| National Assembly Passes Amendment to Personal Information Protection Act Changing Local Agent Rules |
| |
| In our previous newsletter, we informed you that a proposed amendment to the Personal Information Protection Act (PIPA), aimed at strengthening the obligation for foreign businesses to designate a domestic agent, was approved by the National Policy Committee of the National Assembly (Link). We would like to provide an update that a revised version of the amendment was passed by the National Assembly’s plenary session on March 13, 2025. |
| |
| The amendment passed by the plenary session retains the key provisions introduced at the National Policy Committee stage, particularly those that explicitly outline the obligations for data controllers to supervise and manage their designated domestic agents, as well as the imposition of administrative penalties for non-compliance with such obligations. |
| |
| However, as shown in the table below, the revised amendment differs in that it delegates certain matters to a Presidential Decree. |
| |
A data controller* having any of the following entities must designate its domestic agent among them:
| (i) |
A Korean company established by the data controller; or: |
| |
| (ii) |
A Korean company in which the data controller exerts significant influence over executive composition, business operations, and related matters. |
| |
|
A data controller* having any of the following entities must designate its domestic agent among them:
| (i) |
A Korean company established by the data controller; or |
| |
| (ii) |
A Korean company in which the data controller exerts significant influence over executive composition, business operations, and related matters, as specified by Presidential Decree [emphasis added]. |
| |
|
| Data controllers must effectively manage and supervise the domestic agent to ensure the faithful performance of their duties by providing appropriate training and monitoring their work, etc. |
Data controllers must effectively manage and supervise the domestic agent to ensure the faithful performance of their duties by providing appropriate training and monitoring their work, etc. in accordance with the provisions set by Presidential Decree [emphasis added]. |
| The amended provisions will come into effect six months following their promulgation, which is expected to occur by the end of this month or early April. |
| |
| The amendment requires that data controllers who have previously designated a third-party domestic agent under the previous provisions must ensure that, if they have a Korean entity that falls under either category (i) or (ii), they redesignate that entity as their domestic agent. |
| |
| Given these change, foreign businesses should review the forthcoming amendment to the Presidential Decree to assess the eligibility of their existing or prospective domestic agents and explore strategies for managing their compliance obligations moving forward. |
| |
| * Please note that these provisions only apply to data controllers who are subject to the obligation to appoint a domestic agent under the PIPA. |
|
| |
|
|
This legal update is provided for general informational purposes only and should not be considered a legal opinion of KIM & CHANG nor relied upon in lieu of specific advice. Recipients of this publication, whether clients or otherwise, should not act or refrain from acting on the basis of any information included in this publication without seeking appropriate legal or other professional advice.
If you wish to change an address, add a subscriber, or comment on this legal update, please e-mail lawkim@kimchang.com. For more newsletters and legal updates of KIM & CHANG, please visit our website - www.kimchang.com
[UNSUBSCRIBE] If you do not wish to receive our e-mail service, please click here. |
| |
| |
| © 2025 Kim & Chang |
| |
|
