Contact us
Contact us

Korea PIPA Domestic Agent

South Korea's Personal Information Protection Act requires a company with no address or place of business in Korea to designate a domestic agent once it passes thresholds set by decree. The agent has to have an address or place of business in Korea, so Engage does not hold the role itself. Where Korean law requires an outside agent, we arrange a local partner in Korea to hold the role and coordinate the appointment for you. Tell us about your Korean footprint and we will check first whether the duty applies to you at all.

Send an inquiry
By Julian Gage Last reviewed: 28 September 2026

South Korea’s Personal Information Protection Act (PIPA) requires some foreign companies with no address or place of business in Korea to designate a domestic agent. The duty sits at PIPA Article 31-2, and the thresholds that decide who is caught sit in Article 32-3 of the Enforcement Decree.

The short answer: you need a Korean domestic agent only if you have no address or place of business in Korea and you either had KRW 1 trillion or more in total revenue last year, hold personal information on a daily average of 1 million or more people in Korea, or have been singled out by the PIPC after a request for materials. The agent must have an address or place of business in Korea, so Engage does not hold the role itself. Where the law requires one, we arrange a local partner in Korea to hold it. Send us an enquiry and we will check your numbers against the current text first.

As of 28 September 2026, checked against the official Korean text of PIPA (Act No. 21445, in force since 11 September 2026) and its Enforcement Decree (Presidential Decree No. 36671, in force since 11 September 2026) on the Korean Law Information Center, linked below.

What the Korean requirement is

PIPA Article 31-2(1) requires a personal information controller with no address or place of business in Korea, and which meets the criteria set by Presidential Decree, to designate a domestic agent in writing. The provision started life in 2020 as Article 39-11, which applied only to information and communications service providers, and moved to Article 31-2 in the March 2023 amendment so that it now covers controllers generally.

Two later amendments changed how it works. Act No. 20897, in force since 2 October 2025, added the rule on Korean affiliates described below, a duty to supervise the agent, and a duty to name the agent in your privacy policy. Act No. 21445, in force since 11 September 2026, restated the agent’s tasks.

Who needs it

Enforcement Decree Article 32-3(1) catches a company with no address or place of business in Korea that meets any one of these:

  1. Total revenue of KRW 1 trillion or more in the previous year (the previous business year for a company), converted to won at that year’s average exchange rate.
  2. Personal information of a daily average of 1 million or more data subjects in Korea stored or managed over the three months before the end of the previous year.
  3. A request from the PIPC to submit materials under PIPA Article 63(1), followed by a PIPC decision that you need to designate an agent.

These are high bars. Most startups and scale-ups we work with meet none of them, and if that is your position we will say so rather than sell you an appointment you do not need.

Who can hold the role

Article 31-2(2) requires the agent to have an address or place of business in Korea. Since 2 October 2025 it also says where to look first: if you have a Korean company that you established, or one you control, the agent has to be one of those companies. Enforcement Decree Article 32-3(3) defines control as appointing or dismissing the CEO or appointing at least half of the officers, or holding at least 30% of the total shares or capital.

So there are two cases. If you have a Korean subsidiary or controlled company, it becomes your agent and no outside partner is involved. If you have none, an outside agent with an address or place of business in Korea holds the role, and that is where a local partner comes in. Engage is established in the Netherlands, so we cannot hold the role ourselves in either case.

What the agent does

Under Article 31-2(1), as in force since 11 September 2026, the agent acts for you on:

  • handling complaints and remedies from people in Korea about how you process their personal information, under Article 31(4)(5);
  • the notifications and breach reports required by Article 34(1), (2), and (4);
  • submitting materials the PIPC requests under Article 63(1).

Article 31-2(4) requires your privacy policy to state the agent’s name (for a company, its name and the name of its representative), its address or place of business, phone number, and email address. Article 31-2(5) treats a breach of PIPA by the agent in these matters as your own.

Your duty to supervise the agent

Since 2 October 2025, Article 31-2(3) makes you responsible for supervising the agent. Enforcement Decree Article 32-3(4) spells out what that means: training the agent on its duties at least once a year, and checking that the agent has made a plan for its work, carried the plan out, and fixed anything the check found. This applies whether the agent is your own Korean affiliate or an outside partner.

Fines

Under PIPA Article 75(3), each of these can bring an administrative fine of up to KRW 20 million: not designating an agent when required, designating one in breach of the rule on Korean affiliates, and not supervising the agent. Under Article 75(4), leaving the agent’s details out of your privacy policy can bring a fine of up to KRW 10 million.

What we do

  • Threshold check. We read your revenue and Korean user numbers against Enforcement Decree Article 32-3 and tell you plainly whether the duty applies.
  • Korean affiliate check. If you have a Korean company that has to be your agent, we tell you, and help you set up the supervision the law now requires.
  • Local partner. Where you are caught and have no Korean affiliate, we arrange a local partner in Korea to hold the role and coordinate the written designation with you.
  • Privacy policy wording. The agent disclosure that Article 31-2(4) requires.
  • Supervision. A yearly training and plan check you can show the PIPC, whoever holds the role.
  • Coordination with your wider footprint, including an EU or UK representative and a DPO, where you need more than one appointment.

How it works

Scoping. You send us an enquiry with your revenue, your Korean user numbers, and whether you have any company in Korea. We check them against the current decree.

Arranging the agent. If you are caught and have no Korean affiliate, we arrange a local partner in Korea and agree the written designation with you and the partner.

Disclosure. Your privacy policy is updated to name the agent as Article 31-2(4) requires.

Ongoing. We run the yearly supervision check with the agent, and review the thresholds each year as your numbers change.

What it costs

Korea is available on request, with no online checkout and no published price. It is quoted per inquiry, because the local partner’s fee in Korea is part of the cost and many companies that ask turn out not to be caught at all. Where it sits inside a wider privacy program, it is scoped alongside the DPO tiers, which start From €1,000 per month for DPO Foundation. To ask, send an inquiry and we will check the thresholds against your numbers first.

Why Engage Compliance

We are clear about the boundary. The Korean agent needs an address or place of business in Korea, so we do not claim to hold the role ourselves. We check first whether the duty applies to you at all, tell you if your own Korean company has to take the role, and arrange a local partner only where the law requires an outside agent. Where you also need an EU or UK representative or a DPO, we scope all of it together. Every engagement carries professional indemnity and cyber insurance.

Further west, see our pages for an EU representative for Indian companies and Israeli companies.

Sources and references

Contact us Book a free intro call

FAQ

Frequently asked questions

Can Engage also act as our DPO?

Yes. Engage supports both Data Protection Officer work and Article 27 representative work, as two separate products scoped to what you need. See DPO Services.

Does a foreign company need a domestic agent in Korea under PIPA?

Only if it has no address or place of business in Korea and meets one of the tests in Article 32-3 of the PIPA Enforcement Decree: total revenue of KRW 1 trillion or more in the previous year, personal information of a daily average of 1 million or more people in Korea stored or managed over the three months before the end of the previous year, or a request from the Personal Information Protection Commission (PIPC) to submit materials under PIPA Article 63(1) followed by a PIPC decision that you need an agent. Most startups and scale-ups meet none of these, and we will tell you so if that is your position.

What are the thresholds and fines?

As of 28 September 2026, the Enforcement Decree Article 32-3 thresholds are KRW 1 trillion in total revenue for the previous year (converted to won at that year's average exchange rate) or a daily average of 1 million Korean data subjects, plus companies the PIPC designates after a request for materials. Under PIPA Article 75, failing to designate an agent, designating one in breach of the rule on Korean affiliates, or failing to supervise the agent can each bring an administrative fine of up to KRW 20 million, and leaving the agent's details out of your privacy policy up to KRW 10 million.

Who can act as our domestic agent in Korea?

PIPA Article 31-2(2) says the agent must have an address or place of business in Korea. Since 2 October 2025, if you have a Korean company that you set up, or one you control (you appoint its CEO or at least half its officers, or hold at least 30% of its shares or capital), the agent has to be chosen from among those companies. Only where you have no such company can an outside agent, such as a local partner we arrange, hold the role.

What does the domestic agent actually do?

Under Article 31-2(1) as in force since 11 September 2026, the agent acts for you in handling complaints and remedies for people in Korea about how you process their personal information, the notifications and breach reports required by Article 34, and handing over materials the PIPC requests under Article 63(1). The designation has to be in writing, and your privacy policy has to name the agent with its address, phone number, and email address.

Is a Korea PIPA domestic agent the same as a GDPR Article 27 EU representative?

No. They answer to different regulators under different statutes, and appointing one does not satisfy the other. A company selling into both the EU and Korea may need both appointments, and we scope them together along with a DPO where you need one.

Can Engage Compliance be our domestic agent in Korea directly?

No. The agent needs an address or place of business in Korea, and Engage is established in the Netherlands. Where the law requires an agent and you have no Korean affiliate that must take the role, we arrange a local partner in Korea to hold it and coordinate the appointment with you. Send us an enquiry and we will confirm first whether you are caught at all.

Does a US company need a domestic representative in South Korea under PIPA?

Only if it has no address or place of business in Korea and meets one of the Enforcement Decree Article 32-3 tests: KRW 1 trillion or more in total revenue last year, personal information on a daily average of 1 million or more people in Korea, or a PIPC decision after a request for materials. Being a US company does not change the test, and most startups and scale-ups meet none of these.

Who can be our domestic agent in Korea if we have no office there?

If you have no Korean company that you set up or control, an outside agent with an address or place of business in Korea holds the role. Engage is established in the Netherlands, so we cannot hold it ourselves; where the law requires an outside agent, we arrange a local partner in Korea and coordinate the written designation with you.

We have a Korean subsidiary. Can we still use an outside agent?

No. Since 2 October 2025, if you have a Korean company that you established or control, the agent has to be chosen from among those companies. Control means appointing or dismissing the CEO, appointing at least half of the officers, or holding at least 30% of the shares or capital. In that case no outside partner is involved.

Do we have to supervise the domestic agent?

Yes. Since 2 October 2025, Article 31-2(3) makes you responsible for supervising the agent, whether it is your own Korean affiliate or an outside partner. That means training the agent on its duties at least once a year and checking that it has a plan for its work, has carried it out, and has fixed anything the check found.

What has to go in our privacy policy about the agent?

Article 31-2(4) requires your privacy policy to state the agent's name (for a company, its name and the name of its representative), its address or place of business, phone number and email address. Leaving these details out can bring an administrative fine of up to KRW 10 million under Article 75(4).

How much does a Korean domestic agent cost?

There is no published price for Korea. It is quoted per inquiry, because the local partner's fee in Korea is part of the cost and many companies that ask turn out not to be caught at all. Send an inquiry and we will check the thresholds against your numbers first.

Related

Hub Non-EU representative and agent services Service China PIPL compliance services Service Turkey KVKK data controller representative Service EU Representative service Service Global privacy compliance Service DPO Services