Domestic Representative Requirements for Foreign Apps and Platforms in Korea

A foreign app, game, or online platform can serve Korean users without any office in Korea. Korean regulators, however, increasingly require large overseas services to appoint a domestic representative: a person or company in Korea that answers to regulators and users on the service’s behalf. Several statutes now impose this requirement, each with its own thresholds, duties, and deadlines. Recent amendments have also tightened who may serve as the representative. This article explains which rules apply, who must comply, and how to set up a compliant arrangement.

1. Why Korea Requires a Domestic Representative

Korean regulators have found it difficult to investigate overseas services, serve documents on them, and enforce corrective orders against them. Korean users have had similar difficulties with complaints and refunds. The domestic representative system addresses this by requiring large overseas operators without a Korean address or office to designate someone in Korea who:

• receives regulatory requests
• submits documents
• handles certain user matters

The overseas company remains responsible. If the representative violates the law in performing its duties, the overseas company is generally treated as having committed the violation.

2. Personal Information Protection Act

Who must designate. An overseas personal information controller with no address or office in Korea must designate a domestic representative if it meets any one of these criteria:

• Revenue. Total worldwide revenue of KRW 1 trillion or more in the previous year, converted at the previous year’s average exchange rate.
• Korean users. An average of 1 million or more Korean data subjects per day whose personal information it stored or managed, over the three months before the end of the previous year.
• Regulator request. The Personal Information Protection Commission has requested materials from it and found designation necessary, for example after a data breach.

Who must serve: the October 2025 amendment. Since October 2, 2025, an overseas company that has a qualifying Korean company must designate the representative from among those companies. A Korean company qualifies if the overseas company:

• established it
• appoints or dismisses its CEO
• can appoint at least half of its officers
• holds at least 30% of its shares or capital

The grace period for existing designations has ended. A group that previously used an outside agency while also having a Korean subsidiary may need to change its designation.

Duties. The representative handles:

• the duties of the chief privacy officer, including complaints and remedies
• notification and reporting of data breaches
• submission of materials requested by the Commission

Disclosure. The representative’s name, address, telephone number, and email address must be included in the privacy policy.

Headquarters supervision. The overseas company must supervise the representative. This includes training it at least once a year and checking its work plan and how that plan is carried out.

Penalties. Administrative fines of up to KRW 20 million apply for:

• failing to designate
• failing to designate a qualifying Korean company
• failing to supervise the representative

Omitting the representative’s details from the privacy policy carries separate fines that increase with repeated violations.

3. E-Commerce Act (Effective January 2027)

Amendments to the Act on Consumer Protection in Electronic Commerce introduce a domestic representative requirement for overseas online sellers and marketplaces. These rules respond to the growth of cross-border platforms selling directly to Korean consumers. The detailed rules in the Enforcement Decree were approved in July 2026, and the representative provisions take effect on January 21, 2027.

Who must designate. An overseas business without an address or office in Korea must designate a representative if it meets any one of these criteria:

• Revenue. Previous-year sales of KRW 1 trillion or more.
• Visitors. An average of 1 million or more Korean consumers per month accessing its online store, over the three months before the end of the previous year.
• Regulator request. The Korea Fair Trade Commission has requested reports, materials, or goods from it.

Disclosure. After designation, the business must promptly notify the Fair Trade Commission in writing of the representative’s name, address, telephone number, and email address. It must also display this information on the first screen of its online store.

Why it matters. Consumer complaints, refund disputes, and Fair Trade Commission investigations will be directed to the representative. Repeated violations of the E-Commerce Act are also subject to higher surcharges under the amended rules.

4. Game Industry Promotion Act

Overseas game companies distributing games in Korea are subject to their own domestic representative requirement, which took effect in October 2025.

Who must designate. Overseas game businesses without an address or office in Korea that meet the criteria in the Enforcement Decree must designate a representative. According to the Ministry of Culture, Sports and Tourism’s revised proposal, the criteria are:

• Revenue. Previous-year total revenue of KRW 1 trillion or more.
• Downloads. An average of 1,000 or more new installations per day on Korean users’ mobile devices in the previous year. This replaced an earlier proposal of 100,000 monthly users.
• Ministry designation. The Ministry has found that user harm has occurred or is likely.

Duties. The representative carries out the company’s obligations under the Act. These include obligations on game distribution and on preventing speculative play, such as the rules requiring disclosure of the probability of obtaining randomized in-game items.

Penalties. Failure to designate a representative can result in an administrative fine of up to KRW 20 million.

5. Information and Communications Network Act

The Information and Communications Network Act also requires certain overseas information and communications service providers without a Korean address or office to designate a domestic representative. The thresholds are set by Enforcement Decree based on user numbers and revenue.

Since the 2020 reform that moved most privacy obligations into the Personal Information Protection Act, the representative’s role under this Act is narrower. It covers the submission of documents and materials requested by the Ministry of Science and ICT. The representative’s details must still be disclosed on the service’s website or app.

6. Comparison of the Regimes

	Personal Information Protection Act	E-Commerce Act	Game Industry Promotion Act	Information and Communications Network Act
Effective	In force (Korean affiliate rule since Oct. 2, 2025)	January 21, 2027	October 2025	In force
Revenue threshold	KRW 1 trillion (worldwide)	KRW 1 trillion	KRW 1 trillion	Set by decree
User threshold	1 million Korean data subjects per day	1 million Korean visitors per month	1,000 new installations per day	Set by decree
Designation by regulator	Yes	Yes	Yes	—
Main duties	Privacy complaints, breach notices, regulator requests	Consumer and Fair Trade Commission matters	Game law compliance	Document submission
Must use Korean affiliate	Yes, if one exists	Check final rules	Check final rules	No express rule
Penalty for non-designation	Up to KRW 20 million	Administrative fine	Up to KRW 20 million	Administrative fine

One company can be subject to several regimes at once. For example, a large overseas marketplace app may need representatives under the privacy, e-commerce, and network laws. The same Korean entity can usually serve in more than one capacity, if it is properly designated under each law.

7. Choosing and Managing the Representative

Korean affiliate or outside provider. Under the privacy rules, a group with a qualifying Korean company must use it. Groups without a Korean presence typically appoint:

• a specialized representative service provider
• a law firm
• a consultancy

Capability. The representative must be able to work in Korean, respond to regulators quickly, and escalate issues to headquarters. Breach notification under the privacy rules, for example, is generally required within 72 hours of becoming aware of the breach.

The representative agreement. It should cover:

• the scope of duties under each statute
• reporting lines and response times
• access to information
• confidentiality and data protection
• fees and indemnities

Because the overseas company bears liability for the representative’s violations, it should not treat the role as a formality.

Ongoing supervision. Provide annual training, require a work plan, and keep records of supervision. These are required under the privacy rules and useful evidence under the others.

8. Does a Representative Create a Taxable Presence?

Designating a domestic representative is a regulatory requirement and does not, in itself, mean that the overseas company has a permanent establishment (PE) in Korea for tax purposes. The analysis changes if the representative, or the Korean affiliate acting as representative, does more than administrative and regulatory work. Examples include habitually concluding contracts or negotiating with customers on the overseas company’s behalf. The representative’s role should be defined carefully and kept separate from sales activities.

9. Compliance Checklist

• Check the revenue and user thresholds under each regime every year, using each regime’s own counting method.
• Identify any Korean affiliate that must serve as the representative under the privacy rules.
• Designate the representative in writing and sign a representative agreement.
• Disclose the representative’s details in the privacy policy, on the service, and, under the e-commerce rules, to the Fair Trade Commission.
• Set up workflows for complaints, breach notifications, and regulator requests, with Korean-language capability.
• Train and supervise the representative, and keep records.
• Review whether the representative’s activities could create a PE.

10. Conclusion

Korea’s domestic representative rules are expanding:

• the privacy rules now require groups to use their own Korean affiliates
• overseas game companies have been covered since October 2025
• overseas online sellers and marketplaces will be covered from January 2027

For foreign apps and platforms with significant Korean revenue or user numbers, the question is no longer whether a representative is needed. It is which laws apply, who must serve, and how the arrangement is managed.

Key takeaway: Map your Korean thresholds under each law, designate the right entity, and supervise the representative as part of your compliance program. You remain liable for what it does.