A Korea branch must adapt global HR policies to Korean law in five areas

This guide is for HR managers in the Korean branch of a global company who are asked, often by a governance, risk and compliance (GRC) team, to review head office HR policies. Global templates usually need local changes in five areas. The goal is to meet head office requirements while staying within Korean law, as of October 2026.

1. Background checks

Global screening providers work in Korea, but checks can be slow, especially for jobs held abroad, and some global programs are never fully carried out locally. Korean law also sets limits:

• Consent. Collecting a candidate's personal data needs a legal basis, usually consent (Personal Information Protection Act (개인정보 보호법) Article 15). A former employer giving you information is a provision to a third party, which also needs the person's consent (Article 17). Collect only the minimum; the company must prove it was the minimum (Article 16).
• Source notice. If you process data obtained from someone other than the candidate, such as a referee, you must tell the candidate on request the source, the purpose and their right to stop the processing (Article 20). The fine for not doing so is up to ₩30,000,000.
• Sensitive data and ID numbers. Health and other sensitive data need separate consent or a legal basis (Article 23). Resident registration numbers (주민등록번호) may be processed only where a law specifically requires or allows it (Article 24-2); the fine is up to ₩30,000,000.
• Surcharges. Processing personal data without consent or another legal basis (Articles 15 and 17), or processing resident registration numbers unlawfully, can also bring a surcharge of up to 3% of total revenue (Article 64-2).
• Criminal records. Record checks are limited to the purposes in Article 6 of the Act on the Lapse of Criminal Sentences (형의 실효 등에 관한 법률), and no one may obtain records for other purposes.
• Hiring questions. Where 30 or more workers are regularly employed, the Fair Hiring Procedure Act (채용절차법) bans asking for, or collecting proof of, appearance, height, weight, home region, marital status or assets, or family members' education, jobs or assets, unless the job needs it (Article 4-3). The fine is up to ₩5,000,000.
• Fair treatment. An employer must not discriminate in hiring on grounds such as sex, religion, age, physical condition, social status, home region, education or marital status without a reasonable reason (Framework Act on Employment Policy (고용정책 기본법) Article 7).

Documents that work well are certificates of employment (경력증명서) and degree certificates and transcripts. A worker who worked 30 days or more can ask a former employer for a certificate of employment within 3 years of leaving. The employer must issue it at once, showing only the items requested (Labor Standards Act Article 39, Enforcement Decree Article 19).

2. Confidentiality and invention assignment

Rather than a separate US-style confidentiality and invention assignment agreement (CIIAA), Korean branches usually put these clauses in the employment contract. Match the document to the relationship:

The Invention Promotion Act (발명진흥법) limits assignment clauses:

• An employee invention (직무발명) falls within the employer's business and the employee's current or past duties. A clause assigning other inventions in advance is void (Article 10(3)).
• If a contract or the work rules provide for advance assignment, rights in an employee invention pass to the employer on completion, unless the employer tells the employee within the period set by decree that it will not take them (Article 13(1)). Without such rules, the employer must tell the employee in writing whether it takes the rights, or it is deemed to have given them up (Article 13(2) and (3)).
• A company that is not a small or medium enterprise gets no free non-exclusive licence unless it agreed such rules with employees in advance (Article 10(1)).
• Employees report completed inventions in writing (Article 12) and are entitled to fair compensation. The employer must set compensation rules and notify employees in writing (Article 15).

Confidentiality clauses alone do not make information a trade secret; see A security pledge alone does not make information a trade secret in Korea.

3. Security certification and training

ISO/IEC 27001 is the international standard for information security management systems. ISMS-P (정보보호 및 개인정보보호 관리체계 인증) is Korea's combined security and privacy certification, issued by the Korea Internet & Security Agency (KISA, 한국인터넷진흥원) or designated bodies. In the author's view, companies working abroad lean toward ISO 27001, which is recognized internationally, while Korea-focused companies choose ISMS-P.

First check whether certification is mandatory. Under the Network Act (정보통신망법) Article 47(2) and Enforcement Decree Article 49, the security certification (ISMS) is required for major ICT service providers, data centre operators, and providers with ICT service revenue of ₩10,000,000,000 or more, or 1,000,000 or more daily users on average, in the previous year. It is valid for 3 years. A company that holds an international standard certification can have part of the audit skipped (Article 47(3)).

Training is a legal duty for staff who handle personal data (PIPA Article 28(2)). Korean options include KISA Academy (academy.kisa.or.kr), the Personal Information Protection Commission's learning site (edu.privacy.go.kr) and, for financial companies, the Financial Security Institute's education centre (edu.fsec.or.kr). They can run alongside the global platform. When you change platforms, move the completion records too.

4. Discipline and work rules

Korean labor laws change often. Check the National Law Information Center (law.go.kr) and the Ministry of Employment and Labor (고용노동부) website regularly, and update the work rules (취업규칙).

• With 10 or more regular workers, you must write work rules, including rewards and sanctions, and file them. Changes need the majority's opinion, and their consent if unfavourable (Labor Standards Act Articles 93 and 94). See File changed work rules on Form No. 15 with workers' opinion or consent.
• Discipline needs just cause (Article 23(1)) at workplaces with 5 or more regular workers.
• A pay cut as a sanction may not exceed half a day's average wage per case, or one tenth of total wages in a pay period (Article 95).

Recent changes to reflect:

A head office rule to report incidents within 24 hours is internal policy; adjust it to local practice. Make sure it supports external deadlines, such as the 72-hour notice for personal data breaches.

5. Exits, transfers and devices

• Run exits through the HR system, have IT remove access, and track handovers in a tool such as Jira.
• Review access rights when people change teams or roles.
• Bring-your-own-device (BYOD) rules must still meet the safeguard duty in PIPA Article 29: technical, managerial and physical measures against leaks.
• Localize incident response and business continuity planning (BCP) training.

How to run the review

1. Interview local staff about actual practice.
2. Get a legal review from a local law firm.
3. List the gaps between global policy and local practice.
4. Draft fixes with HR and legal.
5. Roll out in stages after management approval.

Explain why the review is happening, listen to local staff, and acknowledge what already works.

Checklist

• Consent forms for background and reference checks.
• Hiring forms checked against the Fair Hiring Procedure Act.
• Invention compensation rules written and notified.
• ISMS duty checked against the revenue and user thresholds.
• Privacy training scheduled for data handlers.
• Work rules updated for the 2025~2026 changes and filed.