Key points. A letter from Korea's Personal Information Protection Commission ("PIPC") is usually one of three things: a request for materials under article 63(1) of the Personal Information Protection Act ("PIPA"), a prior notice of a proposed sanction, or a pre-inspection under article 63-2. They belong to different stages and call for different documents in reply. In the published decisions that record the dates, the median from the start of an investigation to the decision is 360 days. A prior notice must allow at least 14 days for comments (Notice art. 16(1)). The scope and the figures given in the first reply are likely to be compared with what the company says later: in its opinion on the prior notice, in the decision and, if the sanction is challenged, in court.

The first report from Seoul is usually short: a letter has arrived from the regulator, and there is a date on it. Headquarters then has to decide who answers, in whose name and by when, often before anyone outside Korea has read the letter itself.

The first step is to establish which letter it is. The answer determines how much time there is and what the reply is for.

Which letter is it?

A request for materials. Article 63(1) of PIPA allows the Commission to require a personal information controller to submit goods and documents where it has found or come to suspect a violation of the Act, where it has received a report or a complaint, and in the other cases the Act provides for. If the materials are not submitted, or the Commission considers that a violation has occurred, article 63(2) allows its officials to enter the office or place of business and inspect.

The procedure is set out in the Commission's notice on investigations and dispositions (개인정보 보호위원회의 조사 및 처분에 관한 규정, PIPC Notice No. 2026-13, in force 11 September 2026; "the Notice" below). Under Notice art. 9 a request for materials has to state the reason for the request, who is to submit, what is to be submitted, the deadline and place, the method of submission, and the sanction that follows if the request is not complied with. Those six items are the quickest way to recognise this kind of letter, and the second item tells you which entity in the group is being asked.

A prior notice. This comes after the investigation. Under Notice art. 16 the Commission notifies the company of the sanction it proposes, and under art. 16-2 the company may submit an opinion and evidence in writing or by electronic document. In a penalty surcharge case the same article also deals with the submission of material proving turnover. A prior notice sets out the facts and the legal grounds on which the proposed sanction rests, so it reads as a draft conclusion and not as a list of questions.

A pre-inspection. Article 63-2 is a different track. It applies where none of the grounds in article 63(1) is present, that is, where there is no suspected violation, no report and no complaint, and the Commission considers that the risk of an incident is high enough to check for weaknesses in advance. A pre-inspection can end in a corrective recommendation, and the company has 10 days from the day it is notified of the recommendation to say whether it accepts. Acceptance has legal effect: under article 63-2(4) a company that accepts is treated as having received a corrective order under article 64(1). The DeepSeek decision of April 2025 shows how that procedure ran in one published case.

One further point matters where the entity addressed is an overseas company with no address or place of business in Korea, which can be the case even in a group that has a Korean subsidiary. Being required to submit materials under article 63(1) is one of the routes by which an overseas company can be brought within the domestic representative requirement, if the Commission so resolves. That is covered in the note on appointing a domestic representative.

How long does this take?

The Commission's decisions record their own dates: when the investigation ran, when the prior notice was sent, when the respondent filed its opinion, and when the Commission decided. Read across every published decision on this site, the figures are as follows.

  • From the start of the investigation to the decision, the median is 360 days across 328 decisions. The shortest took 64 days and the longest 1,416.
  • The investigation period itself has a median of 185 days.
  • From the end of the investigation to the decision, the median is a further 120 days.
  • From the prior notice to the decision, the median is 71 days across 604 decisions.

Each line has its own denominator. A decision contributes to a figure only if it records the dates concerned, so the four lines cannot be added together or read as one sample.

How the investigation began also appears in the decisions. Of the 571 decisions that state what prompted the investigation, 335 began with the company's own breach report. In the decisions that record it, then, a request for materials after a breach report is the usual way an investigation opens. The figures do not show how often a report is followed by a request. The reporting obligation itself is covered in breach notification. This distribution describes cases that ended in a published decision, not every report or complaint the Commission receives.

The Commission's own target periods. On 2 October 2026 the Commission announced a plan to speed up investigations of breaches and infringements. As a principle, major cases are to be handled within 12 months, ordinary cases within 6 months and minor cases within 3 months. Major cases are those such as a breach affecting one million or more people, a matter of public interest or concern, or the hacking of a major public-sector system. The plan also says that where an investigation is extended the company under investigation will be told at 6- or 12-month intervals, and that a company will be told where a matter is closed without an investigation being opened (PIPC press release, 2 October 2026, in Korean).

These are targets in a plan that the Commission says it will introduce in stages. They are not periods fixed by the Act or by the Notice, and the medians above come from decisions made before the plan was announced. It is therefore too early to say how far the targets will change the figures.

A prior notice arrives. How many days are there?

Notice art. 16(1) provides that the investigator sends the prior notice within 14 days of completing the report on the results of the investigation, and that the party must be given a period of at least 14 days for the submission of opinions. The general rule for administrative dispositions in Korea's administrative procedure statute (행정절차법, art. 21(3)) refers to a period of 10 days or more, so the floor in PIPC cases is the longer one. The period that actually applies is the one written in the prior notice.

The decisions show what respondents actually did with that time. In the 431 decisions that record both the date the prior notice was sent and the date the opinion was filed, the median was 14 days, 51% filed within two weeks, and 84% filed between 8 and 30 days. These are the days respondents took, not the periods they were given, so they should not be read as evidence of what the Commission allows.

For a headquarters team the practical point is the order of work. Fourteen days is short for a group that has to obtain turnover records, translate the notice and clear an opinion through several approvers. Most of that material can be assembled during the investigation stage, before any prior notice exists.

What the opinion argues also matters. In the published decisions that record a finding on the respondent's arguments, arguments about the scope of the turnover used for the surcharge were accepted in whole or in part in 70% of 27 cases, while arguments that safeguards had been in place were reflected in 14% of 14. Only a minority of decisions contain a separate section on the respondent's arguments, so these percentages are not a success rate for cases generally. They are a reason to document the turnover breakdown with care if the opinion is going to rely on it.

What does the first reply commit you to?

The reply to a request for materials is first of all a submission of facts and documents. The formal opportunity to answer a proposed sanction comes later, in the opinion on the prior notice. That does not mean explanations should be held back from the first reply; it means the two documents do different jobs. Even so, the first reply is not left behind when the case moves on.

As at September 2026 we have not found a published court decision that rules directly on the scope or procedure of a request for materials under article 63. What the published cases do show is that the service scope, the number of records and the turnover established during the investigation are used again when the surcharge is calculated and when a court reviews it.

  • Scope of the service. In a case where a company ran a primary-school learning service separately from its secondary-school service, the Seoul High Court read "the personal information held" in the surcharge notice as the personal information connected with the violation, not everything the company held. Because the two services were separate, the company could not argue that the leak was small in proportion to its total holdings (Seoul High Court, 2 November 2023, 2023누34486, made final when the Supreme Court dismissed the appeal in 2023두61554).
  • Turnover and the surrounding facts. The Supreme Court has held that the relevant turnover is to be determined by the scope of the service that holds and manages the personal information affected by the leak. In the same case, where a surcharge was set aside as disproportionate, the court weighed the one-day duration of the violation, the 20 users affected, the report made the following day and the absence of material pointing to a structural problem (Supreme Court, 12 October 2023, 2022두68923).

None of these is a ruling on what a first reply must contain. These cases support stating the basis for each figure in the first reply. A user count or a turnover figure given at the investigation stage is likely to be compared with the figure put forward later, and a difference between the two has to be explained by the company.

A related point concerns what happens to the documents. Article 63(6) of PIPA prohibits the Commission from providing materials it has received or collected to third parties, or disclosing them to the public, except as the Act allows, and Notice art. 14 places a confidentiality duty on investigators. It is still sensible to identify in advance which parts of a submission contain trade secrets or third-party information and why they need to be included.

Before the first reply goes out

  • Read the purpose and the scope from the letter. Under Notice art. 8 the investigator works within the purpose stated in the letter. Copy each requested item into the working file in the letter's own words and numbering, including the period it covers.
  • Fix a reference date for every figure. User numbers, the range of data processed and system settings change over time. State which service, which database and which date each figure is taken from.
  • Keep one table for the whole group. If the Korean entity, the regional team and headquarters each draft their own account, the accounts tend to differ on the same event. One table that links each request to an answer, a source document and an owner avoids that. This is an internal working document, not a statutory form.
  • Record conflicts between documents. Where an incident report and a system log give different times, note both, the reason for the difference and which one the reply relies on. Existing documents should not be quietly amended to remove the difference.
  • Ask for an extension before the deadline if one is needed. Notice art. 12-2 requires the reason and the scope of the extension to be notified before the deadline passes, and the Commission may allow it to the extent the purpose of the investigation can still be achieved. An extension is not automatic. Where the material is held abroad, the time needed to collect it is the kind of reason that has to be explained in the request.
  • Decide who speaks. Under Notice art. 13 counsel may take part in the investigation where the company applies, but participation can be restricted where counsel answers in place of the person being investigated. The people who can explain the systems still need to be identified and prepared.

How these steps apply depends on the wording of the letter and the facts being investigated, and the right course can differ from case to case.

Frequently asked questions

Q. Is a request for materials from the PIPC the same thing as a prior notice of a sanction?

No. A request for materials under article 63(1) of the Personal Information Protection Act belongs to the investigation stage, in which the Commission is establishing facts and collecting documents. A prior notice comes after the investigation and sets out the facts and legal grounds of the sanction the Commission proposes, and the company answers it with an opinion and evidence. A third kind of letter, the pre-inspection under article 63-2, does not presuppose a suspected violation at all. The reply to a request for materials and the opinion on a prior notice are different documents with different jobs.

Q. How long does a PIPC investigation take?

In the published decisions that record the dates, the median from the start of the investigation to the decision is 360 days, with a range from 64 to 1,416 days. The investigation period itself has a median of 185 days, and the median from the end of the investigation to the decision is a further 120 days. Each of these figures has its own denominator, because a decision only yields a figure where it records the dates concerned. On 2 October 2026 the Commission announced target periods of 12 months for major cases, 6 months for ordinary cases and 3 months for minor cases. That is a plan to be introduced in stages, not a period fixed by statute.

Q. How many days do we have to respond to a prior notice from the PIPC?

Article 16(1) of the Commission's notice on investigations and dispositions (PIPC Notice No. 2026-13, in force 11 September 2026) requires that the party be given a period of at least 14 days for the submission of opinions. The period actually given is stated in the prior notice itself. In the 431 published decisions that record both the date the prior notice was sent and the date the opinion was filed, the median was 14 days. Those are the days respondents actually took, not the periods the Commission allowed.

Q. Can we ask for more time to answer a request for materials?

The notice on investigations and dispositions provides for it in article 12-2. Where there is an unavoidable reason, the company must tell the Commission why an extension is needed and what it covers before the deadline passes, and the Commission may allow an extension to the extent that the purpose of the investigation can still be achieved. An extension is not automatic on request, so the request should say which items need more time, what has already been collected and what remains to be confirmed.

This page is general information on Korean law for readers outside Korea and is not legal advice; what a particular letter requires depends on its wording and on the facts under investigation. Korean is the governing language of the statutes, notices and judgments cited, and the English renderings here are unofficial. The figures are read from the decisions the Commission has published and change as more are published.

Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul. The Korean-language note on preparing a first reply is at 개인정보위 자료제출 요구를 받았습니다. The contact page sets out what I work on and what happens after you write.