In our last newsletter (Link), we shared that the amendment to the Personal Information Protection Act (the “Amended PIPA”) will go into effect on October 2, 2025, mandating foreign data controllers,[1] who have a subsidiary or affiliate in Korea, to designate such subsidiary or affiliate as the domestic agent in Korea and to supervise such agent’s performance of duties.
Following this legislative change, the Personal Information Protection Commission (“PIPC”) announced the draft amendment to the Enforcement Decree of the PIPA (the “Proposed Amendment”) on May 30, 2025, which received approval from the Cabinet on September 16, 2025. The Proposed Amendment will take effect concurrently with the Amended PIPA on October 2, 2025.
|
1. |
Entities Eligible for Designation as Domestic Agents |
|
2. |
Duties of Foreign Data Controllers in Supervising Domestic Agents |
-
Provide training to domestic agents on their duties and responsibilities at least once annually, and
-
Conduct inspections to confirm: (i) whether the domestic agent has formulated a plan for the performance of its duties; (ii) whether the domestic agent has implemented such plan, and (iii) whether the domestic agent has remedied any deficiencies identified in the course of inspecting the implementation of the plan referred in (ii).
With the imminent implementation of the Proposed Amendment, foreign data controllers are advised to closely evaluate whether their current or potential domestic agents satisfy the newly clarified eligibility criteria and to establish oversight measures to ensure compliance.
[1] These provisions only apply to data controllers who are subject to the obligation to appoint a domestic agent under the PIPA.
