Key points. The email comes from a contractor running a 2026 monitoring programme for KISA together with the Korea Media and Communications Commission. It cites articles 5, 5-2 and 9 of the Location Information Act and asks the company to return a reply form by a stated date. The reply is either evidence of registration or a report, or an explanation of why the Act does not apply. In our reading the deciding questions are whether location data reaches the company's own systems, whether it identifies a person, and whether the company uses it for its own service or supplies it to others. A foreign company files in its own name; the Location Information Act has no domestic representative system.
This page is written for app and device companies that have no company in Korea. The email names one of your apps and gives a reply date. The letter and the reply form are in Korean, the email quotes prison terms, and there is no Korean legal team in the group to ask. It may be the first contact your company has had with a Korean authority about location data.
The letter has a narrow purpose. The sender wants to know whether the app's use of location data has been registered or reported in Korea, and if not, why not. The steps below follow that purpose. The last section sets out what I do if you send the letter to me.
What is this letter?
The sender is a private contractor commissioned by KISA (Korea Internet & Security Agency) to monitor services that use location data. The letter itself states that the monitoring is carried out together with the Korea Media and Communications Commission and KISA, as a 2026 programme. Its targets are companies that operate or develop smartphone apps using location data, and the check is made app by app: what type of business the app falls into, and whether it has been registered or reported.
In the letter we have seen, the email carried three attachments:
- an official letter notifying the company of improvements needed following the monitoring;
- Attachment 1, the monitoring result sheet for the app;
- Attachment 2, a form titled as a request to confirm the status of the location business, which doubles as a compliance report and an explanation.
The letter cites articles 5, 5-2 and 9 of the Location Information Act (위치정보의 보호 및 이용 등에 관한 법률). It also states the criminal penalties for failing to register or report: up to 5 years' imprisonment or a fine of up to KRW 50 million where registration was required, and up to 3 years or KRW 30 million where a report was required. For an application, it points to the online petition centre of the Ministry of Science and ICT (emsit.go.kr), under the location-based service (personal location information) business category, and for questions to the Location Information Support Center (lbsc.kr).
The letter is also not a one-off. The letter itself indicates that it is sent again if nothing changes.
When is the reply due?
The reply is due on the date written in the letter, and Attachment 2 is returned by email. A company that is a business under the Act attaches the results of its registration or report. A company that is not is told that it must submit an explanation. Silence is not one of the options the letter offers.
A company can ask the sender to extend the deadline. Whether the sender agrees, and for how long, is not something the letter fixes. Therefore the request should say what is still being confirmed, for example how the app's location features are built, and when the reply will follow. Making the request before the deadline passes keeps the company's position clear.
Are we covered: registration, a report, or neither?
The Location Information Act separates two kinds of business. A location information business (art. 2(6)) collects location data and supplies it to companies that run location-based services. A location-based service business (art. 2(7)) provides a service that uses location data. Personal location information (art. 2(2)) is location data about a particular individual, including data that can easily be combined with other information to identify that individual.
Those definitions lead to three outcomes:
- Registration (art. 5(1)). A location information business that deals with personal location information must register with the Korea Media and Communications Commission. The applicant must be a legal entity and must have physical facilities and technical and managerial safeguards, among other requirements. Operating without registration is punishable by up to 5 years' imprisonment or a fine of up to KRW 50 million (art. 39, item 1).
- A report (art. 5-2(1) and art. 9(1)). A location information business that does not deal with personal location information files a report under art. 5-2. A location-based service business that deals with personal location information files a report with the Commission under art. 9(1). Each failure is punishable by up to 3 years or KRW 30 million (art. 40, items 1-2 and 2). A location-based service business that does not deal with personal location information is outside art. 9(1).
- Neither. The company explains in Attachment 2 why the Act does not require it to register or report.
For most app companies the answer turns on three questions. First, does location data reach the company's own servers, so that the company is the one collecting it? Second, does that data relate to an identifiable person? Third, does the company use the data to run its own service, or does it supply the data to others? A company that collects personal location information and uses it in its own app is, on the definitions, a location-based service business that has to report. A company that supplies it to other service providers is in the registration category.
Two situations call for care. In our reading, location that is processed only inside a device platform's own network, for example an operating system's find-my-device network, and never reaches the app company's servers may not be collection by the app company at all. Even so, companion features in the same app, such as an out-of-range alert or a find-my-phone function, have to be assessed separately. Equally, in our reading, a short retention period does not by itself take an app outside the Act: data that reaches the company's servers is collected even if it is overwritten soon afterwards.
If the Act does not apply: the explanation
The explanation goes into Attachment 2 and states why the company is not a business under the Act. The explanation is more useful when it describes technical facts that can be checked. Those facts include where location is computed, which systems receive it, whether it is linked to an account or a device identifier, and what the app does with it. Where one feature is outside the Act and another may be inside it, the explanation should say so feature by feature.
If the Act applies: filing the report
A foreign company files in its own name. The report under art. 9(1) covers the trade name, the location of the principal office, the type of business, and the main business facilities including the location information system. For a foreign company, the principal office is its address abroad, and the location information system description includes where the servers are.
The authority may ask for supplements to the filing, and there is a step at which the registration licence tax is paid. Under art. 9(5) the Commission reviews the report and accepts it if it is in order. The filing is therefore not complete when it is submitted. It is complete when the report is accepted. After acceptance, the company returns Attachment 2 to the sender with the results.
Article 9-2 provides a simplified procedure for small businesses and one-person creative enterprises, as defined in other Korean statutes. This note does not address whether a foreign company can qualify for it.
What continues after the report is accepted?
The main recurring duty is the change report under art. 9(3). A company that changes its trade name, the location of its principal office or its location information system has to report the change. Moving the servers that handle location data is a change to the location information system, so a server migration should be checked against this duty.
Is the operating system's location permission the consent the Act requires?
The articles cited in the letter deal with registration and reports. Consent to the use of location data is governed by a different article, art. 19(1). Many apps ask for location through the permission prompt that the phone's operating system displays, and some development teams treat the user's tap on "Allow" as the consent the Location Information Act requires. In our reading it is not. The permission prompt is the means of obtaining consent to access a device function under art. 22-2 of the Network Act (정보통신망 이용촉진 및 정보보호 등에 관한 법률). That article requires a service that needs access to a device function to tell users which access it needs and why, and to obtain their consent (art. 22-2(1)). It also requires operating system makers to provide a way to give and withdraw that consent (art. 22-2(3)). Art. 19(1) of the Location Information Act imposes a separate duty. A location-based service business must first write into its terms of use its trade name and contact details, the rights of the personal location information subject and how they are exercised, what the service does, and the legal basis and period for keeping records of use and provision, together with the matters listed in art. 23 of the Enforcement Decree. It then obtains the subject's consent to those terms. The permission prompt contains none of these items. Therefore a tap on "Allow" is unlikely, on its own, to satisfy art. 19(1).
The decisions in this site's table of Commission sanction decisions (in Korean) were made by the Korea Communications Commission, which was abolished on 1 October 2025 and succeeded by the Korea Media and Communications Commission. The table holds 30 Location Information Act cases (collection dated 2026-10-26). Art. 19 is cited in 8 of them, and a breach of art. 19(1) was found in the 6 decisions below.
| Decision | What the Commission found | Sanction for the art. 19(1) breach |
|---|---|---|
| No. 2019-28-118 | Consent obtained through summary terms and a personal data consent form that stated the basis and period for keeping records unclearly | Penalty surcharge of KRW 1.9 million, in lieu of business suspension |
| No. 2020-33-153 | Consent obtained to location-based service terms that omitted the matters the Act requires | Administrative fine of KRW 1.5 million |
| No. 2020-33-161 | The full terms did not describe the location-based text message service, and consent was obtained through a consent form in the subscription application | Penalty surcharge of KRW 25.1 million (assessed together with a breach of art. 18(1)) and an administrative fine of KRW 1.5 million |
| Nos. 2023-21-051, 052 and 055 | Consent to the terms obtained from the legal guardian only, not from the child | A surcharge was found to be available, but a corrective order was imposed instead |
In the first three decisions the company had terms, but the terms were incomplete. In No. 2020-33-153 the Commission started from the first-breach base amount of KRW 3 million in Appended Table 5 of the Enforcement Decree and halved it, because the company had corrected the terms within the period for submitting its opinion. In Nos. 2019-28-118 and 2020-33-161, on the other hand, the Commission treated the same summary-terms practice as a ground for suspending the business and imposed a turnover-linked surcharge in place of the suspension. The three 2023 decisions concerned apps that locate children. The Commission stated that an art. 19(1) breach could attract a surcharge and criminal penalties. It nevertheless imposed no surcharge and made no criminal referral, because the wording of art. 19 resembles the guardian consent rule in the Personal Information Protection Act and the companies could have misread it. The decisions are discussed in more detail in a Korean article on this site.
Under the Act as it now stands, the two situations fall under different provisions. A business that fails to set out the required matters in its terms is liable to an administrative fine of up to KRW 10 million (art. 43(2), item 5). Appended Table 5 of the Enforcement Decree sets the amount at KRW 3 million for a first breach, KRW 6 million for a second and KRW 10 million for a third or later breach. A business that uses or provides personal location information without the subject's consent is liable to a penalty surcharge of up to 3% of the turnover related to the breach (art. 14(1), item 3), and to up to 5 years' imprisonment or a fine of up to KRW 50 million (art. 39, item 3). In our reading, an app that relies only on the permission prompt and has no location-based service terms at all is closer to the second situation than to the first. The level of any actual sanction depends on the facts of the case.
The table has limits. It holds only decisions published on the Commission's decision board, and the latest Location Information Act decision in it is dated 28 June 2023. It contains no case in which an app had a permission prompt and no consent to terms at all. The surcharge in art. 14(1) was introduced by Act No. 18517, promulgated on 19 October 2021 and in force from 20 April 2022. Before that amendment the only surcharge available was the one in lieu of business suspension (now art. 14(2)), which is the one used in Nos. 2019-28-118 and 2020-33-161. We have not confirmed when the conduct in the 2023 decisions took place.
A company that is preparing a report, or has filed one, can check three points about consent at the same time:
- Separate terms. Whether the app has its own location-based service terms that contain every item in art. 19(1) and the notice matters in art. 23 of the Enforcement Decree.
- Consent to the terms. Whether the app obtains the personal location information subject's own consent to those terms, separately from the permission prompt.
- Full text, not a summary. Whether the app shows only a summary consent form and leaves the full terms to a notice on the website.
Does the company need a domestic representative?
No. The Location Information Act has no domestic representative system and no special rule for foreign businesses, so a foreign company registers or reports in its own name. The domestic representative requirement under the Personal Information Protection Act is a separate obligation, covered in appointing a domestic representative.
Before the reply goes out
- Note the date and the app. Record the reply date and the app named in the letter. Check whether earlier rounds of the same letter went to another inbox.
- Map each location feature. For every feature that touches location, note where location is computed, whether it reaches the company's servers, how long it is kept and whether it is linked to a person.
- Decide the outcome per feature. Assign each feature to registration, a report or neither. A single app can contain more than one.
- Ask for time early if needed. Send the extension request before the deadline and say what remains to be checked.
- Use the attached form. Return Attachment 2 by email, with the report or registration results, or with the explanation.
- Plan for changes. If a report is filed, list the events that trigger a change report, including a server move.
How these steps apply depends on how the app is built and what the letter says, and the conclusion can differ from case to case.
What happens if you send the letter to me?
I am a Korean-qualified lawyer at SEUM Law in Seoul. For a company with no Korean entity, the work runs in this order. You deal with me in English throughout; everything that has to be in Korean is prepared and filed on your behalf.
- The deadline first. I read the letter and its attachments, tell you in English what they ask for and by when, and say whether an extension request is needed. If it is, I send it in Korean before the date passes. I aim to reply within one business day, Korea time.
- A short questionnaire on how the app handles location. It follows the questions in this note: where location is computed, whether it reaches your servers, where those servers are, how long it is kept, whether it is linked to a person, and what each feature does with it. Your engineers answer it in English.
- A written answer to the question in the letter. For each location feature: registration, a report, or neither, with the article that decides it. You see the reasoning before anything goes to the sender.
- The reply in Korean. I prepare Attachment 2 (the explanation, or the compliance report) and submit it to the sender by email.
- The filing, if one is needed. The report is made in your company's own name through the Korean online petition system. I prepare it, deal with any request for supplements, tell you when the registration licence tax falls due, and follow it until the Commission accepts the report. The result then goes back to the sender.
- What to watch afterwards. A one-page list of the events that trigger a change report, such as a new trade name, a new office address or a server move.
How the work is charged is agreed before it begins: hourly, with a cap for the reply and an overall cap if a filing turns out to be needed.
What to send: the email and all its attachments, the date it reached you, the app or product it names, and a few lines on how that app uses location. That is enough for the first step. You can write to me through the contact page.
Related
- A letter from Korea's PIPC — the same situation with a different regulator, under the Personal Information Protection Act
- Appointing a domestic representative — the Personal Information Protection Act requirement that the Location Information Act does not have
- About — the areas covered on this site
- Contact — what to send and what happens after you write
Frequently asked questions
Q. We received a KISA location-data monitoring email. Do we have to answer if the Location Information Act does not apply to us?
Yes. The letter asks every company it reaches to return the attached reply form by the stated deadline. A company that is a business under the Act returns evidence that it has registered or filed a report. A company that considers itself outside the Act is told that it must submit an explanation. Leaving the email unanswered does not end the matter, because the same letter can be sent again if nothing changes. An explanation is more persuasive when it rests on technical facts, such as where location data is processed and whether it ever reaches the company's servers.
Q. What is the deadline, and can we ask for more time?
The deadline is the date written in the letter, and the reply form is returned by email. A company can ask the sender for more time before that date. Whether an extension is granted, and for how long, is a matter for the sender, so the request should explain what is still being checked and when the reply can be sent.
Q. We have no office in Korea and no one who reads Korean. Can the reply and the filing be handled for us?
Yes. You deal with me in English. I read the letter, confirm the deadline and ask for an extension if one is needed, work out with your engineers whether registration, a report or neither applies, and prepare and submit the Korean reply. If a report is needed, it is filed in your company's own name through the Korean online petition system, and I follow it until the Commission accepts it. What to send first: the email with all its attachments, the date it reached you, the app it names and a few lines on how that app uses location.
Q. Do we need a Korean domestic representative to file a location-based service report?
No. The Location Information Act has no domestic representative system and no special rule for foreign businesses. A foreign company that has to register or file a report does so in its own name, giving its own trade name and its principal office abroad. The domestic representative requirement under the Personal Information Protection Act is a separate question.
Q. Our app already asks for location through the operating system's permission prompt. Is that the consent the Location Information Act requires?
In our reading, no. The permission prompt is the means of obtaining consent to access a device function under art. 22-2 of the Network Act. Art. 19(1) of the Location Information Act requires a location-based service business to write into its terms of use matters such as its trade name and contact details, the subject's rights and how they are exercised, what the service does, and the basis and period for keeping records of use and provision, and then to obtain the personal location information subject's consent to those terms. The prompt contains none of these. Among the Korea Communications Commission decisions collected on this site, the 6 decisions that found an art. 19(1) breach involved incomplete terms or a missing consent from the child. The table contains no decision on an app that had a permission prompt and no terms at all.
This page is general information on Korean law for readers outside Korea and is not legal advice; what a particular letter requires depends on its wording and on how the app handles location data. Korean is the governing language of the Location Information Act, and the English renderings here are unofficial. The statutory references are to the Act as in force from 1 October 2025.
Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile; the page opens in Korean, so use the ENG switch at the top right for the English version).