Personal Information Protection Act · Article 31-2
Do you need a domestic agent under Korea’s PIPA?
Personal Information Protection Act (“PIPA”), Article 31-2
In force In force. Korean-entity rule applies since 2 October 2025.
A company that handles personal data of people in Korea but has no address or office there must appoint a domestic agent in writing once it meets any one of three tests: worldwide revenue, the number of Korean data subjects, or a decision by the Personal Information Protection Commission. The agent’s details then go into the privacy policy.
| Who | Personal information handlers with no office in Korea |
|---|---|
| Tests | Meet any one of 3 |
| Korean entity first? | Yes — a Korean entity you set up or control comes first |
| Where the agent is published | Privacy policy |
| Fine for no agent (cap) | KRW 20 million |
| Status | In force. Korean-entity rule applies since 2 October 2025. |
| Korean title | 개인정보 보호법 |
| Also called | Domestic representative, local representative (국내대리인) |
Who must appoint a domestic agent?
A company with no address or office in Korea that meets any one of these tests:
- Total revenue of KRW 1 trillion or more in the prior year (or prior fiscal year), converted at that year’s average exchange rate
- Personal data of 1 million or more people in Korea stored or managed, on a daily average over the last three months of the prior year
- A request for materials from the PIPC, followed by a Commission resolution that an agent is needed
How are the numbers counted?
- Revenue
- Worldwide revenue for the prior year or prior fiscal year, converted to Korean won at that year’s average exchange rate.
- People in Korea
- A daily average of the people in Korea whose personal data you store or manage, over the last three months of the prior year. This counts everyone whose data you hold, which is usually more than your active users.
- PIPC route
- The PIPC can ask you for materials and then decide, by Commission resolution, that you need an agent, whatever your size.
Does a Korean entity have to be the agent?
If you set up a Korean entity, or control one — by appointing its CEO or at least half its officers, or holding 30% or more of its shares or capital — the agent must be chosen from among those entities. Companies that already had an outside agent when this took effect had until April 2026 to switch.
What does the agent do, and what stays with you?
| The agent | Your company |
|---|---|
| Handles privacy complaints from people in Korea and helps them get a remedy | Decides how to answer each complaint or request |
| Delivers breach notices to users and breach reports to the regulator | Decides how to respond to a breach and fixes its cause |
| Submits the materials the PIPC requests | Decides what to submit, and keeps it accurate |
| Is listed in your privacy policy as the contact in Korea | Keeps the privacy policy accurate and posted |
| Takes part in the yearly training and review | Trains and checks the agent at least once a year |
Anything the agent does wrong in these tasks is treated as your company’s own breach. Legal positions stay with your counsel.
How fast must breach notices go out?
Notices to affected users and reports to the regulator are generally due within 72 hours of becoming aware. Since the March 2026 amendment, the duty also covers cases where a breach is likely, not only confirmed. The agent delivers them; your company decides the response.
What must you publish, and where?
| Item | For a company agent |
|---|---|
| Name | Company name and its representative |
| Address | Office address in Korea |
| Phone | A Korean phone number |
| A contact email |
The agent’s name (for a company, its name and representative), address, phone number and email must appear in your privacy policy, which must stay posted on your website. PIPA does not ask you to file the appointment with the regulator; the privacy policy is the public record.
What are the penalties?
| Failure | Cap | Standard amount in the decree |
|---|---|---|
| Not appointing an agent | Up to KRW 20 million | KRW 20 million |
| Appointing an agent in breach of the Korean-entity rule | Up to KRW 20 million | KRW 20 million |
| Failing to train and check the agent | Up to KRW 20 million | KRW 20 million |
| Leaving the agent out of the privacy policy | Up to KRW 10 million | KRW 3 / 6 / 10 million (first / second / third and later) |
What is changing?
- Amendments taking effect in 2027 do not change the agent provisions.
Korea’s PIPA Article 31-2 in English
Official English translation (Korea Legislation Research Institute), updated by KoreaAgent to match the current Korean text. The Korean text on law.go.kr is the binding version.
Article 31-2 (Designation of Domestic Agents)
(1) A personal information controller with no address or place of business in the Republic of Korea who is prescribed by Presidential Decree in consideration of the sales, the scale of personal information retained, and other factors shall designate a person who acts as an agent for the following (hereinafter referred to as "domestic agent"). In such cases, the domestic agent shall be designated in writing: 1. Handling grievances and remedial compensation in relation to personal information processing under Article 31(4)5; 2. Notification under Article 34(1) and (2) and reporting of divulgence, etc. under paragraph (4) of that Article; 3. Submission of materials such as articles and documents under Article 63(1).
(2) A domestic agent shall have an address or place of business in the Republic of Korea. In such cases, a personal information controller who has any of the following corporations shall designate a domestic agent from among such corporations: 1. A domestic corporation established by the personal information controller; 2. A domestic corporation, prescribed by Presidential Decree, over which the personal information controller exercises dominant influence in terms of the composition of executives, business operations, etc.
(3) A personal information controller who designates a domestic agent pursuant to paragraph (1) shall manage and supervise the domestic agent by training and inspecting the work status as prescribed by Presidential Decree to ensure that the domestic agent faithfully performs its duties.
(4) The personal information controller shall include the following in the Privacy Policy if he or she designates a domestic agent pursuant to paragraph (1): 1. Name of the domestic agent (in cases of a corporation, referring to its name and the name of its representative); 2. Address (in cases of a corporation, referring to the location of a business office), telephone number, and e-mail address of the domestic agent.
(5) If a domestic agent violates this Act in relation to the subparagraphs of paragraph (1), the personal information controller shall be deemed to have committed such a violation.
Enforcement Decree, Article 32-3: the thresholds
(1) "Who is prescribed by Presidential Decree" in the former part, with the exception of the subparagraphs, of Article 31-2(1) of the Act means any of the following persons: 1. A person whose total sales for the previous year (referring to the previous business year in the case of a corporation) is at least one trillion won; 2. A person who has, as of the end of the previous year, a daily average of at least one million domestic data subjects whose personal information is stored and managed, calculated over the immediately preceding three months; 3. A person who is requested to submit relevant materials, such as articles and documents, pursuant to Article 63(1) of the Act and for whom the Protection Commission deliberates and resolves on the need to designate a domestic agent.
(2) The total sales under paragraph (1)1 shall be based on the amount converted into Korean won by applying the average exchange rate for the previous year.
(3) "A corporation prescribed by Presidential Decree" in Article 31-2 (2) 2 of the Act means any of the following corporations: 1. A corporation whose representative director the personal information controller appoints or dismisses, or for which it appoints or is able to appoint at least 50 percent of the executives; 2. A corporation in which the relevant personal information controller has invested at least 30/100 of the total number of issued stocks or the total amount of investment.
(4) A personal information controller who designates a domestic agent pursuant to Article 31-2 (1) of the Act shall manage and supervise the domestic agent to faithfully perform their duties in accordance with the following subparagraphs pursuant to Article 31-2 (3) of that Act. 1. Education on the duties of the domestic agent shall be conducted at least once a year for the domestic agent; 2. Inspection of the matters in each of the following items: a. Whether the domestic agent has formulated a plan for performing duties; b. Whether the domestic agent has performed a plan for performing duties; c. Whether the matters requiring improvement identified in the results of the inspection of plan implementation under item b have been improved.
How KoreaAgent runs it
- Our Korean phone line and inbox are the contact details in your privacy policy, answered by people on Korean business days
- Privacy complaints are logged, answered in wording you have agreed in advance, and anything else goes to your team with an English or Chinese summary
- If a breach happens, we file the notice and the report on your instructions and keep the 72-hour clock in view
- Every year we give you the training and review records you need to show you supervised your agent
Questions about the PIPA agent rule
What is the PIPA agent’s core role?
Handling privacy complaints and remedies from people in Korea, delivering breach notices to users and breach reports to the regulator, and submitting documents the PIPC requests. Breach notices and reports are generally due within 72 hours.
What happens if we do not appoint a PIPA agent?
A fine of up to KRW 20 million. The same cap applies if the agent breaks the Korean-entity rule or you fail to supervise it, and leaving the agent out of your privacy policy can add a fine of up to KRW 10 million. The PIPC may reduce or waive fines.
Does the PIPA domestic agent have to be registered with the PIPC?
The statute does not require filing the appointment. What it requires is that the agent’s details appear in your privacy policy.
We have a Korean subsidiary. Can an outside firm still be our PIPA agent?
Where you set up or control a Korean entity, the agent must come from among those entities. An outside firm can still run the work behind that entity under contract — that is what our Core plan for your Korean entity does.
Who supervises the agent?
You do. The company that appoints the agent must train it at least once a year and check that it plans, carries out and improves its work.
Can KoreaAgent be our PIPA agent?
Yes, if you have no Korean entity you set up or control: the agent needs an address or office in Korea, and ours is in Seoul. If you do have such an entity, it must be the agent, and we can run the work behind it.
Related questions
Sources
- PIPA Art. 31-2 (designation, duties, disclosure) (Korean, official text)
- PIPA Art. 34 (breach notification) (Korean, official text)
- PIPA Art. 75 (fines) (Korean, official text)
- Enforcement Decree Art. 32-3 (thresholds, control, supervision) (Korean, official text)
- Personal Information Protection Act, English translation (for reference)
Korean title: 개인정보 보호법. Summarized by Youngho Kim (KoreaAgent) from the official Korean text on law.go.kr, which is the authoritative version. This is general information, not legal advice, and it does not say whether the law applies to your company. Last reviewed: .