Headhunter onboarding at a Korea branch: procurement steps and data rules

This guide is for HR managers in the Korean branch of a global company who need to bring in a headhunter or another outside vendor through head office procurement. Global procurement rules are strict for good reasons: risk control, compliance, data protection and financial transparency. The local HR manager's job is to give the process the right information early. Korean law adds its own rules on personal data and on headhunting firms, described here as of October 2026.

How global vendor onboarding usually works

A typical onboarding runs through these stages:

1. A new vendor registration form and the vendor's company documents.
2. A privacy review and a data processing agreement (DPA).
3. Contract review by the legal team.
4. Vendor approval by finance.
5. A purchase order from procurement and final budget approval.

Each team has its own role. Procurement runs the process and negotiates terms. Legal reviews the contract and assesses risk. Finance confirms the budget and payment terms. The privacy team reviews how personal data will be handled. Every team also has its own requirements and timetable, and time differences, language and culture between head office and the branch add to the delay.

Where local HR managers get stuck

• Information gaps. The hiring need is clear, but the local manager often does not have the approved budget, the approval line or other details that procurement and finance ask for.
• Different priorities. HR wants to hire fast, procurement wants thorough checks, and legal wants a complete contract.
• Little guidance. Registering a new vendor can take weeks, yet local staff often get no explanation or training on the process.
• Peak periods. At quarter-end and year-end, approval queues in finance, legal and management are already full, and nobody may tell you in advance.

Prepare before you request a vendor

• Get the approved hiring budget and the expected salary range from the budget owner.
• Have the job description and the requisition number ready.
• Decide whose budget pays: HR or the business unit. A business unit budget usually needs the unit head's prior approval and a confirmation that the budget exists.
• If the current vendor is underperforming, document it with numbers before asking for a new one: candidates submitted, interview pass rate, hires made and average time to hire.
• Keep a request template with the position, estimated cost, budget source, service period and responsible department.
• Build the onboarding time into the hiring plan, and avoid quarter-end and year-end where you can.

Personal data: the DPA and Korean entrustment rules

Recruitment vendors handle candidates' personal data, so head offices usually require a DPA. Under Article 28(3) of the EU General Data Protection Regulation (GDPR), processing by a processor must be governed by a contract or other legal act that sets out the subject matter and duration, the nature and purpose of the processing, the type of personal data, the categories of data subjects and the controller's obligations and rights. Article 28(9) requires this contract to be in writing, including electronic form.

Korea has its own rule. When your company entrusts the processing of personal data to another party, for example by having a vendor screen applicants for you, Article 26 of the Personal Information Protection Act (개인정보 보호법) applies:

Local vendors may not understand why a global company insists on these documents. Explain the reason and offer the company's standard DPA template.

Governing law can also be a sticking point. A local vendor may resist a contract governed by a foreign law, such as Dutch law. Work with the legal team on a practical compromise, for example: the main contract prevails in general, and the DPA prevails on the processing of personal data. The local HR manager's role as a mediator matters here.

Budget: success fees and Korean headhunting law

Under a success-fee model, the vendor charges a percentage of the hired person's annual salary, and only when a hire is made, with no advance payment. This keeps budget risk low, but you still need an estimate. Multiply the expected salary by the fee rate to get the maximum spend, and get that amount approved in advance.

In Korea, finding candidates for a fee is a fee-charging job placement business (유료직업소개사업) under the Employment Security Act (직업안정법). A domestic agency must register with the head of the local government (시장·군수·구청장) where its main office is located (Article 19(1)). It may not charge more than the fees set by the Ministry of Employment and Labor (고용노동부). The exception is the placement of high-level professionals defined in the Enforcement Rule, for whom the agency and the employer may agree the fee (Article 19(3)). Ask for the registration certificate during onboarding.

Working well with head office

• When something goes wrong, focus on the fix. Admit what you missed, say how you will correct it, and propose how to prevent a repeat.
• Ask for specific help. Name the information or decision you need, rather than asking for help in general.
• Keep all related emails and documents in date order, and keep a list of each team's contact person and role.
• Set milestones for each stage with an owner and an expected duration, and act at once when something stalls.
• After each onboarding, write a short manual with the checklist, documents, contacts and timing, and update it when the process changes.
• Consider using more than one vendor to spread risk, but remember each one needs the full onboarding.

Checklist

• Budget, salary range, job description and requisition number confirmed.
• Budget owner (HR or business unit) and approval line known.
• Vendor's company documents and job placement registration certificate collected.
• DPA signed, and the Korean entrustment document covers the Article 26 items.
• Entrusted work and processor posted on your website.
• Timeline planned around quarter-end and year-end approval peaks.