Starting to serve Korean users?
Check these five duties first
Korean privacy and security rules reach companies abroad once they handle Korean users' data. These are the duties foreign companies ask us about most. Thresholds and details change, so confirm each one against the current law with your counsel.
| Duty | Who it applies to | What to prepare | Law |
|---|---|---|---|
| Domestic representative | Businesses with no address or office in Korea that meet size thresholds, such as large total revenue, large revenue from IT services, or data on a large number of Korean users | Appoint a representative in Korea, name them in your privacy policy, and give them authority to handle privacy requests and data leak reports. Who may serve as representative was tightened in 2025, so check the current rule. | Personal Information Protection Act (PIPA), Art. 31-2 |
| Cross-border transfer | Anyone sending Korean users' personal data abroad, including to a parent company or cloud region outside Korea | A lawful basis for each transfer: separate consent, a law or treaty, a contract with the user plus disclosure in the privacy policy, a certified recipient, or an adequate country. List recipients, countries, items, timing and retention in the privacy policy. | PIPA, Art. 28-8 |
| Breach notification | Any controller of Korean users' personal data | Notify affected users without delay and, where the law requires (for example 1,000 or more people, sensitive or unique identifiers, or leaks caused by hacking), report to the regulator within 72 hours of becoming aware. | PIPA, Art. 34 and Enforcement Decree |
| ISMS certification | Information and communications service providers above legal thresholds, such as IT service revenue or daily average users in Korea | An information security management system certified by KISA. Preparation usually takes six months to a year for a first certification. | Act on Promotion of Information and Communications Network Utilization and Information Protection, Art. 47 |
| CSAP | Cloud service providers selling to Korean public institutions | Cloud Security Assurance Program certification at the level the public buyer requires. | Cloud Computing Act and KISA rules |
As of 2026.11.07 This page is general information, not legal advice. Official English translations of Korean laws are on the Korea Legislation Research Institute site; the Korean text on law.go.kr is authoritative. The privacy regulator is the Personal Information Protection Commission.
Rules that apply by industry
Financial services
Network separation and alternative controls under the Electronic Financial Supervisory Regulation.
Public sector
How N2SF sorts information and systems, and what it means for security monitoring.
AI services
Duties under Korea's AI Basic Act, including high-impact AI and notices to users.
What Genox can take on
We are a security company, not a law firm.
We work alongside your counsel on the technical side.
- Map where Korean users' data flows and which transfers need a legal basis
- Gap assessment against ISMS-P and the personal information security standards
- Prepare the security controls and evidence an ISMS audit asks for
- Breach response readiness: who reports what, to whom, within 72 hours