South Korean companies reach European consumers directly through e-commerce for beauty, fashion, food and entertainment merchandise, through games and apps, and through SaaS and hardware with EU customers. Germany is one of the largest markets for Korean consumer brands in Europe. Where a Korean company has no establishment in the EU and targets people there, Art. 27 GDPR requires an EU representative. Kanzlei Matutis, a German data protection law firm in Potsdam, acts as EU representative for Korean companies for 350 EUR per year. We correspond in English and German.
Does a company from South Korea need an EU representative?
Yes, if it has no establishment in the EU and its processing of personal data relates to offering goods or services to people in the EU or to monitoring their behaviour there (Art. 3(2) in conjunction with Art. 27(1) GDPR). Examples: a Seoul K-beauty brand with an EU web shop in German and EUR pricing; a game publisher whose titles are distributed in EU app stores and analyse player behaviour; a Korean SaaS company with customers in Germany. Korean groups with a subsidiary in Germany or the Netherlands do not need a representative; the EU entity is the contact point. A Korean company that already has a subsidiary, branch or office in an EU Member State does not need a representative; that EU entity is the point of contact. The exceptions of Art. 27(2) GDPR (occasional, low-risk processing without large-scale sensitive data; public authorities) are narrow and rarely apply to a business that actively markets to the EU. The full criteria are explained on the page What is the legal situation?.
Korean PIPA, the EU adequacy decision and Art. 27 GDPR
South Korea’s Personal Information Protection Act (PIPA) is enforced by the Personal Information Protection Commission (PIPC). The European Commission adopted an adequacy decision for the Republic of Korea in December 2021 under Art. 45 GDPR, allowing personal data to flow from the EU to Korean companies subject to PIPA without additional safeguards. As with all adequacy decisions, this concerns transfers out of the EU. It does not limit the territorial scope of the GDPR under Art. 3(2) GDPR and does not exempt a Korean company that targets people in the EU from appointing an EU representative under Art. 27 GDPR. Korean companies therefore need PIPA compliance at home and GDPR compliance, including the representative, for their EU-facing business.
What we do as EU representative for Korean companies
Rechtsanwaltskanzlei Matutis is a German law firm in Potsdam, near Berlin, specialised in data protection law. Under a written mandate pursuant to Art. 27(1) GDPR we act as your point of contact in the EU for all supervisory authorities of the Member States and for data subjects. Letters and emails addressed to us are checked, scanned and forwarded to your contact person without undue delay; we point out deadlines, such as the one-month period for data subject requests under Art. 12(3) GDPR. With a time difference of seven to eight hours, forwarded mail is in your inbox the next morning; urgent deadlines are flagged in the subject line. We communicate in English and German. We do not replace your Data Protection Officer and do not take over your compliance decisions; the difference is explained on the page EU representative vs. Data Protection Officer.
Cost for companies from South Korea
The annual flat fee is 350 EUR. Because the service is provided by a German law firm to a business customer outside Germany, German VAT is not charged (reverse charge), so net equals gross. We invoice in EUR; payment by international transfer or by credit card or PayPal is possible. Please instruct your bank so that the full EUR amount is credited. Forwarding of scanned mail by email is included; postal forwarding of originals is charged at 2 EUR per item plus postage. Full details: What does it cost and what is included?
Next step
Send us your company name, website and a short description of your activities in the EU via the inquiry form. We confirm whether a representative is required in your case and send you the contract and written mandate. The complete process is described on the page How to appoint an EU GDPR representative. Other countries: EU representative by country.