Skip to main content
Promotional banner for the pentest readiness checklist
Operationalizing Attorney-Client Privilege in South Korean Tax AuditsRegulatory Obligations Management
5 min readFor CISOs

Operationalizing Attorney-Client Privilege in South Korean Tax Audits

Why This Matters Now

If your team manages compliance for a multinational with operations in South Korea, you're familiar with the document-heavy nature of Korean tax audits. Previously, legal communications with Korean counsel during these audits were in a gray area. Attorneys had confidentiality duties, but clients couldn't shield these communications from seizure or disclosure.

This changes with the Korean National Assembly's amendment to the Attorney-at-Law Act on January 29, 2026, which establishes statutory attorney-client privilege (ACP). The amendment takes effect one year after promulgation, giving you about 12-18 months to adjust how your team handles privileged communications in South Korea.

This isn't just a local issue. Your global legal hold procedures, document retention policies, and cross-border investigation protocols need updating. The amendment applies retroactively to existing communications, meaning materials you've already produced might now qualify for protection.

Preparing for Change

Before redesigning your South Korean compliance workflows, gather these resources:

Current Documentation:

  • Legal hold procedures for South Korean tax matters
  • Document collection protocols for Korean tax audits
  • Email retention policies for Korean subsidiaries
  • Engagement letters with Korean tax counsel
  • Agreements with Korean tax authorities on document production

Cross-Functional Stakeholders:

  • Korean tax counsel (in-house and external)
  • Regional compliance leads for APAC operations
  • IT teams managing document retention for Korean entities
  • Records management personnel handling legal holds
  • Privacy officers, as the amendment covers electronic materials

Technical Infrastructure:

  • Access to your document management system's privilege tagging
  • Email archiving system with South Korea-specific rules
  • Ability to create jurisdiction-specific legal hold protocols
  • Secure channels for attorney-client communications

Legal Clarity on Exceptions: The amendment includes four exceptions where ACP doesn't apply. You'll need Korean counsel to map these to your operations:

  • Client consent (requires documented waiver procedures)
  • Conflict with significant public interest (needs operational definition)
  • Attorney's right to defend themselves in disputes with clients
  • Where separate statutes expressly provide otherwise (requires review)

The last exception is critical. The amendment doesn't specify which statutes override ACP, so you're working with incomplete information until further clarification emerges.

Implementing the Changes

Phase 1: Policy Updates (Months 1-3)

Start by updating your global legal hold policy with a South Korea-specific section:

  • Trigger events requiring privilege review (tax audit notices, investigation letters)
  • Who can assert privilege (attorney-client communications only)
  • Documentation requirements for privilege claims
  • Escalation paths when Korean tax authorities challenge privilege assertions

Update your document retention schedule to cover "documents or materials, including those in electronic form" prepared for litigation, investigations, or inquiries. This includes:

  • Legal memoranda analyzing Korean tax positions
  • Email exchanges with Korean tax counsel
  • Draft submissions prepared with counsel input
  • Work product from counsel reviewing proposed tax filings

Create privilege assertion templates for when Korean tax authorities request documents. These should:

  • Identify the privileged material by category
  • Cite Article 26-2 of the amended Attorney-at-Law Act
  • Specify the exception analysis
  • Include a certificate from Korean counsel confirming privilege status

Phase 2: Technical Controls (Months 3-6)

Configure your document management system to tag South Korean legal communications:

  • Metadata fields for "South Korea ACP" classification
  • Automated tagging rules for emails to/from Korean counsel domains
  • Privilege log generation for Korean tax matters
  • Audit trails showing who accessed privileged materials

Set up secure communication channels. Historical communications now qualify for protection, but going forward, ensure clean segregation:

  • Dedicated email aliases for Korean tax legal matters
  • Encrypted file sharing for sensitive Korean tax documents
  • Meeting protocols that distinguish legal advice from business discussions

Implement legal hold automation for Korean entities. When a tax audit notice arrives:

  • Automatic notification to Korean counsel and regional compliance
  • Immediate suspension of routine document destruction for in-scope materials
  • Privilege review workflow before document production
  • Tracking system for privilege assertions and authority responses

Phase 3: Training and Documentation (Months 6-9)

Train your Korean finance and compliance teams on privilege hygiene:

  • How to request legal advice using secure channels
  • What to include in email subject lines to trigger privilege protection
  • Why mixing business and legal discussions breaks privilege
  • When to escalate document requests to legal

Document your privilege decision-making. Create a privilege log template that records:

  • Document description (without revealing privileged content)
  • Date created
  • Author and recipients
  • Privilege basis (Article 26-2, Attorney-at-Law Act)
  • Exception analysis
  • Authority response (if challenged)

Phase 4: Testing (Months 9-12)

Before the amendment takes effect, run tabletop exercises:

  • Simulate a dawn raid scenario with Korean tax officials
  • Practice real-time privilege assertions using new templates
  • Test secure communication channels under time pressure
  • Validate that your document management system identifies privileged materials

Review existing open audits. For any Korean tax matters under investigation:

  • Conduct privilege review of already-produced documents
  • Determine if retroactive ACP application changes your position
  • Consider re-asserting privilege over previously disclosed materials
  • Document your legal analysis for each decision

How to Verify It Works

Don't wait for an actual audit to find gaps. Run these validation checks before the amendment takes effect:

Technical Validation:

  • Pull a sample of emails between your Korean entities and tax counsel from the past year
  • Verify your document management system tagged them as privileged
  • Confirm legal hold procedures preserved them during retention cycles
  • Test whether your privilege log auto-generates accurate entries

Process Validation:

  • Submit a mock document request to your Korean finance team
  • Time how long privilege review takes
  • Check whether your templates assert Article 26-2 protection
  • Verify escalation paths work

Cross-Border Validation:

  • Review your global investigation playbook
  • Confirm South Korea-specific procedures integrate with broader protocols
  • Test whether your U.S. or EU legal teams consult Korean counsel before producing documents involving Korean entities
  • Validate that your IRM platform reflects South Korea's new privilege regime

The real test: can a junior compliance analyst in your Seoul office, facing a document request during a tax audit, execute your privilege assertion procedure without escalating to headquarters?

Ongoing Tasks

Quarterly Reviews:

  • Monitor Korean court decisions interpreting Article 26-2
  • Track legislative developments clarifying which statutes override ACP
  • Update your exception analysis as judicial interpretation develops
  • Review privilege assertion logs for patterns in authority challenges

Annual Updates:

  • Refresh training for Korean finance and compliance teams
  • Audit privilege tagging accuracy in your document management system
  • Review and update secure communication channel configurations
  • Assess whether your privilege templates need revision based on authority responses

When Things Change: Watch for triggers requiring immediate policy updates:

  1. Korean courts issue rulings defining "significant public interest" exception
  2. Tax authorities publish guidance on ACP application during audits
  3. Other Korean statutes are amended to address ACP interaction

Document every privilege decision, track every authority response, and build institutional knowledge about what works. The first year after this amendment takes effect will establish precedents that shape Korean tax compliance for the next decade.

Your Korean counsel should be your primary source for updates, but don't assume they'll notify you. Schedule quarterly calls specifically to discuss ACP developments.

Promotional banner for the Pentest Readiness checklist download

You Might Also Like