Temu fined KRW 1.369 billion by the Korean PIPC for unlawful cross-border transfers and RRN processing, plus KRW 17.6 million for undisclosed offshore processing and no domestic agent
Subject: Whaleco Technology Limited and Elementary Innovation Pte. Ltd. (operators of the Temu platform)
What happened
The PIPC has been investigating overseas direct purchase services since 2024. Temu is an online marketplace connecting sellers and buyers; user data is managed by Whaleco Technology Limited and seller data by Elementary Innovation Pte. Ltd., so the PIPC sanctioned both entities.
How it was handled
The investigation found Temu had entrusted the processing and storage of personal data to businesses located in Korea, China, Singapore and Japan for shipping, without disclosing the entrustment in its privacy policy or notifying users, and without properly managing and supervising those processors (no security training, no examination of their data-processing practices). As of end-2023 its average monthly users reached 2.9 million, yet it had not designated a domestic agent as the PIPA requires; and it made withdrawal of membership difficult through a seven-step process. During the investigation the company voluntarily remediated: revising the privacy policy to disclose cross-border transfers and processors, appointing a domestic agent, and streamlining the un-registration process. Separately, when Temu began recruiting Korean sellers for a local-to-local service in February 2025 it collected and processed sellers’ resident registration numbers (RRNs) without a lawful basis; it destroyed all data collected in that recruitment process during the investigation.
Outcome
At its 11th plenary of 2025 (resolution of 15 May 2025) the PIPC imposed a penalty for violations (gwajingguem) of KRW 1.369 billion and a fine for wrongdoing (gwataeryo) of KRW 17.6 million, together with correction orders and recommendations, including an order for Temu to designate its Korean corporation as its domestic agent. The amounts split by entity: Whaleco Technology Limited, KRW 879 million penalty plus the KRW 17.6 million fine; Elementary Innovation Pte. Ltd., KRW 490 million penalty. Note that the KRW 1.369 billion is not attributable to cross-border transfer alone — the PIPC states it covers both the cross-border transfer violations and the limitations on processing resident registration numbers, while the KRW 17.6 million fine corresponds to the entrustment and domestic-agent failures. The same release recalls that in July 2024 the PIPC fined Alibaba.com Singapore E-Commerce Private Limited (AliExpress) KRW 1.978 billion for unlawful cross-border transfers and ordered it to build domestic-level data management capability; the PIPC also released a Chinese-language version of its Guidelines on Applying the Personal Information Protection Act to Foreign Business Operators.
What it means for Chinese exporters
- · Entrusted processing must be disclosed by name in the privacy policy. Korean law requires that where processing or storage is entrusted to foreign businesses to perform a contract, this be disclosed in the privacy policy or notified to data subjects by email or similar. Chinese companies routinely treat logistics, warehousing, support and payment channels as "vendors" and leave them out — that was the core infringement here.
- · A domestic agent is not optional. Once the statutory threshold is met, you must appoint one and then publish its name, address and contact details in the privacy policy. If you already have a Korean entity, designating it is the cheapest compliant route — which is exactly what the correction order required.
- · Managing and supervising processors is an auditable activity: security training records, periodic inspection records, security clauses in the processing agreement. Signing a contract without inspecting is a separate finding of infringement.
- · Friction in the account-deletion flow is treated as obstructing rights. A seven-step withdrawal hands the regulator an extra infringement. The rights-exercise entry point for an overseas service should be as easy to reach as the sign-up flow.
- · The regulator now treats Chinese cross-border e-commerce and platforms as a dedicated supervision category and has published Chinese-language guidance for them. Such companies should assume they are on a high-attention list and sequence overseas market pushes compliance-first.
Related regulations
Sources (1)
- Korean PIPC sanctions Temu for unlawful cross-border data transfer and other violationsPersonal Information Protection Commission, Republic of Korea (PIPC) · published 2025-05-20 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.