31-2(2) is subject to an administrative fine of up to KRW 20 million (art. 75(3)(3)). Failing to appoint at all remains subject to the same ceiling (art. 75(3)(2)).
The provision is enforced. In May 2025 the PIPC’s decision against Whaleco Technology Limited, the operator of Temu, listed art. 31-2 among the provisions breached — see the enforcement table for foreign companies.
What counts as "dominant influence"?
Article 32-3(3) of the Enforcement Decree, added on 23 September 2025, gives two limbs:
- a corporation in which the processor appoints or dismisses the representative director, or appoints or may appoint 50% or more of the officers; or
- a corporation in which the processor has contributed 30% or more of the total number of issued shares or the total contributions.
The second limb is the one that catches people out. A 30% equity holding is well below the consolidation and control thresholds most groups apply internally, so a Korean joint venture or a minority-held affiliate can fall inside art. 31-2(2) even though the group does not treat it as a controlled subsidiary. The test is applied entity by entity, not at group level.
The deadline has passed. What does that change?
Article 2 of the Addenda to Act No. 20897 allowed a processor that had already appointed a domestic representative under the previous rules six months from entry into force to re-appoint from among the qualifying corporations. Counting from 2 October 2025, that period ended on 2 April 2026.
There is no longer a transitional position to rely on. A non-compliant appointment that is still in place is a continuing breach rather than a pending remediation, which changes both the internal urgency and the way the position reads if the PIPC asks.
Three things follow in practice. The appointment itself must be in writing — the second sentence of art. 31-2(1) says so expressly. The privacy policy has to carry the representative’s name (and, for a corporation, its name and the name of its representative), address (for a corporation, the location of its place of business), telephone number and email address (art. 31-2(4)). And the supervision cycle described below has to actually start.
What is the supervision duty, and what does it require?
Article 31-2(3), added by the same amendment, requires a processor that has appointed a domestic representative to educate the representative and inspect the status of its work so that it performs its duties faithfully, in the manner prescribed by Presidential Decree.
Article 32-3(4) of the Enforcement Decree sets out what that means:
- providing training on the domestic representative’s duties at least once a year; and
- inspecting whether the representative (a) has established a plan for performing its duties, (b) has carried that plan out, and (c) has remedied any items identified as needing improvement by the inspection under (b).
Failure to supervise carries an administrative fine of up to KRW 20 million (art. 75(3)(4)).
This is a documentation obligation as much as a substantive one. Annual training that leaves no record, and an inspection with no written plan to inspect against, are difficult to evidence after the fact.
Why the in-house move raises the stakes rather than lowering them
Article 31-2(5) provides that where the domestic representative violates the Act in connection with the matters listed in art. 31-2(1), the personal information controller is deemed to have committed the act.
That attribution rule existed before the 2025 amendment. What the amendment changed is who sits in the role. Moving the function from an external provider to a group company does not dilute the attribution — it relocates the operational risk inside the group while the legal consequence continues to land on the overseas processor. The supervision duty in art. 31-2(3) is the counterpart to that: the legislature tightened who may hold the role and, in the same breath, required the processor to keep watching them.
What changed on 11 September 2026?
Act No. 21445, promulgated on 10 March 2026, amended art. 31-2(1) with effect from 11 September 2026. Two changes matter.
The remit widens. Item 2 of art. 31-2(1) read, until 10 September 2026, "notification and reporting of a personal data breach under art. 34(1) and (3)". Since 11 September 2026 it reads "notification under art. 34(1) and (2) and reporting of a breach under art. 34(4)".
The reference to art. 34(2) is the substantive point. Article 34(2), newly inserted by the same Act, requires that where a processor becomes aware of a likelihood of a breach — of a kind prescribed by Presidential Decree, having regard to the type of personal data, the effect on data subjects and the degree of risk — it must notify all data subjects potentially affected, without delay, of the matters prescribed by Presidential Decree, including information to minimise harm.
So since 11 September 2026 the domestic representative’s statutory functions have included a notification that is triggered before a breach is confirmed.
The definition is now fixed by the Decree. Article 34(2) delegates both the triggering circumstances and the content of the notification to the Enforcement Decree, and the amending Decree (Presidential Decree No. 36671, promulgated 10 September 2026) supplies them. Read the triggering circumstances and the notification content from the Decree text before writing a group process against art. 34(2).
A cross-reference moves. Item 1 of art. 31-2(1) changes from art. 31(3)(3) to art. 31(4)(5). The substance — handling complaints and providing redress in connection with the processing of personal data — is unchanged; the underlying provision on the privacy officer was renumbered. If your appointment document or privacy policy quotes the old sub-article, it will be citing a provision that no longer says what you are pointing at.
One more representative you may need
PIPA is not the only Korean statute that requires an overseas company to appoint a representative in Korea. The AI Framework Act imposes a separate domestic representative obligation on AI businesses with no address or place of business in Korea, under its own thresholds, with the appointment reported to the Minister of Science and ICT rather than to the PIPC.
The two regimes are independent: separate triggers, separate regulators, separate appointment documents. Satisfying one does not satisfy the other, and the entity you appoint under one is not automatically the right entity under the other. If your group supplies AI services into Korea, that obligation needs its own assessment. The Korean-language note on the AI Framework Act’s thresholds is here.
A short checklist
- Identify whether the overseas entity meets the art. 32-3(1) threshold — revenue, Korean data subject numbers, or a PIPC resolution following a materials request.
- List every Korean corporation the group established or in which it holds 30% or more, or where it appoints the representative director or half the officers. Apply the test entity by entity.
- If any such corporation exists, confirm the domestic representative is one of them. If it is an external firm, the position has been non-compliant since 3 April 2026.
- Keep the appointment in writing, and check the privacy policy carries all four data points required by art. 31-2(4).
- Put the annual training and the three-part inspection into the compliance calendar, with records that can be produced.
- Since 11 September 2026 the representative’s remit extends to the art. 34(2) notification; the triggering circumstances are in Presidential Decree No. 36671.
The fines attached to these duties are fixed amounts in Table 2 of the Enforcement Decree, not turnover-based. How Korean privacy fines are calculated sets out those amounts and the separate surcharge formula.
Frequently asked questions
Is our company in scope for the domestic representative requirement at all?
Two conditions must both be met. First, the processor must have no address or place of business in Korea (PIPA art. 31-2(1)). Second, it must fall within one of the thresholds in art. 32-3(1) of the Enforcement Decree: total revenue of KRW 1 trillion or more in the preceding year; a daily average of 1 million or more Korean data subjects whose personal data was stored or managed during the three months immediately preceding the end of the preceding year; or a party that has been required to submit materials under art. 63(1) of the Act and that the Personal Information Protection Commission has resolved needs a domestic representative. Revenue is converted into Korean won at the preceding year’s average exchange rate (Decree art. 32-3(2)).
We already appointed a Korean law firm as our domestic representative. Can we leave it in place?
Not if you have a qualifying Korean corporation. The second sentence of PIPA art. 31-2(2), added by Act No. 20897 and in force since 2 October 2025, requires a processor that has either a Korean corporation it established or a Korean corporation over which it exercises dominant influence as defined by the Enforcement Decree to appoint the domestic representative from among those corporations. Appointing someone else in breach of art. 31-2(2) carries an administrative fine of up to KRW 20 million (art. 75(3)(3)). Article 2 of the Addenda to Act No. 20897 allowed six months from entry into force to re-appoint, and that period ended on 2 April 2026.
What does 'dominant influence' mean in practice?
Article 32-3(3) of the Enforcement Decree, added on 23 September 2025, defines it as a Korean corporation in which the processor either (i) appoints or dismisses the representative director, or appoints or may appoint 50% or more of the officers, or (ii) has contributed 30% or more of the total number of issued shares or total contributions. The 30% equity limb is lower than the control thresholds many groups use internally, so joint ventures and minority-held Korean entities can fall inside the rule even where the group does not treat them as controlled subsidiaries.
This note is a general summary of Korean law for readers outside Korea and is not legal advice; how these provisions apply turns on the facts of a particular group structure and requires individual review. Statutory references follow the Ministry of Government Legislation’s English translation of the Personal Information Protection Act where one exists. All English translations of Korean statutes are unofficial and carry no legal effect; the Korean text governs.
Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile — the page opens in Korean; use the ENG switch at the top right for the English version). The Korean-language article on the same subject is at 한국에 자회사가 있는데 국내대리인은 로펌입니다, and other English summaries are collected at English summaries.