Domestic Agent Requirements for Overseas Businesses under Korea’s PIPA
If your company is headquartered outside Korea and provides SaaS, platform, e-commerce, AI, or other online services to users in Korea, Korea’s Personal Information Protection Act (PIPA) may apply to your processing of personal information.
Certain overseas businesses are required to appoint a domestic agent in Korea.
Since October 2, 2025, the rules have become more stringent. If an overseas business has a qualifying Korean corporation that it established or over which it exercises dominant influence, it must appoint its domestic agent from among those Korean corporations. The overseas headquarters is also required to manage and supervise the domestic agent.
1. Can Korea’s PIPA Apply to an Overseas Business?
Yes. An overseas business may be subject to Korea’s PIPA when it provides goods or services to data subjects in Korea or when its processing of personal information affects data subjects in Korea.
The fact that a company does not have a Korean subsidiary, or that its servers and data-processing infrastructure are located outside Korea, does not by itself place the company outside the scope of Korean privacy regulation.
Overseas SaaS providers, online platforms, AI services, gaming companies, content providers, and e-commerce businesses that process account information, payment information, access data, or other personal information of users in Korea should assess whether PIPA applies to their operations.
The Personal Information Protection Commission (PIPC), Korea’s data protection authority, has also issued guidance specifically for foreign businesses on compliance with PIPA, including privacy policies, data breach notification, data subject rights, cross-border transfers, and the appointment of a domestic agent.
PIPC – Guidelines on Applying the Personal Information Protection Act to Foreign Business Operators
2. Which Overseas Businesses Must Appoint a Domestic Agent?
Not every overseas business is required to appoint a domestic agent.
Under Article 31-2 of the Personal Information Protection Act and Article 32-3 of the Enforcement Decree of the Personal Information Protection Act, a personal information controller without an address or place of business in Korea must appoint a domestic agent if it falls within any of the following categories.
🔹 When Is a Domestic Agent Required?
| Category | Threshold |
|---|---|
| Annual revenue | Total revenue for the previous year of KRW 1 trillion or more |
| Number of data subjects in Korea | Personal information of an average of at least 1 million data subjects in Korea per day was stored or managed during the three months immediately preceding the end of the previous year |
| PIPC determination | The business has received a request to submit materials and the PIPC determines, through deliberation and resolution, that appointment of a domestic agent is necessary |
The revenue threshold is based on the business’s total worldwide revenue for the previous year, not only revenue generated in Korea. Foreign-currency revenue is converted into Korean won using the average exchange rate for the previous year.
Accordingly, a global business should not assume that it is exempt simply because its Korean revenue is relatively small. Its worldwide revenue and the scale of personal information it processes in Korea should both be reviewed.
Article 31-2 of the Personal Information Protection Act – Appointment of Domestic Agent
Article 32-3 of the Enforcement Decree – Scope of Businesses Required to Appoint a Domestic Agent
3. If an Overseas Business Has a Korean Corporation, Must It Appoint That Corporation as Its Domestic Agent?
If the overseas business is required to appoint a domestic agent and has a Korean corporation that meets the statutory requirements, the domestic agent must be appointed from among those qualifying Korean corporations.
Since October 2, 2025, Article 31-2 of PIPA requires an overseas business to appoint its domestic agent from among Korean corporations that it has established or over which it exercises dominant influence.
The relevant Korean corporations include:
- a Korean corporation established by the overseas business;
- a Korean corporation whose representative director may be appointed or removed by the overseas business;
- a Korean corporation in which the overseas business appoints, or has the authority to appoint, at least 50% of the officers; or
- a Korean corporation in which the overseas business holds at least 30% of the total issued shares or total capital contributions.
The latter criteria are further defined in Article 32-3 of the Enforcement Decree.
Accordingly, where an overseas business subject to the domestic-agent requirement has one or more subsidiaries or affiliated companies in Korea, it should review its ownership structure, governance rights, and appointment authority before determining which entity should serve as the domestic agent.
A six-month transitional period was provided for businesses that had already appointed a domestic agent when the amended law took effect. That transitional period has now expired.
Article 31-2 of the Personal Information Protection Act – Appointment of Domestic Agent
Article 32-3 of the Enforcement Decree – Qualifying Korean Corporations and Supervision Requirements
Supplementary Provision, Article 2 – Transitional Measure for Appointment of Domestic Agents
4. What Does a Domestic Agent Do?
A domestic agent is not merely a local contact point. It must perform specific functions required under PIPA.
A domestic agent is responsible for handling matters including:
- complaints and remedies relating to the processing of personal information;
- notification and reporting of personal information breaches; and
- responding to requests from the PIPC for the submission of documents, records, and other materials.
The overseas business must also disclose specified information about its domestic agent in its privacy policy, including the agent’s name or corporate name, representative, address, telephone number, and email address.
If the domestic agent violates PIPA while performing these statutory functions, the violation is treated as an act of the overseas personal information controller itself.
For this reason, businesses should not treat the appointment as a documentation exercise. The domestic agent should be capable of responding in practice to requests from users in Korea, data breach incidents, and regulatory inquiries from the PIPC.
Article 31-2 of the Personal Information Protection Act – Appointment and Duties of Domestic Agent
5. Must the Overseas Headquarters Manage and Supervise the Domestic Agent?
Yes. An overseas business that appoints a domestic agent is also required to manage and supervise the agent’s performance of its duties.
The Enforcement Decree requires the overseas personal information controller to take measures including:
- providing relevant training to the domestic agent at least once a year;
- checking whether the domestic agent has established a work plan;
- reviewing whether that work plan has been properly implemented; and
- confirming that any issues identified during the review have been corrected.
This means that the compliance obligation does not end once a domestic agent has been formally appointed.
The overseas headquarters should establish practical procedures for handling privacy-related inquiries, responding to personal information breaches, communicating with the PIPC, and obtaining the documents and information needed for regulatory responses in Korea.
Article 32-3 of the Enforcement Decree – Management and Supervision of Domestic Agents
6. What Are the Consequences of Failing to Comply with the Domestic Agent Requirements?
Administrative fines may be imposed if an overseas business fails to appoint a domestic agent or fails to comply with the statutory appointment, disclosure, or supervision requirements.
The current administrative fine schedule includes the following.
🔹 Key Administrative Fines
| Violation | Administrative Fine |
|---|---|
| Failure to appoint a required domestic agent | KRW 20 million |
| Failure to appoint a domestic agent from among the qualifying Korean corporations | KRW 20 million |
| Failure to properly manage and supervise the domestic agent | KRW 20 million |
| Failure to disclose required domestic-agent information in the privacy policy | Amount varies depending on the number of violations |
For failure to disclose the required domestic-agent information in the privacy policy, the current Enforcement Decree provides for fines of KRW 2 million for a first violation, KRW 4 million for a second violation, and KRW 8 million for a third or subsequent violation.
In addition, appointing a Korean corporation or an external service provider as a domestic agent does not transfer the overseas headquarters’ liability under PIPA to that agent.
Article 75 of the Personal Information Protection Act – Administrative Fines
Enforcement Decree, Appendix 2 – Standards for Administrative Fines
7. What Should an Overseas Business Review Before Appointing a Domestic Agent?
The first step is not simply choosing a domestic agent. The business should determine whether the appointment requirement applies to its operations and corporate structure in Korea.
Key points to review include:
- whether the business processes personal information of data subjects in Korea;
- whether the overseas headquarters can be regarded as having an address or place of business in Korea;
- whether its total worldwide revenue meets the statutory threshold;
- the scale of personal information relating to data subjects in Korea that it stores or manages;
- whether it has established, or exercises dominant influence over, a Korean corporation;
- whether its current domestic agent can actually perform the duties required under PIPA;
- whether the required domestic-agent information is accurately reflected in the privacy policy; and
- whether appropriate training, monitoring, and reporting procedures are in place between the overseas headquarters and the domestic agent.
For global groups with multiple Korean affiliates, the analysis should go beyond shareholding percentages. Rights relating to the appointment of the representative director and other officers may also affect which Korean corporation must be appointed.
8. Frequently Asked Questions (FAQ)
Q1. If our revenue in Korea is below KRW 1 trillion, are we exempt from appointing a domestic agent?
Not necessarily.
The KRW 1 trillion threshold refers to total revenue, not only Korean revenue. In addition, a business may still be required to appoint a domestic agent if it stores or manages personal information of an average of at least 1 million data subjects in Korea per day during the relevant three-month period, or if the PIPC determines that a domestic agent is necessary after requesting the submission of materials.
Q2. If we have a subsidiary in Korea, do we automatically have to appoint a domestic agent?
No.
The business must first determine whether it falls within the scope of businesses required to appoint a domestic agent under PIPA. If the requirement applies and the business has a Korean corporation that falls within the statutory categories, the domestic agent must then be appointed from among those qualifying Korean corporations.
Q3. Can we appoint an external professional service provider as our domestic agent?
Potentially, if the business does not have a Korean corporation that is required by law to serve as its domestic agent.
If the overseas business has established a qualifying Korean corporation or exercises the level of dominant influence specified under PIPA and its Enforcement Decree, however, the agent must be selected from among those Korean corporations.
Q4. Do we need to file a separate government registration after appointing a domestic agent?
PIPA requires the domestic agent to be appointed in writing and requires specified information about the agent to be included in the business’s privacy policy.
Accordingly, businesses should focus not only on preparing the appointment document but also on updating the privacy policy and establishing an operational framework that allows the domestic agent to perform its statutory duties.
9. Key Considerations for Overseas Businesses Appointing a Domestic Agent in Korea
Appointing a domestic agent should not be treated as simply designating a local contact person in Korea.
An overseas business should first determine whether it is subject to the domestic-agent requirement. If it has Korean subsidiaries or affiliated companies, it should also assess which entity must be appointed based on the statutory requirements.
Once appointed, the domestic agent must be able to respond effectively to privacy complaints, personal information breaches, PIPC investigations, and requests for documents. The overseas headquarters must also maintain an appropriate management and supervision framework.
Since the strengthened rules on appointing qualifying Korean corporations and supervising domestic agents took effect on October 2, 2025, businesses that appointed a domestic agent under the previous regime should also review whether their current appointment and operating structure remains compliant with the amended PIPA.
