Even if a company does not have a separate legal entity in Korea and directly provides SaaS, platform, e-commerce, AI, or other services from overseas, Korea’s Personal Information Protection Act (PIPA) may apply if the company processes the personal information of users in Korea.
In particular, certain overseas businesses that meet the statutory thresholds are required to appoint a domestic representative in Korea.
From October 2, 2025, where an overseas business has established a Korean entity or has a Korean entity over which it exercises controlling influence, the overseas business must appoint its domestic representative from among those Korean entities. The overseas headquarters is also subject to obligations to manage and supervise the domestic representative.
1. Can Korea’s Personal Information Protection Act Apply to Overseas Businesses?
Yes. Even an overseas business may be subject to Korea’s PIPA if it provides services to Korean data subjects or if its processing of personal information affects data subjects in Korea.
Accordingly, the fact that a company has no Korean legal entity or that the servers processing personal information are located overseas does not automatically exclude the company from Korean data protection regulations.
Overseas SaaS providers, online platforms, AI services, games, content providers, and e-commerce businesses should review whether Korean law applies if they process Korean users’ membership information, payment information, access information, or other personal data.
The Personal Information Protection Commission also advises overseas businesses operating services in Korea to review domestic requirements relating to personal data breach reporting, privacy policies, data subject rights, and appointment of a domestic representative.
[PIPC Guidance on the Application of Korea’s Personal Information Protection Act to Overseas Businesses]
2. Which Overseas Businesses Must Appoint a Domestic Representative?
Not every overseas business is required to appoint a domestic representative.
Under Article 31-2 of the Personal Information Protection Act and Article 32-3 of its Enforcement Decree, a personal information controller without an address or place of business in Korea must appoint a domestic representative if it falls under any of the statutory criteria.
Businesses Subject to the Domestic Representative Requirement
Category | Appointment Threshold |
Revenue | Total revenue for the preceding year of KRW 1 trillion or more |
Scale of Korean data subjects | Personal information of 1 million or more Korean data subjects on average per day was stored or managed during the immediately preceding three months, as of the end of the previous year |
PIPC designation | The Personal Information Protection Commission has reviewed and resolved that appointment of a domestic representative is necessary after making a request for submission of materials |
The revenue threshold refers not only to revenue generated in Korea, but to the overseas business’s total revenue for the preceding year.
Therefore, a global business should not conclude that it is exempt merely because its sales in Korea are small. Both its total revenue and the scale of Korean users should be reviewed.
[Personal Information Protection Act, Article 31-2]
[Enforcement Decree of the Personal Information Protection Act, Article 32-3]
3. If the Overseas Business Has a Korean Entity, Must That Entity Be Appointed?
If an overseas business subject to the domestic representative requirement has a Korean entity specified by law, it must appoint the domestic representative from among those Korean entities.
The amended PIPA, effective October 2, 2025, requires an overseas business to select the domestic representative from among its Korean entities where the overseas business has established that entity or exercises controlling influence over it.
The Enforcement Decree further specifies Korean entities over which an overseas business exercises such influence, including:
- a Korean entity established by the overseas business;
- a Korean entity in which the overseas business appoints the representative director;
- a Korean entity in which the overseas business appoints, or has the right to appoint, 50% or more of the officers; and
- a Korean entity in which the overseas business has invested 30% or more of the issued shares or total capital contribution.
Accordingly, where an overseas business subject to the domestic representative requirement has a Korean subsidiary or affiliate, it should first review its governance and ownership structure to determine which Korean entity must be designated.
The six-month grace period previously provided to businesses that had already appointed a domestic representative at the time the amended law took effect has now ended.
[Personal Information Protection Act, Article 31-2]
4. What Does a Domestic Representative Do?
A domestic representative is not merely a local point of contact for the overseas business. It must actually perform the duties assigned under the PIPA.
The domestic representative performs, on behalf of the overseas business, duties including:
- handling complaints related to personal information processing and providing remedies;
- receiving and reporting notices of personal data breaches; and
- responding to requests by the Personal Information Protection Commission for submission of goods, documents, or other materials.
Where a domestic representative is appointed, the name of the domestic representative, the name of its representative, address, telephone number, and email address must also be included in the company’s privacy policy.
The Personal Information Protection Commission has emphasized that the domestic representative regime is intended to ensure practical protection and remedies for Korean data subjects.
Therefore, businesses should not limit compliance to preparing an appointment document. They need an actual operational structure capable of responding to requests from Korean users and to investigation or document submission requests from the PIPC.
5. Must the Overseas Headquarters Also Manage and Supervise the Domestic Representative?
Yes. An overseas business that appoints a domestic representative is required to manage and supervise the performance of the domestic representative’s duties.
The Enforcement Decree requires measures such as:
- providing the domestic representative with relevant training at least once a year;
- checking whether a plan for performing the domestic representative’s duties has been established;
- checking whether that plan is actually being implemented; and
- confirming whether improvements identified through such checks have been carried out.
Therefore, appointment of a domestic representative does not terminate the overseas company’s compliance obligations.
The overseas headquarters and the domestic representative should establish in advance procedures for forwarding privacy complaints, responding to personal data breaches, and preparing materials requested by the PIPC.
[Enforcement Decree of the Personal Information Protection Act, Article 32-3]
6. What Penalties Apply for Violating the Domestic Representative Requirement?
Administrative fines may be imposed if an overseas business fails to appoint a domestic representative or fails to comply with its appointment and supervision obligations.
Major Administrative Fines Relating to Domestic Representatives
| Violation | Administrative Fine |
| Failure to appoint a domestic representative | KRW 20 million |
| Failure to appoint from among the required Korean entities | KRW 20 million |
| Failure to manage and supervise the domestic representative | KRW 20 million |
| Failure to include domestic representative information in the privacy policy | Fine imposed depending on the number of violations |
In addition, if the domestic representative violates the PIPA in connection with the statutory duties performed on behalf of the overseas business, the violation is deemed to have been committed by the overseas personal information controller.
Therefore, appointing a Korean company or an external service provider as a domestic representative does not separate the overseas headquarters from responsibility under Korean data protection law.
[Personal Information Protection Act, Article 75 — Administrative Fines]
7. What Should an Overseas Business Check Before Appointing a Domestic Representative?
When determining whether appointment is required, an overseas business should review not only whether it has a Korean legal entity, but also its overall business structure and how it processes personal information relating to Korean data subjects.
Key points include:
- whether the business processes personal information of Korean data subjects;
- whether the overseas headquarters can be regarded as having an address or place of business in Korea;
- whether the preceding year’s total revenue meets the statutory threshold;
- the scale of personal information stored or managed for Korean data subjects;
- whether the overseas headquarters has established a Korean entity or exercises controlling influence over one;
- whether the current domestic representative can actually perform the statutory duties;
- whether domestic representative information is properly reflected in the privacy policy; and
- whether training and monitoring procedures between the overseas headquarters and the domestic representative have been established.
For global groups with multiple Korean affiliates, it is particularly important to examine not only shareholding ratios but also authority to appoint representative directors and other officers.
8. Frequently Asked Questions (FAQ)
Q1. If our Korean sales are below KRW 1 trillion, can we avoid appointing a domestic representative?
Not necessarily.
Even if the revenue threshold is not met, an overseas business may still be required to appoint a domestic representative if it stores or manages personal information of 1 million or more Korean data subjects on average per day, or if the PIPC determines that appointment is necessary.
Q2. If we have a Korean subsidiary, must we always appoint a domestic representative?
No.
You must first determine whether the overseas business itself is subject to the domestic representative requirement under the PIPA. If it is, and a Korean entity specified by law exists, the domestic representative must be appointed from among those Korean entities.
Q3. Can an external professional service provider in Korea be appointed as the domestic representative?
If there is no Korean entity that must be appointed under the law, a person with an address or place of business in Korea may be appointed as the domestic representative.
However, if the overseas business has established a Korean entity or exercises controlling influence over one, the appointment must be made from among those Korean entities. The corporate structure should therefore be reviewed first.
Q4. Is a separate filing required after appointing the domestic representative?
The PIPA requires the domestic representative to be formally appointed and the relevant information to be included in the privacy policy.
Accordingly, compliance involves more than preparing an appointment document.
The privacy policy and the actual operational structure for performing the representative’s duties should also be updated.
9. Key Considerations When Appointing a Domestic Representative
Appointing a domestic representative should not be treated as simply designating a local contact person in Korea.
The overseas business should first determine whether it is legally required to appoint a representative and, if it has a Korean subsidiary or affiliate, which entity must be designated. After appointment, it should establish an operating structure that enables the domestic representative to respond to privacy complaints, data breaches, and PIPC investigations in practice.
In particular, because the requirements for selecting and supervising a domestic representative were strengthened from October 2, 2025, overseas businesses that appointed a domestic representative under the previous regime should also review whether their current arrangement complies with the amended requirements.