"Points domestic companies must not miss when contracting with foreign companies!"

Article posted in 2025-02-03 15:38:37 | VEAT

Law firm Veat reviewed the legal aspects of a service use contract that a listed healthcare company (hereinafter "Client") plans to enter into with an overseas legal entity (hereinafter "Subject Overseas Legal Entity") providing specific services.

In this case, since the Client uses the Subject Overseas Legal Entity's device and interfaces connected to it, and transmits data including personal information of final consumers to the Subject Overseas Legal Entity's server, it was necessary to conduct a multifaceted review, including compliance with the "Personal Information Protection Act."

 

Necessity of Reviewing a Service Use Contract with an Overseas Legal Entity

 

Even if a domestic company enters into a contract with an overseas company, the laws of the Republic of Korea may still apply, and it may ultimately become the subject of various obligations under laws such as the Personal Information Protection Act.

Therefore, it is important to clearly understand the provisions of the relevant laws of the Republic of Korea before entering into a contract and to clearly define the rights and obligations between the domestic legal entity and the overseas legal entity to minimize legal risks.

To achieve this purpose, Law firm Veat provided legal advice focusing on the following points.

1. Overseas Transfer of Personal Information

Personal Information Protection Act

Article 28-8 (Overseas Transfer of Personal Information) ① A personal information processor shall not provide (including cases of inquiry), process through outsourcing, or store (hereinafter “transfer” in this Section) personal information overseas. However, personal information may be transferred overseas in cases falling under any of the following subparagraphs.
1. In cases where separate consent for overseas transfer has been received from the information subject.
2. ~ 5. (Omitted)
② A personal information processor shall inform the information subject of the following matters before receiving consent under subparagraph 1 of paragraph 1 of Article 28-8.
1. Items of personal information to be transferred
2. Country, timing, and method of transfer of personal information
3. Name (in the case of a legal entity, the name and contact information) of the recipient of the personal information
4. Purpose of use of personal information by the recipient, and retention and utilization period
5. Method, procedure, and effect of refusing the transfer of personal information


The "Personal Information Protection Act" stipulates that, except for special circumstances such as receiving separate consent from the information subject for overseas transfer, personal information should not be transferred overseas. Furthermore, when obtaining such consent, it imposes an obligation to inform the information subject of legally stipulated matters such as the items of personal information to be transferred and the transfer country.

In this case, we informed the Client, which is subject to the Personal Information Protection Act, that it may become the subject of these obligations because it is transferring personal information to a server owned by the Subject Overseas Legal Entity.

2. Provision and Processing Outsourcing of Personal Information

The "Personal Information Protection Act" distinguishes between "third-party provision" and "processing outsourcing" of personal information and prescribes different requirements for each.

Therefore, it is necessary to clearly determine whether transmitting personal information collected by the Client to the Subject Overseas Legal Entity constitutes "third-party provision" or "processing outsourcing" under the Personal Information Protection Act. However, it is difficult for general individuals lacking expertise in personal information-related laws to judge this themselves, so we recommend seeking the assistance of a legal expert.

Law firm Veat judged whether the information transfer in this case constituted "third-party provision" or "processing outsourcing" under the "Personal Information Protection Act" based on the "Personal Information Protection Act," similar cases, and Supreme Court precedents, and provided detailed legal advice to the Client regarding the legal obligations it must comply with accordingly.

3. Clarifying Rights and Obligations

If the roles of the domestic and overseas legal entities are ambiguous in the contract, there is a risk that the location of legal responsibility will be unclear. Therefore, Law firm Veat, based on a thorough understanding of the services provided by the Subject Overseas Legal Entity and the business the Client intends to pursue, modified the service use contract to clearly define the rights and obligations between the two parties, minimizing the legal obligations the Client must bear.

 

Partner with Law firm Veat for Contract Negotiation and Performance with an Overseas Legal Entity

 

When a domestic company collaborates with an overseas entity, simply entering into a contract from a purely business perspective can exclude the possibility of unforeseen legal risks. Law firm Veat has provided customized legal advice based on a thorough understanding of IT and global business.

If a legal issue arises in the process of entering into or performing a contract with an overseas entity, please contact Law firm Veat. We at Law firm Veat can provide legal advice optimized for your specific circumstances.

This case study can also be found on the Law firm Veat blog.

Points to Keep in Mind When a Domestic Company Contracts with an Overseas Company!

Thank you.

Law firm Veat