- Foreign suppliers of electronic services to Korean consumers must register under the simplified procedure of Article 53-2 of the VAT Act, charge 10% and file quarterly returns — online, in English, without a Korean entity.
- Sales to Korean businesses with a business registration number are outside the simplified regime; licence fees they pay can bear Korean withholding at 22% or the treaty rate.
- App stores and other intermediaries that sell your service to Korean consumers are treated as the supplier for VAT.
- The Personal Information Protection Act applies to foreign businesses serving Korean users; larger ones must appoint a Korean domestic agent, and fines can reach 3% of revenue.
- Games need a Korean rating and must disclose loot-box probabilities; large foreign game companies must appoint a domestic agent.
For years foreign digital businesses served Korean users with no Korean footprint at all. That ended in stages. Korea began taxing foreign electronic services to consumers in 2015 and widened the scope in 2019 to cloud computing, online advertising and intermediary platforms. The Personal Information Protection Act was overhauled in 2023, with fines calculated on total revenue and new rules on data leaving Korea. Game, telecoms and e-commerce rules increasingly require foreign operators to have someone in Korea who answers for them.
This guide covers each layer for a foreign company that serves Korean users from abroad: VAT, income tax and withholding, data protection, domestic agents, sector rules for games and platforms, and the point at which a Korean subsidiary becomes the simpler option.
VAT: the simplified registration
Under Article 53-2 of the VAT Act, a foreign business without a Korean place of business that supplies electronic services (전자적 용역, jeonjajeok yongyeok) to Korean consumers must register for Korean VAT through the simplified business registration (간편사업자등록, ganpyeon saeopja deungnok). Electronic services include games, audio and video content, e-books, software and apps and their updates, cloud computing, online advertising, and intermediary services that connect Korean consumers with suppliers — app markets, accommodation, transport and other platforms.
Registration is online, in English, through the National Tax Service’s portal for foreign suppliers, within 20 days of starting to supply Korean consumers. The registered supplier charges 10% VAT on its Korean consumer sales, files quarterly returns by the 25th of the month after each quarter, and pays in won or in a major foreign currency. It cannot issue Korean tax invoices and generally cannot deduct Korean input VAT, which it rarely has. Records of Korean sales must be kept for five years.
Who counts as a Korean consumer
The simplified regime covers supplies to customers who are not registered Korean businesses. Since 2019, supplies to Korean businesses that hold a business registration number are excluded: the supplier does not charge Korean VAT on them, and the business customer, if it is VAT-exempt, accounts for VAT itself under the proxy payment (대리납부, daeri nappu) rule of Article 52. The supplier should collect and keep its business customers’ registration numbers to justify not charging VAT. Location of the customer is determined from evidence such as billing address, payment card and IP address.
App stores and other intermediaries
Where an app market or other platform sells a foreign developer’s app or in-app content to Korean consumers, the intermediary is treated as the supplier for Korean VAT and accounts for it. A developer selling only through such stores usually has no Korean VAT registration of its own; one that also sells subscriptions directly on its website does, for those direct sales.
No company, no office, no staff — and still a Korean VAT number. That is the deal for selling digital services to Korean consumers.
Voixa Korea
Income tax and withholding
A foreign digital business without a Korean permanent establishment (국내사업장, gungnae saeopjang) does not pay Korean corporate tax on sales to Korean consumers. Servers, data centres and local partners can raise PE questions in specific cases; a Korean subsidiary that markets the service and concludes contracts for the parent can create one under Article 94 of the Corporate Tax Act.
Sales to Korean businesses are different. Payments by Korean companies for software licences, content rights and similar are royalties (사용료, sayongnyo) under Article 93 of the Corporate Tax Act and bear Korean withholding at 22% including local income tax, reduced to 5–15% by most treaties if the foreign supplier gives the Korean customer a limited tax rate application and residence certificate before payment. Whether a SaaS subscription is a royalty or a business profit depends on whether the customer acquires a right to use software or simply receives a service; Korean practice has treated many software payments as royalties. Our guide to withholding by country lists the treaty rates.
Large multinational groups are also within Korea’s global minimum tax rules, in force from 2024, which implement the OECD Pillar Two income inclusion rule; they do not affect smaller businesses.
Data protection: PIPA
The Personal Information Protection Act applies to any business that processes the personal information of people in Korea, wherever it is based. Its requirements are familiar from the GDPR but stricter in places:
- Legal basis and consent: processing needs a legal basis; consent, where relied on, must be specific, with separate consents for distinct purposes such as marketing.
- Privacy policy in Korean, published and detailed, under Article 30.
- Transfers abroad: personal information may be transferred outside Korea only on a basis listed in Article 28-8 — consent, a treaty, certification, a recognised destination, or disclosure of outsourcing and storage abroad in the privacy policy for contract performance.
- Breach notification: affected individuals and, above thresholds, the regulator must be notified within 72 hours under Article 34.
- Penalties: administrative fines of up to 3% of total revenue, excluding revenue unrelated to the violation, under Article 64-2, plus corrective orders and publication.
The Personal Information Protection Commission (개인정보보호위원회, gaein jeongbo boho wiwonhoe) (PIPC) has enforced the law against foreign platforms, imposing large fines on global social media and search companies and, more recently, on foreign e-commerce platforms over transfers of Korean customers’ data abroad. Foreign services are not too far away to reach.
The domestic agent
A foreign business with no address or place of business in Korea that meets thresholds set by decree — based on worldwide revenue, Korean-related revenue or the number of Korean users whose data it processes, or that has caused a breach — must appoint a domestic agent (국내대리인, gungnae daeriin) in Korea under Article 31-2 of the PIPA. The agent acts as the privacy contact for Korean users, handles breach notifications and submits documents to the regulator; the agent’s details appear in the privacy policy. The foreign business remains liable for the agent’s acts. Since recent amendments, the agent must be a Korean entity with a real address and, where the foreign business has a Korean subsidiary, generally the subsidiary.
Domestic-agent obligations also arise under other laws: the Telecommunications Business Act for large online service providers, the Game Industry Promotion Act for large foreign game companies, and proposals for e-commerce platforms. A single Korean entity can often serve several of these roles.
Games
Games distributed in Korea need a rating from the Game Rating and Administration Committee or a self-rating operator under the Game Industry Promotion Act; open app markets operate self-rating systems for mobile games. Since March 2024 games with probability-based items must disclose the type and probability of each item, and misleading disclosure is treated as a consumer-protection breach with damages claims. From October 2025, foreign game companies above thresholds set by decree must appoint a domestic agent responsible for compliance with these rules. Gambling-like mechanics and cash-out of in-game currency remain prohibited.
Platforms, payments and consumer law
Foreign platforms that intermediate sales to Korean consumers are mail-order intermediaries (통신판매중개자, tongsin panmae junggaeja) under the Act on Consumer Protection in Electronic Commerce, with obligations to identify sellers, handle complaints and, in some cases, share liability. Subscription services must make cancellation easy and refund unused periods under consumer rules; automatic renewals and price increases need advance notice. Korean consumers expect local payment methods — domestic cards, easy-pay wallets — which a foreign business reaches through global payment providers or, more fully, through a Korean subsidiary contracting with a Korean payment gateway. See e-commerce in Korea.
Korean entities providing online services file a value-added telecommunications business report under the Telecommunications Business Act; foreign providers serving Korea from abroad generally do not, but large ones face specific obligations, including service-stability and user-protection duties.
Other sector rules that catch foreign services
- Location-based services: services that collect users’ location data, or provide services based on it, must register or report under the Act on the Protection, Use, etc. of Location Information and obtain specific consents. Delivery, mobility, dating and fitness apps are typical cases.
- Cloud for the public sector: cloud services sold to Korean government bodies and many public institutions need the Cloud Security Assurance Program (CSAP) certification, which has historically required Korean data centres and separation from other customers. Private-sector cloud sales do not.
- Online content: illegal and harmful content is overseen by the Korea Communications Standards Commission, which can order access blocked; services popular with minors face youth-protection rules on age verification and content.
- Online advertising: endorsements and influencer posts must disclose sponsorship under Fair Trade Commission guidelines; health, finance and cosmetics claims are further restricted by sector law.
- Payments and wallets: stored-value and payment services offered to Korean users can require registration under the Electronic Financial Transactions Act; crypto-asset services are subject to the virtual asset user protection regime and are effectively closed to unregistered foreign operators.
Getting the registration right
A few practical points from the simplified VAT procedure. Register before the first Korean consumer sale, or within 20 days of it; late registration brings penalties and back-tax with interest. Decide the currency for returns and payments and keep it consistent. Determine customer location with at least two non-contradictory pieces of evidence — billing address and card country, for instance — and keep them. Show Korean prices including VAT on the Korean storefront. Reconcile Korean sales in the payment provider’s reports with the quarterly return; the National Tax Service receives data from card companies and payment providers. Keep records for five years. And note that registration does not make the foreign company a Korean taxpayer for other purposes: it remains outside Korean corporate tax unless it has a permanent establishment.
When a Korean subsidiary makes sense
Serving Korea from abroad works well until the business needs people in Korea — sales to enterprises, partnerships, customer support, local marketing — or wants Korean payment methods, Korean contracts and a Korean entity that regulators and customers can deal with. At that point a Jusik Hoesa (주식회사, jusik hoesa) usually takes over Korean sales or provides marketing and support services to the parent, paid on a cost-plus basis or by a commission. It then charges Korean VAT through its own ordinary registration, issues Korean tax invoices to business customers, pays Korean corporate tax on its margin, and can act as domestic agent. Licence fees it pays the parent bear Korean withholding at the treaty rate.
| Serve from abroad | Korean subsidiary | |
|---|---|---|
| VAT on consumer sales | Simplified registration, quarterly returns | Ordinary registration through the subsidiary |
| B2B sales | No Korean VAT; customer may withhold on royalties | Korean contracts and tax invoices |
| Corporate tax | None without a PE | On the subsidiary’s margin |
| Data protection | PIPA applies; domestic agent if above thresholds | PIPA applies; subsidiary can be the agent |
| Local payments and partners | Limited | Full access |
| Cost | Low | Company running costs |
Serving Korea from abroad compared with a Korean subsidiary.
A worked example
A Lisbon-based language-learning app has 200,000 Korean users. Most subscribe through the app stores, which account for Korean VAT. A growing share subscribe on the company’s website, so it registers under Article 53-2, adds 10% VAT to Korean web prices and files quarterly returns in euros. It revises its privacy policy in Korean to disclose that data is stored in the EU and processed by named providers, satisfying Article 28-8. As its Korean user base passes the decree threshold, it appoints a Korean domestic agent. Two years later, with Korean universities asking for site licences, it forms a Seoul Jusik Hoesa that sells to institutions with Korean tax invoices and pays the parent a licence fee, withheld at the Portugal–Korea treaty rate.
A second example: a mobile game
A Polish studio publishes a free-to-play mobile game with in-app purchases. Korean players buy through the two main app stores, which account for Korean VAT as suppliers, so the studio has no simplified VAT registration of its own. It obtains a rating through the stores’ self-rating systems, publishes Korean probability tables for every randomised item in the game and on its website, and adjusts its refund handling to Korean consumer rules. When it launches a web shop selling bundles directly to Korean players, it registers under Article 53-2 for those sales. As its Korean revenue passes the thresholds under the Game Industry Promotion Act and PIPA, it appoints a Korean company as domestic agent for both, and later uses the same company to run Korean community events and influencer campaigns under a cost-plus service agreement.
Mistakes we see
- Waiting for the first Korean tax letter before registering for VAT.
- Charging VAT to Korean businesses, or failing to keep their registration numbers.
- English-only privacy policies with no Korean version or no disclosure of transfers abroad.
- No breach plan able to notify Korean users within 72 hours.
- Missing the domestic-agent threshold as Korean users grow.
- Games launched without rating or with incomplete probability disclosure.
- Korean staff working for the foreign company without a Korean entity, creating PE and employment issues.
Korean terms you will meet
Questions readers ask
Do foreign digital service providers pay Korean VAT?
Yes, on sales to Korean consumers. They register under the simplified procedure of Article 53-2 of the VAT Act and charge 10%.
Do I need a Korean company to register?
No. Registration is online, in English, without a Korean entity.
What about sales through app stores?
The app store is treated as the supplier for Korean VAT on sales it makes to Korean consumers.
Is VAT charged to Korean businesses?
No, if they have a Korean business registration number. Their payments for software licences may bear Korean withholding.
Does PIPA apply to foreign companies?
Yes, to any business processing personal information of people in Korea. Larger foreign businesses must appoint a domestic agent.
What are the PIPA fines?
Up to 3% of total revenue, excluding revenue unrelated to the violation.
Do foreign games need a Korean rating?
Yes, through the Game Rating and Administration Committee or app-market self-rating, with probability disclosure for loot boxes.
Alexander Baranov
Founder of the BCA Group · cross-border corporate and tax adviser since 2008
Alexander advises foreign founders and groups on company formation, tax structuring and corporate law in more than 40 jurisdictions across Europe, the Gulf, Asia and Latin America. He is the author of nine books on international business and tax and writes regularly for professional finance and tax journals. He works in English, German, Spanish and Russian.
This guide is based on the Korean statutes cited in the text and on our own filings. It is reviewed when the law or official rates change.