REP27 · EU representative · South Korea
Article 27 GDPR · South Korea
If your company is established in South Korea and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
PIPA and the Korean adequacy decision concern transfers and domestic processing. Neither removes the duty under Article 27 for a Korean company reaching people in the EU.
Visible from outsideThis is the only GDPR duty a regulator can check without an investigation: the absence is written in your own privacy notice, on a page you publish yourself.
Consumer electronics, beauty and K-commerce brands, gaming studios with EU players, and enterprise software with European customers.
Regulators read the site the way a customer would. Prices in euro, a shipping option to Ireland, a checkout in French: each one is evidence you envisaged the Union.
Store listings available in EU countries, telemetry from European devices and accounts held by people in the Union all bring you inside Article 3(2).
As a processor you are caught in your own right. Your client's designation covers your client, never you.
PIPA is one of the strictest regimes in Asia and the PIPC enforces it, including against foreign companies. Korea also holds an adequacy decision with the Union — again about transfers, not about representation.
the Personal Information Protection Commission. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Korean companies reach the Union through K-beauty and fashion sold D2C, gaming studios with European players, consumer electronics, and enterprise software with European offices.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
Your electronic signature and ours. Article 27(1) wants it in writing; a one-sided declaration is weaker than most companies assume.
One line of HTML that reads the register in real time: green while the designation is active, red the moment it lapses. Nobody can display a status they no longer hold.
A Greek or Polish data subject writes in their own language. The desk reads it, logs it and forwards it with the deadline already counted.
Only if that distributor is established in the Union and has signed a written designation accepting the role of representative. A distribution agreement, however detailed, is not a designation under Article 27(1).
Structurally similar, legally separate. The PIPA representative sits in Korea for foreign companies handling Korean data. Article 27 wants one in the Union for you.
The representative's identity and contact details, under Articles 13(1)(a) and 14(1)(a). We generate the exact sentence in French, German and every other language your store uses.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Korean D2C brands usually find out through a payment provider or a logistics partner, not through a regulator — which is the good way to find out.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check