Key points. Under Korea's Personal Information Protection Act ("PIPA"), transferring personal data to headquarters does not end the Korean entity's duty to answer a Korean data subject's access, correction, deletion or suspension request. Article 28-8(4) keeps Chapter 5 of the Act (the data subject rights chapter) binding on the transferring entity whichever transfer ground was used. On the reading taken in the Korean source note, article 28-11, which deals with onward transfers, does not itself extend Chapter 5 to the overseas recipient; headquarters may still owe duties of its own if it is a controller or an entrustee for the data. The Enforcement Decree gives 10 days from receipt to notify the data subject of access arrangements, of a deferral or refusal, or of the result of correction, deletion or suspension. The refusal grounds are listed in the Act, and "group policy" and "the data is held abroad" are not among them.
A Korean customer writes to the Korean subsidiary's support desk and asks for the personal data held about them to be deleted. The account lives on a global platform that headquarters runs, so the support team opens a ticket for the headquarters privacy team. That team may work to a procedure built on a one-month default.
The Korean deadline and refusal grounds differ from such a procedure, and the Korean entity carries the risk if the ticket comes back late. This note covers what general summaries of PIPA's reach tend to leave out: which entity owes the answer, how long it has, what it may refuse, and what headquarters can build. The full Korean-language analysis is 본사 서버에 있는 데이터를 지워 달라는 요구가 들어왔습니다.
Who owes the answer once the data has moved abroad?
The answer starts with article 28-8(4). After a transfer under the proviso to article 28-8(1), the transferring controller must keep complying with three things: the Act's other cross-border provisions, articles 17 to 19, and Chapter 5. The paragraph applies whichever of the five transfer grounds the company used.
Chapter 5, "Guarantee of Rights of Data Subjects", runs from article 35 (access) to article 39-2 (statutory damages), eight articles in all. Correction and deletion (article 36), suspension of processing (article 37) and liability (article 39) all sit inside it.
The recipient side is addressed by article 28-11, a provision on onward transfers. For the case where the recipient passes the data on to a third country, that article applies articles 28-8 and 28-9 mutatis mutandis and reads "personal information controller" as "the person who received the personal information". Chapter 5 is not on that list.
Article 26(8) shows the contrast. For entrustment, it expressly applies articles 35, 35-2, 36, 37, 37-2 and 38 to the entrustee and reads "personal information controller" as "entrustee". The Act therefore places Chapter 5 duties on another party in express words where that is intended, and it contains no such sentence for an overseas recipient. On the source note's reading, the transfer does not displace the Korean entity's duty under article 28-8(4). That is not the same as saying headquarters owes nothing. If headquarters is itself a controller for the Korean data, or an entrustee to which article 26(8) applies, it may have duties of its own. Which position headquarters holds is discussed in Your group DPA calls us a processor.
Where does the domestic representative fit?
The representative is a different mechanism with a different trigger. The appointment duty in article 31-2(1) applies to a controller with no address or place of business in Korea that falls within criteria set by Presidential Decree, which take account of revenue, the volume of personal data held and similar factors. Complaint handling and redress are among the tasks the representative carries out for that controller. Under article 31-2(5), a breach by the representative in those tasks counts as the controller's own act.
Two set-ups should therefore be kept apart. Where the Korean entity collected the data and sent it on, article 28-8(4) keeps the Chapter 5 duty with the Korean entity. Where headquarters itself processes the data of Korean users, the existence of a Korean subsidiary does not by itself take headquarters outside article 31-2(1), and the representative acts for headquarters. The two set-ups can also exist side by side, so that the Korean entity and headquarters each owe duties under different provisions. See Appointing a Domestic Representative.
The decision table
The table assumes the first set-up: the Korean entity collected the data and transferred it to headquarters. It does not address any separate duties headquarters may have as a controller or entrustee.
| Request | Who owes the response | Period to notify the data subject | Grounds on which the request can be declined or deferred |
|---|---|---|---|
| Access (art. 35) | Korean entity (art. 28-8(4)) | 10 days from receipt, by access notice; no notice needed where access is given immediately (Decree arts. 41(4), 41(5)) | Three grounds in art. 35(4), the third for public institutions only. Deferral for a justified reason under art. 35(3), with access without delay once the reason ceases |
| Deferral or refusal of access | Korean entity | Within the same 10 days, with reasons and the method of objecting (Decree art. 42(2)) | Not applicable |
| Correction or deletion (art. 36) | Korean entity | The measure itself without delay (art. 36(2)); notice of the result within 10 days (Decree art. 43(3)) | Deletion: where another statute specifies the data as an item to be collected (art. 36(1), proviso) |
| Suspension of processing (art. 37) | Korean entity | Notice of the result within 10 days (Decree art. 44(2)) | Four grounds in the proviso to art. 37(2); the contract ground needs both difficulty of performance without the processing and no clear statement by the data subject that it wants to terminate |
| Transmission (art. 35-2) | Separate procedure | Separate procedure | See the Korean note on transmission requests |
| Automated decisions (art. 37-2) | Korean entity (art. 37-2 is in Chapter 5) | A different period applies | See Our headquarters' system made the decision |
Deletion carries two further rules. Article 36(2) requires the measure without delay, and article 36(3) requires deleted data to be made impossible to restore or regenerate. A platform that only flags records as deleted should be checked against the second rule.
GDPR Article 12(3) allows one month, with a two-month extension for complex or numerous requests. A procedure built on that one-month default is counting in a different unit from the Korean 10 days.
Is "group policy" or "the data is abroad" a refusal ground?
It is not. Because the Korean grounds are enumerated, the test is whether a reason fits a listed item, not whether it is sensible.
For deletion, the bar is the proviso to article 36(1): another statute must specify the personal data as an item to be collected. For access, article 35(4) lists three cases: a statutory prohibition or restriction on access; a risk of harm to another person's life or body, or of unjust infringement of another person's property or other interests; and, for public institutions only, serious disruption of certain public functions. For suspension, the proviso to article 37(2) lists four.
None of these lists has an item for retention schedules, group policy or the offshore location of the data. Nor do articles 35(4) and 37(2) contain anything like the "manifestly unfounded or excessive" ground in GDPR Article 12(5). Where the Korean entity relies on the article 36(1) proviso, the notice should name the statute concerned and give the reasons and the method of objecting.
What headquarters can put in place
The notification periods run against the Korean entity, but meeting them depends on how fast headquarters acts. The Korean provisions point to three things, the second and third of which are practical recommendations built on them.
A request channel no harder than the collection channel. Article 38(4) requires the request method and procedure to be set up, published, and no more difficult than the way the data was collected. Decree article 41(2) adds that the method must be easy to use, must at least match the collection channel or method, and must be published on the website. The same standard covers correction, deletion, suspension and automated decision requests. A service that signs users up on a Korean website but takes rights requests only through an English-language global portal should be checked against this standard; the September 2026 recommendations described below concerned channels that went unanswered or replied to Korean users in English or Chinese.
A forwarding turnaround in the intra-group contract. Among the protective measures for a cross-border transfer, Decree article 29-10(1) includes grievance handling and dispute resolution, and under article 29-10(2) the Korean entity and headquarters have to settle those measures before the transfer and write them into the contract or an equivalent document. No statute requires the contract to state a number of days. As a practical recommendation, the contract can state how many days headquarters has to search, delete or suspend and to confirm the result to Korea, set so that the Korean entity can still notify within 10 days; a one-month figure taken from a global template cannot do that. The contract layer is covered in We signed the group DPA.
An objection route and a record. Article 38(5) requires a procedure for objecting to a refusal or other measure, and the data subject has to be told about it. Decree article 46(1) requires the controller to confirm that the person making the request is the data subject or a lawful agent. As a practical recommendation, the Korean entity can keep a record of each step, from that confirmation to the measure taken and the statutory ground for any refusal.
What has the PIPC actually checked?
The Personal Information Protection Commission ("PIPC") resolved at its 19th plenary meeting, on 9 September 2026, to issue improvement recommendations to five businesses. It was a follow-up check on companies rated inadequate in the 2025 privacy policy assessment, covering the rights-request channel, the domestic representative and the accessibility of the privacy policy. An improvement recommendation is not a sanction: it is not a penalty surcharge, an administrative fine or a corrective order.
Three businesses were named for the rights channel (names as given in the Korean PIPC release: ㈜뤼튼테크놀로지스, 테슬라코리아(유) and 딥시크). Wrtn Technologies left an inquiry about exercising rights unanswered, while Tesla Korea answered Korean users in English and DeepSeek in Chinese. Two more, OpenAI and Nike, were named on the representative side: in each case a caller was pointed to an email address, and messages to that address received no reply. The point for headquarters is that the PIPC tested the channel in operation, including the language of the reply, and not only the wording of the privacy policy.
What follows if a request is not met?
A transfer suspension order under article 28-9(1) may be relevant where that article's conditions are met: a breach of article 28-8(1), (4) or (5), with the transfer continuing or further transfers expected. Because the Chapter 5 duty forms part of article 28-8(4), failures to meet requests may be relevant to that route. An objection to a suspension order must be lodged within 7 days (art. 28-9(2)).
Chapter 5 also holds the damages provisions. Where a breach of the Act causes damage, article 39(1) makes the controller liable if it cannot prove that it acted without intent or negligence. Statutory damages of up to KRW 3 million under article 39-2(1) have separate requirements of their own. How either provision applies to a delayed or refused request depends on the facts of the case. Act No. 21445, which took effect on 11 September 2026, did not touch the text of articles 28-8, 35, 36, 37, 37-2 or 38; within Chapter 5, only the damages articles were rewritten.
Checklist
- Korean users can make requests through a channel at least as easy as the one used to collect their data, published on the website (art. 38(4); Decree art. 41(2)).
- The Korean entity's own procedure counts 10 days from receipt for each notice to the data subject (Decree arts. 41(4), 41(5), 42(2), 43(3), 44(2)), and treats the deletion or correction itself as due without delay (art. 36(2)).
- Transmission requests (art. 35-2) and automated decision requests (art. 37-2) are routed to their own procedures and periods.
- As a practical recommendation, the intra-group contract fixes a headquarters turnaround that leaves room for the 10-day notice (art. 28-8(4); Decree art. 29-10(2)). The number of days is not a statutory requirement.
- Deferral and refusal templates carry reasons and the method of objecting, and an objection procedure exists (art. 38(5)).
- As a practical recommendation, each refusal is documented against articles 35(4), 36(1) or 37(2), and each deletion against article 36(3).
Related
- We signed the group DPA. What does Korean law separately require the transfer contract to contain?: the article 29-10 protective measures and the transfer suspension route
- Our headquarters is certified. Is that a transfer ground under Korean law?: the five transfer grounds under article 28-8(1)
- Appointing a Domestic Representative under Korea's PIPA: when headquarters itself needs a representative
- Your group DPA calls us a processor. Korean law has no such slot: whether headquarters is a recipient or an entrustee
- English summaries: the index of English pages on this site
Frequently asked questions
Q. The data sits on headquarters' servers. Does the Korean subsidiary still have to deal with a Korean user's deletion request?
Q. How long does the Korean entity have to answer an access request?
Q. Can we decline a deletion request because the group retention policy requires us to keep the data, or because the data is held abroad?
Q. We have a domestic representative in Korea. Is the representative the one who has to answer?
Q. What should the intra-group contract say about data subject requests?
Sources
- Personal Information Protection Act (Act No. 21445, in force 11 September 2026), articles 26(8), 28-8, 28-9, 28-11, 31-2, 35, 36, 37, 38, 39 and 39-2: Korean text
- Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 36671, in force 11 September 2026), articles 29-10, 41, 42, 43, 44 and 46: Korean text
- PIPC press release of 16 September 2026 on improvement recommendations to five businesses concerning rights-request channels and domestic representatives (resolved at the 19th plenary meeting on 9 September 2026)
- GDPR Article 12, paragraphs (3) and (5)
This note is a general summary of Korean law for readers outside Korea and is not legal advice; which entity is the controller, and whether a particular refusal is justified, turn on the facts and require individual review. All English renderings of Korean statutes on this page are unofficial and carry no legal effect; the Korean text governs.
Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile; the page opens in Korean, with an ENG switch at the top right). Questions about this page can be sent through the contact page.