The label in the contract is not the position under Korean law

When a group data processing agreement arrives naming the Korean entity a processor, the first thing to establish is that Korean law has no slot that corresponds to it.

The Personal Information Protection Act works with two different relationships. One is entrustment of processing under article 26, where one company has another carry out processing for it. The other is provision to a third party under article 17, where the recipient processes for its own purposes. Which one applies is decided by who determines the purpose and means and who exercises control — not by the word the contract uses.

This matters because the two carry different duties, different disclosure obligations and, where the data leaves Korea, different transfer bases. A privacy policy that files every vendor under "entrustment" because the group DPA said processor will be wrong somewhere, and the error surfaces where it is most expensive: in the cross-border transfer basis.

Physical location does not settle it either. Equipment sitting at a customer's premises is still operated by whoever holds the authentication and access control.

Where the liability sits while the contract runs

While the contract is live, the centre of gravity is the company that entrusted the work. Articles 26(4) and 26(7), with article 64-2(1)5, build that structure. The vendor is not without duties of its own — the two layers overlap — but a foreign group that assumes its Korean vendor carries the exposure has the direction wrong.

What the published decisions show is narrower than the theory suggests, and it cuts both ways.

Of the decisions in which the Commission found a breach of article 26, there are 70. Of those, 41 ended in an administrative fine, and 50 turned on article 26 alone with no other provision engaged — things visible on the face of the documents, such as failing to disclose that processing was entrusted, or a contract missing a mandatory term.

So far this reads like a paperwork risk. The part that is usually missed is the rest of it: 10 of those decisions carried a penalty surcharge rather than an administrative fine, and 6 of those rested on article 26 alone. Failure to supervise an entrustee can produce a surcharge without any other violation being found.

After the contract ends, the direction reverses

This is the part that catches vendors.

Where the parties agreed that data would be destroyed at the end of the contract, the data was not destroyed, and a breach followed, the sanction has landed on the vendor rather than the customer. Article 26(8) applies the duties of destruction, safeguards and notification to the entrustee, and the administrative fine provisions say so expressly.

Two practical consequences. A destruction clause in the contract and a record that destruction actually happened are different things, and only the second is a defence. And the confirmation step at termination protects both sides, which is why it is worth insisting on even when the commercial relationship has soured.

Paying first does not mean recovering in full

Where one side has compensated data subjects and seeks recovery from the other, the route is open but the amount is not the whole of what was paid. What moved the split in the decided cases was the state in which the data was handed over — not how much supervision the paying party could evidence.

What changed on 11 September 2026

The amendment added three administrative fine provisions on the chief privacy officer, and all three are applied to entrustees through article 26(8).

A company that only processes personal data on another company's instruction now carries, in its own name, the duty to designate a chief privacy officer, to have the designation resolved by the board where that applies, and to file it. A group that treats its Korean vendors as an extension of its own compliance perimeter will not have planned for that.

When your standard terms are the only contract with Korean customers

Take a B2B SaaS vendor whose Korean customers all accept the same terms of service on the same screen. Because the service stores and processes the customers' user data, the vendor is usually the entrustee in each of those relationships. Sooner or later one customer's legal team asks for a separate entrustment agreement to be signed, and the vendor has to decide whether it can keep a document per customer.

Article 26(1) requires entrustment to be made in a document. The article lists what that document must contain: a prohibition on processing beyond the entrusted purpose, and technical and managerial safeguards. Article 28(1) of the Enforcement Decree adds the purpose and scope of the entrusted work, restrictions on onward entrustment, safety measures, supervision including checks on how the data is being managed, and responsibility such as compensation for damage.

The Commission's consolidated guidance on processing personal information (July 2025) takes the view that where the entrusted work consists of using the entrustee's service, the contract may be concluded through terms of service. The guidance also says the document need not be a standalone contract. What it does require is that every item set by the statute and the decree is reflected.

So the question is content, not form. If the terms say only that personal data is handled under a separate policy, and the linked policy leaves out mandatory items, the argument that the terms stand in for the document loses its footing.

Whether a linked policy becomes part of the contract is also a question under the Act on the Regulation of Terms and Conditions. Article 3 of that Act requires the business to make the terms clear and to explain their important content, and a business that fails to do so cannot assert those terms as part of the contract. That structure does not appear to fall away because the customer is a company: the Supreme Court has treated provisions of a pre-formatted addendum to an outsourcing agreement, prepared for use with many sales agents, as standard terms (Supreme Court Decision 2020Da278873, 12 May 2022). Whether incorporation holds can depend on how the consent screen presents the entrustment clause and the linked documents.

Article 26(6) requires the entrustee to obtain the entrusting company's consent before passing the work on. The duty is the vendor's own, and a breach is subject to an administrative fine under article 75(3)1.

The guidance does not restrict the form of that consent. As one method, it gives the example of setting out in the entrustment document, in advance, the scope of permitted onward entrustment and a simplified procedure such as after-the-fact approval or periodic notice.

The example assumes the scope and the procedure are actually written down. A clause saying only that the vendor may entrust onward as needed is unlikely to be read the same way. The model entrustment contract annexed to the guidance (pp. 184–186), in its article 5, also has the vendor publish the names of its sub-entrustees and the scope of their work in its own privacy policy.

When the customer does not disclose the entrustment

Article 26(2) places the duty to disclose the entrustment on the entrusting company, and the administrative fine for not disclosing it (article 75(4)5) is aimed at the entrusting company as well. Article 26 itself is not among the provisions that article 26(8) applies to entrustees. The fine for not putting the entrustment in a document (article 75(4)4) follows the same pattern.

What remains with the vendor is its own duty. Article 26(8) applies article 30, so the vendor has to establish and publish a privacy policy of its own, and the Commission's privacy policy drafting guidelines (April 2026) say sub-entrustees belong in it. That duty does not depend on whether the customer has disclosed anything.

The same guidelines allow the entrusting company to disclose sub-entrustees by adding a link to the vendor's policy. A sub-processor list the vendor publishes therefore supports its customers' disclosure. The vendor itself, as the first-tier entrustee, still has to be named directly in each customer's own policy, together with the work entrusted to it.

What to do with this

  • Work out the position under Korean law before the group DPA's terminology is copied into the Korean privacy policy and the local contract.
  • Split the vendor list by article — entrustment under article 26, provision under article 17 — and check the cross-border basis against that split, not against the group's labels.
  • Treat termination as a documented step, not a clause.
  • If your Korean entity or vendor only processes on instruction, check the chief privacy officer position again against the September 2026 changes.
  • If you contract with Korean customers through standard terms, check that the terms and every linked policy cover each item in article 26(1) and Enforcement Decree article 28(1), and that any onward entrustment clause states its scope and procedure.

Frequently asked questions

Q. Is a processor under a group DPA an entrustee under Korean law?

Not by virtue of the label. Korean law has no position that corresponds one-to-one with a processor. The Personal Information Protection Act works with entrustment of processing under article 26 and provision to a third party under article 17, and which one applies turns on who decides the purpose and means and who exercises control — not on what the contract calls the parties. Copying the group DPA's terminology into the Korean privacy policy and contracts before working out the position is the usual source of the problem.

Q. Who is sanctioned when a vendor's employee causes a breach in Korea?

While the contract is running the weight sits with the company that entrusted the work, under article 26(4) and (7) and article 64-2(1)5. That does not mean the vendor has no duties of its own; the two layers overlap. Once the contract has ended the direction reverses, because article 26(8) applies the duties of destruction, safeguards and notification to the entrustee, and there are decisions in which the vendor itself was sanctioned.

Q. Do vendors in Korea have to appoint a chief privacy officer?

Since 11 September 2026 the three new administrative fine provisions on the chief privacy officer are applied to entrustees through article 26(8). A company that only processes personal data on another company's instruction now carries the designation, board resolution and filing duties in its own name.

Q. Our global SaaS terms are the only contract with Korean customers — does that satisfy PIPA article 26's written-document requirement?

It can, on the Commission's guidance. The consolidated guidance on processing personal information (July 2025) accepts that where the entrusted work consists of using the entrustee's service, the contract may be concluded through terms of service, and the document need not be a standalone contract. The test is content: the terms and the documents they link to must together contain every item in article 26(1) and in article 28(1) of the Enforcement Decree. Terms that only point to a separate policy which leaves mandatory items out are a weak basis. Whether linked documents form part of the contract is also a question under article 3 of the Act on the Regulation of Terms and Conditions, and can depend on how the consent screen presents them.

This page is general information on Korean law and is not legal advice; whether a particular arrangement is entrustment or provision depends on its facts. Korean is the governing language of the statutes cited — the English renderings here are unofficial. The counts are read from the decisions the Commission has published and change as more are published.