How Korea's PIPC Sanctions Foreign Companies — every published decision against a non-Korean operator, in one table

Key points. The Personal Information Protection Commission ("PIPC") has issued 46 decisions against named foreign operators, involving 41 companies from 14 countries. The overseas entity itself was the respondent in 30 of them; a Korean subsidiary of a foreign parent in 16. Three things are visible in the table. Cross-border transfer was the basis of a surcharge in 2 of these decisions — Apple’s (January 2025) and Temu’s (May 2025), both for failing to tell data subjects about processing outsourced abroad (art. 28-8(1)); every other surcharge rested on consent or safeguards. One decision, Google’s in September 2022, is 77% of all surcharges in the 15 decisions whose full text is published. And the point this group contests most often is not whether it broke the law but how much of its turnover counts as Korean. 🔴 Anonymised decisions cannot be included, so every count here is a lower bound.

A legal team at headquarters that has a Korean subsidiary, or Korean users, usually needs answers to two questions. Does the Korean regulator actually sanction companies like ours? If so, on what basis, and for how much?

The decisions that answer those questions exist. They are scattered across more than six hundred published resolutions, in Korean, with no field that marks the respondent as foreign. This page collects them.

As of 2026-09-11. Source: the Personal Information Protection Commission's decision board and, for decisions not yet published in full, its press releases. 🔴 "Foreign operator" is a classification this table applies, not one the Commission uses: the place of incorporation and the nationality of the parent were checked against public information and tagged by hand. Anonymised decisions cannot be counted — no nationality is inferred for a respondent whose name the Commission withheld — so the table is a lower bound. Amounts are summed only for decisions whose full text is published; press-release-only figures come from a different source and are not added.

"No separate section" means the decision has no distinct part headed "review of the respondent's arguments"; it does not mean the respondent did not contest the case. The full text of each argument, in Korean, is in the respondents' arguments table. To point at a single row, use an address of the form #fg-2026-07-22-n12330-0.

Which provisions were the basis for the sanctions?

Provisions found to have been breached in decisions whose full text is published. Decisions known only from a press release are not counted here because the release does not cite provisions. Article numbers follow the Personal Information Protection Act unless marked as the former Network Act.

What does the table show?

• Cross-border transfer was the surcharge basis twice, and both times the breach was a disclosure failure. In January 2025 the Commission imposed KRW 2,405,000,000 on Apple Distribution International Limited for breach of art. 28-8(1): card-payment data was passed to an overseas processor for a credit-scoring model without data subjects being told of the outsourcing abroad. In May 2025 Whaleco Technology Limited (Temu) received KRW 879,000,000 on the same provision: personal data was outsourced and stored in Singapore, Japan, the United States and China without the statutory particulars being disclosed in the privacy policy. Those are the only decisions in the table whose surcharge rests on the transfer provision (2 of 46; a transfer breach was found in 3, but in Facebook’s August 2021 decision the transfer breach under former art. 39-12 drew an administrative fine, and the surcharge rested on the Network Act consent rule); the others rest on the duty to take safeguards, the former consent rule for online services, outsourcing, and breach notification. Part of the explanation is timing — art. 28-8 took its current form only in September 2023.
• The amounts are concentrated in one decision. Google’s 2022 decision is 77% of the surcharges imposed in published decisions. The impression that "foreign companies get large fines in Korea" is that one case; apart from the two Facebook decisions (about KRW 6 billion each) and AXA and Apple (about KRW 2 billion each), the rest are in the hundreds of millions of won or less. An average is misleading.
• The most contested point is relevant turnover. Arguments that global revenue should be multiplied by the Korean user share, or limited to the service at issue, recur and were partly accepted more than once. Arguments that the respondent was not the obligated party were rejected. The pattern holds when Korean respondents are included: see the respondents' arguments table (Korean).
• The same companies come back. Apple and Meta each appear more than once. Repeat respondents are collected separately in the repeat-sanction table (Korean), and the amending Act in force since 11 September 2026 raises the surcharge ceiling to 10% of total turnover for intentional or grossly negligent repeat violations within three years (art. 64-2(2)).
• One case went to a criminal referral over document production. It is the only published example of what the Commission does when an overseas company does not respond to a request for materials.

What was the legal basis in the other decisions?

Two provisions carry most of the weight.

The first is art. 29, the duty to take technical and administrative safeguards. It is the most common basis in this table, as it is across the Commission’s enforcement generally. The Christie’s, TAG Heuer, TELUS and K Games decisions all rest on it, usually after a data breach and usually paired with a finding that notification of the breach was late.

The second is the former art. 39-3, a special consent rule for online service providers that the 2020 amendment carried over from the Network Act and that was repealed in the 2023 restructuring. It was the basis of the two decisions everyone has heard of. In September 2022 the Commission found that Google had collected and used behavioural data from third-party sites without valid consent and imposed a surcharge of KRW 69,241,000,000; Meta received KRW 30,806,000,000 on the same day. The February 2023 decision against Meta, on the refusal of service to users who declined to consent to behavioural data collection, is on the same provision.

The point for a headquarters reader is that neither of these is a Korea-specific data-localisation or transfer rule. They are the ordinary obligations — secure the data, get valid consent — applied to a company that had Korean users. The two transfer-based surcharges, Apple’s and Temu’s, turned on what data subjects were told about outsourcing abroad, not on the transfer itself.

Is the parent or the Korean subsidiary the respondent?

The overseas entity, more often than not: 30 of 46 decisions name the foreign company itself. The Korean subsidiary was the respondent in 16, all of them retail or insurance businesses with a Korean corporate presence — the three LVMH subsidiaries in February 2026 and AXA General Insurance in 2024.

Which entity is named changes what is argued. Where the overseas entity is the respondent, the surcharge ceiling is a percentage of relevant turnover, and the dispute is about which part of global revenue is Korean. Where the Korean subsidiary is the respondent, the issues are how the group’s global policy was implemented locally and how processing was outsourced — the Temu decision, which found breaches of art. 26 (outsourcing) and art. 31-2 (domestic representative) alongside the transfer point, sits between the two.

The domestic representative provision has its own English note: Appointing a Domestic Representative under Korea’s PIPA.

What do foreign respondents argue, and does it work?

The table’s last column lists each argument the decision records and the Commission’s finding on it. Two patterns are consistent with the rest of the Commission’s practice.

Arguments about the fact of the violation rarely succeed. "Safeguards were in place" was rejected in the TAG Heuer decision; "we are not the obligated party" was rejected in the Temu decision; Meta’s argument that third-party behavioural data was essential to the service was rejected.

Arguments about the calculation often do. "Relevant turnover" — the base to which the surcharge percentage is applied — was partly accepted for Christie’s and K Games. Across every published decision on this site, not only the foreign ones, arguments about the scope of relevant turnover were accepted in whole or in part in 73% of the 22 cases where a finding is recorded; arguments that safeguards were in place succeeded in 15% of 13.

The practical consequence is that a foreign respondent’s submission is most useful where it documents which revenue is and is not Korean, with the accounting to support the split. In at least one decision the Commission used total revenue because the respondent had not produced a formula for separating it.

What happens if an overseas company does not cooperate?

One decision answers this. In November 2025 the Commission found that umanle S.R.L, the Paraguayan operator of a Korean-language forum, had breached art. 63 by not producing the materials it had been ordered to submit, and a separate resolution on the same day referred the company for criminal investigation. It is the only published referral of a foreign operator, and it turned not on how personal data was processed but on the refusal to engage with the investigation.

How to read this table

• "Foreign operator" is this table’s classification, not the Commission’s. Decisions carry no such field. The author checked the place of incorporation and the nationality of the parent against public information and tagged each respondent by hand; candidates that were rejected, and why, are kept with the data. A foreign brand operated by a Korean-incorporated company with Korean owners is not included.
• Anonymised decisions cannot be included. No nationality is inferred for a respondent whose name the Commission withheld. The counts are a lower bound.
• Classification is as at the date of the decision. AXA General Insurance was sold to Korean owners after its decision and is listed as it stood.
• Amounts are not added across layers. Figures read from a published decision and figures known only from a press release come from different sources. The summary total covers only the former; the press-release figures are shown in their rows but not summed.
• Terminology. A 과징금 is rendered as a "penalty surcharge" (a monetary sanction calculated from relevant turnover), a 과태료 as an "administrative fine" (a fixed-schedule fine), following the Ministry of Government Legislation’s English text of PIPA. Article numbers follow the Act in force at the time of the decision; provisions since repealed or renumbered are marked.

Frequently asked questions

On what legal basis has the PIPC sanctioned foreign companies?

In decisions whose full text is published, the provisions most often found breached are art. 29 of PIPA (duty to take safeguards) and the former art. 39-3, a consent rule for online service providers carried over from the Network Act and repealed in 2023, which was the basis for the Google and Meta behavioural-advertising decisions. Art. 26 (outsourcing) and art. 34 (breach notification) follow. Two published decisions impose a surcharge under the cross-border transfer provision, art. 28-8(1): Apple’s in January 2025 (KRW 2.4 billion) and Temu’s in May 2025 (KRW 879 million). In both, the breach was not the transfer itself but the failure to inform data subjects that processing had been outsourced to a provider abroad. In every other decision the penalty rested on other provisions.

Does the PIPC sanction the overseas parent or the Korean subsidiary?

Both, and the overseas entity more often. In the named decisions, the overseas company itself was the respondent in 30 decisions and a Korean subsidiary of a foreign parent in 16. The distinction matters for what gets argued. When the overseas entity is the respondent, the dispute is typically about which part of global turnover is attributable to Korea for surcharge purposes. When the Korean subsidiary is the respondent, the issues are how the group’s global policy was applied in Korea and how processing was outsourced.

Can a foreign company reduce a surcharge by contesting the calculation?

It is the argument most frequently made by this group and the one most often reflected in the outcome. Arguments that only Korean-user revenue should be counted, or that revenue should be limited to the service concerned, were partly accepted in several decisions. Across all published decisions on this site, arguments about the scope of relevant turnover were accepted in whole or in part in 73% of the cases where a finding is recorded, whereas arguments that safeguards were in place succeeded in 15%. Arguments that the company was not the obligated party, or that no cross-border transfer took place, were rejected.

Are foreign companies that do not appear in this table unsanctioned?

No. The Commission anonymises many respondents, and no nationality can be verified for a company whose name is withheld. This site does not identify anonymised respondents from other sources. The table is therefore a floor, not a census, and the amounts in decisions known only from press releases are listed but not added to the total.

Related data on this site

In English: how Korean privacy fines are calculated — the surcharge formula these amounts came out of, with a calculator and the administrative fine table.

The tables below are in Korean; the row addresses and figures are the same ones this page draws on.

• Foreign operators — Korean version of this page
• Respondents' arguments and the Commission’s findings, with acceptance rates by type of argument
• Repeat respondents
• Every published enforcement decision, searchable by company and provision, with a CSV download
• English summaries of other articles

Source and citation

The table is machine-extracted from the decisions and press releases the Personal Information Protection Commission has published; only the foreign-operator classification is applied by hand. When citing it, please also cite the Commission’s decision board as the primary source. If you find an error, or know that a decision has since been annulled or varied on appeal, write to hyunsub.lee@seumlaw.com; corrections are made once checked against the original.

This note is a general summary of Korean law for readers outside Korea and is not legal advice; how these decisions bear on a particular company turns on its facts and requires individual review. Statutory references follow the Ministry of Government Legislation’s English translation of the Personal Information Protection Act where one exists. All English translations of Korean statutes are unofficial and carry no legal effect; the Korean text governs.

Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile — the page opens in Korean; use the ENG switch at the top right for the English version). The Korean-language version of this table is at 해외 사업자는 개인정보위에 어떻게 처분받나, and other English notes are collected at English summaries.