Key points. Whether a Korean entity may give customer data to Korean investigators turns on which document arrived and on the entity's own regulatory status. A court permission for communication confirmation data, meaning records such as the other party's number, call times, internet logs and IP addresses (Protection of Communications Secrets Act article 13), and a written request for telecommunications user information, meaning details that identify the subscriber such as name, address and user ID (Telecommunications Business Act article 83(3)), are both addressed to telecommunications business operators. The Constitutional Court called the article 83(3) request a voluntary investigative measure that an operator can decline without legal disadvantage (2016Hun-Ma388). A private company cannot rely on the criminal-investigation exception in article 18(2)(7) of the Personal Information Protection Act, because the proviso to article 18(2) limits it to public institutions. A voluntary disclosure by a private company therefore needs another basis in article 18(2): separate consent (item 1), a clearly urgent need to protect life, body or property (item 3), an urgent need for public safety (item 10), or, as is usual for a routine request, another Act that provides for it (item 2), read strictly by the Ministry of Government Legislation and somewhat more widely by the PIPC. A search and seizure warrant is not the company's decision, but checking the demand against the warrant's stated scope still is.

A sealed letter from a Korean police station reaches the Korean entity's customer centre, and headquarters is asked whether the group's rule of no disclosure without a warrant works in Korea. The Personal Information Protection Act ("PIPA") does not ask whether the company wishes to cooperate. It asks what the legal basis for the disclosure is, and the answer starts with the document itself.

Which document has the Korean entity received?

The first task is to read the title of the document and the provision it cites. The documents below can look alike, but each rests on a different statute and leaves the company in a different position.

Document receivedStatutory basisWho decidesAddressed toCan the company decline?Notice to the customer
Search and seizure warrantCriminal Procedure Act art. 215A judge issues it; investigators execute itThe company, as the party on which it is executedNot a choice the company makes; the company checks the demand against the warrant's scopeThe party that seized must notify the data subject of information copied from a storage medium (art. 106(4))
Court permission for communication confirmation dataProtection of Communications Secrets Act art. 13(4)The competent district court or branch courtTelecommunications business operators (art. 13(1))Not covered by this noteNot covered by this note
Written request for telecommunications user informationTelecommunications Business Act art. 83(3) and (4)Investigators; no court involvementTelecommunications business operatorsThe Constitutional Court called it voluntary, with no legal disadvantage for declining (2016Hun-Ma388)The requesting prosecutor or agency head notifies within 30 days from the date the information was received, subject to deferral (art. 83-2)
Request for voluntary submissionCriminal Procedure Act art. 218The company itselfThe company, as owner, possessor or custodianThe submission is the company's own decision, so PIPA article 18 appliesNot covered by this note
Cooperation letter with no usable basis statedNot identifiable from the documentThe company itselfThe companyA private company may be unable to find a basis, and can then reply asking for the proper procedureNot covered by this note

Courts are involved in the first two documents and not in the others. The last row leaves the company to find the basis itself. The user-information request and the cooperation letter are the ones most often confused, because both arrive as sealed letters with a deadline and a request for cooperation.

Why the criminal-investigation exception is not available to a private company

Article 18(1) of PIPA prohibits using personal information, or providing it to a third party, beyond the scope for which it was collected. Handing customer data to investigators will usually fall outside the original purpose, so article 18 applies.

Article 18(2) lists the exceptions. Item 7 covers cases where the information is needed to investigate a crime or to bring and maintain a prosecution, and it is the item a compliance team tends to reach for first. The proviso to article 18(2), however, limits items 5 to 9 to public institutions. A private company therefore cannot use item 7. The same limitation already appeared in the original 2011 Act and has been carried through to the current text (Act No. 21445).

The item a private company actually has to examine is article 18(2)(2): cases where another Act contains a special provision. Items 1 (separate consent), 3 (clearly urgent need to protect life, body or property) and 10 (urgent need for public safety such as public health) are not limited to public institutions either, but a routine investigative request will rarely fit them.

The bar for item 2 is high. The Ministry of Government Legislation read it strictly: the other Act must specifically provide for something different from PIPA on use or provision beyond purpose, and a general duty to cooperate is not enough (Interpretation No. 17-0506, 4 December 2017). A statutory duty to produce documents, by contrast, has been held to override an objection based on personal information (Supreme Court Decision 2014Ma2239, 1 July 2016, on article 344(2) of the Civil Procedure Act).

The provisions most often cited in police cooperation letters fail this test. In Decision No. 2021-122-043 (10 November 2021) the Personal Information Protection Commission ("PIPC") resolved, in an unofficial translation of its operative wording, that "a private company may not provide personal information to an investigative agency on the basis of article 199 of the Criminal Procedure Act or article 8(1) of the Act on the Performance of Duties by Police Officers." The PIPC applied a wider test than the Ministry, under which an Act can qualify if it is reasonably foreseeable that personal information will be involved. The two bodies therefore do not use one test, and the Ministry's is the narrower; for police cooperation letters the PIPC decision is the one that speaks directly, and the two provisions failed even its wider test. They failed because they permit inquiries to public offices and organisations without specifically allowing personal information to be provided. A public institution receiving the same letter could consider item 7, and one court accepted that basis for a public body that responded to a police request (Suwon District Court, Case No. 2022Gadan517097, 7 January 2025).

A specific provision looks like article 32(6)(5) and (6) of the Credit Information Use and Protection Act, which allows disclosure under a court order or a warrant issued by a judge and also deals with emergency disclosure without a warrant, subject to destruction of the information if no warrant is obtained within 36 hours of its provision (see article 32(6)(6) for the conditions).

Is the Korean entity a telecommunications business operator?

Article 83(3) of the Telecommunications Business Act allows an operator to comply when a court, a prosecutor, the head of an investigative agency or the head of an intelligence agency asks for a user's name, resident registration number, address, telephone number, user ID and date of joining or leaving, for purposes such as a trial, an investigation, the execution of a sentence or protecting national security. Article 83(4) requires the request to be in writing and to state the reason, the link to the user and the scope of information sought. The 2023 amendment also changed who may ask and for what, adding tax-crime investigations by the National Tax Service.

The provision addresses telecommunications business operators. If the Korean entity is not one, article 83(3) appears unable to serve as the "other Act" under PIPA article 18(2)(2). The court permission under article 13 of the Protection of Communications Secrets Act has the same structure, because article 13(1) names operators under the Telecommunications Business Act as the party from whom the material is requested.

Letters in this form nevertheless reach shopping, booking, delivery and app businesses, and the industry label does not decide the question. Article 2(8) of the Telecommunications Business Act defines an operator as a person that has registered or reported (including where reporting is exempted) and provides telecommunications services, and article 22(5)(1) treats certain small value-added businesses as having reported. The Korean entity should therefore check its filings and the nature of the service it actually provides before concluding that it is outside the regime.

Where the entity is an operator, the Supreme Court has held that it has no general duty to review the substance of each request; it checks the formal and procedural requirements of the provision (Decision 2012Da105482, 10 March 2016). That judgment applied the former provision, article 54(3) and (4); whether it carries over unchanged to the current article 83 is a separate question. A company outside the provision cannot borrow that reasoning in any event, because for it the provision sets no requirements to check.

What a warrant changes, and what it does not

A warrant is not a document on which the company decides. Under article 215(2) of the Criminal Procedure Act, a judicial police officer applies to a prosecutor, who asks a district court judge to issue it, and the seizure is confined to what is relevant to the case. The company is the party on which the warrant is executed.

The Seoul Central District Court considered a case in which investigators faxed a copy of a warrant to a messaging service, without showing the original, and received the data by email (Case No. 2014Gadan5351343, 2 October 2019; appeal dismissed in Case No. 2019Na68505; further appeal dismissed in Supreme Court Case No. 2020Da285505). The court held that a disclosure under an unlawfully executed warrant did not fall within the "other Act" exception of the former Network Act. It nonetheless rejected the company's liability for damages. Showing the warrant was the investigators' duty, and absent special circumstances such as an objectively obvious abuse of power, a private company has no power or duty to review the legality of execution. Whether current PIPA produces the same result is a separate question.

The company's own check survives the warrant. Material outside the items and places the warrant specifies is not covered by it. Recording whether the original was shown, and whether execution was by copy, fax or email, is not something the court required, but it gives the company an account of what it received and what it handed over.

A request for voluntary submission under article 218 of the Criminal Procedure Act is different. Since amendments in force on 2 October 2026, the provision names judicial police officers as the party that may seize what is voluntarily submitted. The submission itself is the company's decision, so PIPA article 18 applies in full.

How a "no warrant, no data" policy lines up

Many groups apply a global rule that customer data is released only under a warrant or court order. Read against the documents above, the rule and Korean law point in the same direction more often than not.

For a warrant, the policy and the law agree, and what remains is checking the demand against the warrant's scope and recording how it was presented and executed, since the 2014Gadan5351343 judgment shows that execution can be challenged later. For a request under article 83(3), the Constitutional Court's reading means that an operator declining under a group policy does so without legal disadvantage. In Case No. 2016Hun-Ma388 the Court said, in an unofficial translation, that such a request "is a voluntary investigation, and the telecommunications business operator cannot be regarded as suffering any legal disadvantage even if it does not comply." For a cooperation letter or a request for voluntary submission received by a private company, PIPA itself may leave no basis to disclose. In that case the policy simply restates what article 18 requires.

Two points need care. First, a court permission under the Protection of Communications Secrets Act is court-authorised but is not a warrant, so the group policy should say whether it counts as a court order. Second, as a practical recommendation, the policy can leave room for the exceptions Korean law recognises: a provision in another Act, such as the credit-information rules above, consent under article 18(2)(1), and the urgent-need items in article 18(2)(3) and (10). These exceptions permit disclosure; they do not compel it, so the policy decides whether the group uses them.

Transparency reporting is the other point of contact. The half-yearly figures from the Ministry of Science and ICT are totals reported by telecommunications business operators under article 83(6) of the Telecommunications Business Act and article 13(8) of the Protection of Communications Secrets Act. For the second half of 2025 they recorded 1,461,647 telephone numbers (534,070 documents) for user information and 349,046 telephone numbers for communication confirmation data, increases of 11.9% and 35.0% on a year earlier. The figures do not identify individual operators, and they do not include requests to companies outside the regime. A Korean entity that is not an operator will therefore have no official count of its own requests unless it keeps a register. The full half-yearly series is on the Korean data page.

Order of checks before replying

  1. Confirm the document. Record its title, the sending office and the provision it cites, exactly as written.
  2. Identify the basis. Check whether that statute addresses the Korean entity. For a court permission or an article 83(3) request, settle the entity's telecommunications status first. For a voluntary request, look for a basis in article 18(2): usually an Act that qualifies under item 2, and less often consent (item 1) or an urgent need under item 3 or 10. Check that its conditions are met. If none can be found, record that and the checks made.
  3. Limit the scope. For a warrant, compare the demand with the stated items. For a voluntary disclosure, provide only what both the request and the authorising Act cover, and under article 18(5) ask the recipient to limit its use and to protect the data.
  4. Keep the record. Log the date of receipt, the document number, the basis relied on, what was provided and who approved it. As a practical recommendation rather than a legal requirement, separating the person who decides from the engineer who extracts the data keeps the decision at company level.

Two further provisions frame the risk. Article 30(1)(3) of PIPA requires third-party provision to be described in the privacy policy, and article 71(2) punishes provision in breach of article 18(1) or (2) with imprisonment of up to five years or a criminal fine of up to KRW 50 million.

The aim is not to refuse investigators but to establish whether a basis exists, whether disclosure is mandatory or voluntary, and how much it covers. How the steps apply depends on the entity's status, the wording of the document and any other Act involved, so the result can differ from case to case.

Frequently asked questions

Q. Korean police sent our Korean entity a cooperation letter citing article 199 of the Criminal Procedure Act. Can we hand over the customer data?

Those provisions are unlikely to be enough on their own. In Decision No. 2021-122-043 (10 November 2021) the PIPC resolved that a private company may not provide personal information to an investigative agency on the basis of article 199 of the Criminal Procedure Act or article 8(1) of the Act on the Performance of Duties by Police Officers, because both provisions allow inquiries to public offices and organisations without specifically permitting the provision of personal information. A private company also cannot use the criminal-investigation exception in article 18(2)(7) of the Personal Information Protection Act, which the proviso to article 18(2) limits to public institutions. Where no other Act can be identified, the company can record that finding and the checks it made, and reply that the material should be sought through the procedure that fits it, such as a search and seizure warrant.

Q. We run an e-commerce platform in Korea. Does article 83(3) of the Telecommunications Business Act give us a basis to disclose member data?

Only if the Korean entity is a telecommunications business operator, because that is who article 83(3) addresses. If the entity is not, the provision is unlikely to serve as the 'other Act' under article 18(2)(2) of the Personal Information Protection Act. Status is not settled by the industry label. Article 2(8) of the Telecommunications Business Act defines an operator as a person that has registered or reported (including where reporting is exempted) and provides telecommunications services, and article 22(5)(1) treats certain small value-added businesses as having reported, so the entity's filings and the nature of the service it actually provides both need to be checked.

Q. If a search and seizure warrant is served, do we still need to assess the disclosure under PIPA?

Executing a warrant is a compulsory measure taken by the investigators, so the company is not deciding whether to disclose in the way it does for a voluntary request. Two points remain. First, the company should compare what is being demanded with the items and places the warrant specifies, because handing over material outside that scope is a separate act. Second, how the warrant is executed matters: in a case under the former Network Act, the Seoul Central District Court held that disclosure under a warrant executed by fax copy, without the original being shown, did not fall within the statutory exception; it nonetheless found the company not negligent and placed liability on the State (Case No. 2014Gadan5351343, 2 October 2019, final after appeal and further appeal were dismissed). Whether current PIPA produces the same result is a separate question, so recording how the warrant was presented and executed is worth doing.

Q. Does Korean law treat a request for telecommunications user information as compulsory?

The Constitutional Court did not. In Case No. 2016Hun-Ma388 (21 July 2022) it described a request under article 83(3) of the Telecommunications Business Act as a voluntary investigative measure and said that an operator that does not comply cannot be regarded as suffering any legal disadvantage. The same decision found the provision incompatible with the Constitution because it lacked notice to the person concerned. Since the 2023 amendment, article 83-2 requires the requesting prosecutor or agency head to notify the person within 30 days of receiving the information, subject to the deferral grounds in article 83-2(2) and (3).

Q. Who tells the customer that their data was given to the police?

For the two procedures with a notice provision cited on this page, the notice falls on the investigators, not on the company. For telecommunications user information, article 83-2 of the Telecommunications Business Act requires the prosecutor or agency head who received it to notify the person within 30 days of the date it received the information, subject to deferral. For information copied from a storage medium under a seizure, article 106(4) of the Criminal Procedure Act requires the party that seized it to notify the data subject without delay. This note does not cover notice for the other documents in the table, or whether the company may or should tell its own customer.

This page is general information on Korean law for readers outside Korea and is not legal advice. What a particular request requires depends on the Korean entity's status, the wording of the document and the facts, and requires individual review. All English renderings of Korean statutes, decisions and quotations on this page are unofficial; the Korean text governs.

Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul. Questions about this page can be sent through the contact page.

Sources

  • Personal Information Protection Act (Act No. 21445, in force 11 September 2026), articles 18, 30(1)(3) and 71(2): Korean text
  • Telecommunications Business Act, articles 2(8), 22(5)(1), 83 and 83-2. Articles 83 and 83-2 were amended and added by Act No. 19856 (promulgated 29 December 2023, in force 1 January 2024) and are unchanged through Act No. 21503 (in force 1 October 2026): Korean text
  • Protection of Communications Secrets Act (Act No. 21989, promulgated 29 September 2026, in force 2 October 2026), articles 6(2) and 13: Korean text
  • Criminal Procedure Act (Act No. 22009, in force 2 October 2026), articles 106, 215, 218 and 219; the deletion of article 215(1) and the amendment of articles 218 and 219 were made by Act No. 21857 (promulgated 4 August 2026, in force 2 October 2026): Korean text
  • Credit Information Use and Protection Act (in force 11 September 2026), article 32(6)(5) and (6): Korean text
  • PIPC Decision No. 2021-122-043 (10 November 2021), interpretation on requests for personal information by investigative agencies
  • Ministry of Government Legislation, Interpretation No. 17-0506 (4 December 2017)
  • Constitutional Court, Case No. 2016Hun-Ma388 (21 July 2022)
  • Supreme Court Decision 2012Da105482 (10 March 2016); Supreme Court Decision 2014Ma2239 (1 July 2016)
  • Seoul Central District Court, Case No. 2014Gadan5351343 (2 October 2019); appeal dismissed, Seoul Central District Court Case No. 2019Na68505 (13 October 2020); further appeal dismissed, Supreme Court Case No. 2020Da285505 (11 March 2021)
  • Suwon District Court, Case No. 2022Gadan517097 (7 January 2025), appeal dismissed
  • Ministry of Science and ICT, release on the provision of telecommunications user information and communication confirmation data in the second half of 2025 (31 July 2026): press release board