South Korea’s Personal Information Protection Act requires certain foreign companies with no office in Korea to designate a domestic agent. The duty sits at PIPA Article 31-2, and the agent has to be located in Korea.
The short answer: above thresholds set by Enforcement Decree Article 32-2, a foreign company with no office, place of business, or facility in Korea has to designate a domestic agent who is located in Korea. Because the agent has to be in Korea, we deliver this through a vetted local partner and manage the designation, remaining your single point of contact. We do not publish the exact thresholds here, and say plainly why below.
What the Korean requirement is
PIPA Article 31-2, Designation of a domestic agent, requires certain foreign personal information controllers with no office, place of business, or facility in Korea to designate an agent located in Korea. The provision was introduced by the March 2023 amendment to PIPA and renumbered from the former Article 39-11, which had applied only to information and communications service providers before the amendment broadened it.
The thresholds that decide who is caught sit in Enforcement Decree Article 32-2, not in the Act itself, and those thresholds have themselves moved: the revenue test was amended to use total company sales revenue rather than revenue from the online business division alone, effective 15 September 2023. Because the thresholds are set by decree rather than by the Act, and because they have already changed once, we treat them as something to confirm against the current text at the time of scoping rather than a fixed number to publish and let go stale.
Who needs it
A company with no office, place of business, or facility in Korea whose Korean-directed processing puts it above the Enforcement Decree Article 32-2 thresholds. The exact test is a scoping question, confirmed against the current decree rather than answered generically, because the thresholds have already been revised once since the duty was introduced.
Who can hold the role
Article 31-2 requires the agent to be located in Korea. There is no route for a company established outside Korea, ours included, to perform the role directly. This is the same structural point that governs the China and Turkey appointments: a written mandate from an EU establishment is not enough where the local statute ties the role to local presence.
What we do
- Local domestic agent designation, coordinated through a vetted Korean partner who meets the location requirement.
- Filing and maintenance of the designation as your Korean footprint or processing changes.
- Threshold scoping, confirmed against the current Enforcement Decree rather than a number quoted from memory, before you rely on it either way.
- Single point of contact. You deal with Engage throughout; we manage the relationship with the local partner.
- Coordination with your wider footprint, including an EU or UK representative and a DPO, where you need more than one appointment.
How it works
Scoping. We confirm against the current statute and Enforcement Decree whether the domestic agent duty applies to you, rather than apply a threshold that may already be out of date.
Designation. The domestic agent is engaged through our local partner and formally designated.
Filing. The designation is filed and recorded as the statute requires.
Ongoing. The agent remains the designated Korean contact, and we keep the designation current when your footprint or processing changes.
What it costs
This appointment is scoped per engagement rather than sold as a published flat fee, because the local partner’s own fee varies by case and the threshold test itself needs confirming before scope is fixed. Where it sits inside a wider privacy program, it is scoped alongside the DPO tiers, which start From €1,000 per month for DPO Foundation. See pricing for the published DPO and EU representative figures.
Why Engage Compliance
We are honest about the boundary. The Korean agent has to be located in Korea, so we do not claim to hold the role ourselves, and we do not publish a threshold figure that could already be stale. We scope whether the duty applies to you against the current Enforcement Decree, coordinate the vetted local partner who holds the role, manage the filing, and stay your single point of contact. Where you also need an EU or UK representative or a DPO, we scope all of it together. Every engagement carries professional indemnity and cyber insurance.
Sources and references
- Personal Information Protection Act, Article 31-2 (Designation of a domestic agent), as amended March 2023
- Enforcement Decree of the Personal Information Protection Act, Article 32-2, as amended with effect from 15 September 2023
- Personal Information Protection Commission (PIPC), the Korean data protection regulator