How Should Companies Respond to a Dawn Raid in Korea?

Short Answer

Companies should stay calm, cooperate appropriately, and quickly identify the legal basis for the raid.

In Korea, a “dawn raid” may refer to different types of government action.

It may involve:

• A criminal search and seizure by prosecutors or police
• An on-site investigation by a regulatory authority
• An inspection by an agency such as the Korea Fair Trade Commission (KFTC), Personal Information Protection Commission (PIPC), or other regulators

The company’s response depends on which authority is present, what legal power is being exercised, and what documents or electronic data are being requested.

Companies should not obstruct a lawful investigation, but they should also not assume that investigators may access everything without limitation.

---

What Is a Dawn Raid?

A dawn raid is an unannounced visit by government investigators to secure evidence or inspect business records.

Depending on the case, officials may seek to:

• Enter business premises
• Review business records
• Collect electronic data
• Interview employees
• Copy documents
• Seize devices or storage media
• Inspect internal systems

The most important first step is to determine whether the raid is a criminal search and seizure or a regulatory on-site investigation.

The procedures and company rights may differ significantly.

---

Who May Conduct a Dawn Raid in Korea?

Several authorities may conduct on-site investigations.

Common examples include:

• Prosecutors conducting criminal investigations
• Police executing search and seizure warrants
• KFTC officials investigating competition law or unfair trade practices
• PIPC officials investigating privacy or data protection issues
• Other regulators investigating industry-specific compliance issues

Each authority has different powers and procedures.

The company should identify the authority first before deciding how to respond.

---

Criminal Search and Seizure vs. Regulatory Inspection

This distinction is critical.

A criminal search and seizure usually involves prosecutors or police executing a court-issued warrant.

A regulatory inspection may be conducted under the relevant administrative statute and may involve document requests, on-site review, or inspection of business records.

Companies should avoid two common misunderstandings.

First, not every on-site investigation is automatically invalid just because it does not look like a criminal warrant search.

Second, even where a warrant exists, investigators must generally stay within the scope of the warrant and follow proper execution procedures.

---

What Should Companies Check First?

The first response should be organized and controlled.

Companies should immediately check:

• Which authority is conducting the raid
• Whether there is a warrant, official notice, or investigation letter
• What location is covered
• What documents, devices, or data are being requested
• What alleged violation is being investigated
• Whether the investigation involves the company, employees, or both
• Whether outside counsel should be contacted immediately

The company should designate one internal person to coordinate communications with investigators.

---

If There Is a Criminal Search Warrant, What Should Be Checked?

If prosecutors or police present a search and seizure warrant, the company should carefully review the warrant.

Important points include:

• The place to be searched
• The items to be seized
• The suspected offense
• The warrant’s effective period
• Whether electronic data, servers, emails, or storage media are included
• Whether the search extends to specific employees or personal areas

A warrant is not unlimited permission to search all company information.

The company should cooperate with lawful execution, but should also monitor whether the search stays within the authorized scope.

---

Does the Warrant Need to Be Presented?

Generally, yes.

In a criminal search and seizure, investigators should present the warrant so that the affected person can understand the legal basis and scope of the search.

This may be especially important where investigators search:

• A specific employee’s desk
• A personal locker
• A company laptop assigned to an employee
• A mobile phone
• A specific email account
• A separate office or storage area

If multiple persons or spaces are affected, the way the warrant is presented may become important later.

---

Should Employees Cooperate?

Yes, but carefully.

Employees should remain professional, calm, and truthful.

However, employees should not:

• Guess answers
• Speculate about facts
• Destroy or hide documents
• Delete emails or files
• Give consent beyond their authority
• Allow access to personal accounts or devices without clarification
• Make informal comments that may be misunderstood

If an employee does not know the answer, it is better to say so clearly.

Cooperation does not mean giving unlimited access or making unnecessary statements.

---

Can Investigators Search Everything?

Not necessarily.

The scope depends on the legal basis for the raid.

In a criminal warrant search, investigators should generally stay within the scope of the warrant.

In a regulatory investigation, the scope is usually determined by the relevant statute, investigation notice, or official request.

Companies should monitor:

• The areas being searched
• The documents being copied
• The electronic data being accessed
• The employees being questioned
• Whether the request goes beyond the stated investigation scope

This is especially important where confidential, privileged, personal, or unrelated business information may be involved.

---

How Should Companies Handle Electronic Data?

Electronic evidence is often the most sensitive part of a dawn raid.

Investigators may seek access to:

• Company emails
• Internal messaging records
• Shared servers
• Accounting systems
• Electronic approval systems
• Employee laptops
• Mobile devices
• External storage devices
• Cloud-based files

Companies should preserve relevant electronic data and avoid deletion or modification.

At the same time, electronic data collection should generally be managed carefully so that the search is limited to relevant data and properly documented.

---

What Is Selective Collection of Electronic Data?

In Korea, electronic evidence issues often focus on whether investigators collect only data related to the case.

For a criminal search and seizure, electronic data is generally expected to be collected through a targeted process, such as selecting, copying, or printing relevant information.

Broader copying or removal of entire storage media may raise additional procedural issues.

Companies should try to confirm:

• What electronic data is being searched
• What keywords, folders, accounts, or time periods are being reviewed
• Whether company personnel or counsel may participate
• Whether unrelated information will be excluded
• Whether an electronic data inventory will be provided
• Whether irrelevant copied data will be deleted, returned, or otherwise handled properly

These points can become important if the legality or scope of the search is later disputed.

---

Should the Company Keep Records During the Raid?

Yes.

The company should keep a clear internal record of what happens.

Useful records may include:

• Names and affiliations of investigators
• Time of arrival and departure
• Documents or notices presented
• Areas searched
• Employees interviewed
• Documents copied or seized
• Devices or storage media taken
• Electronic data accessed or copied
• Questions asked by investigators
• Objections or concerns raised by the company

This record may be important for later legal review and internal reporting.

---

Should Employees Answer Questions Immediately?

It depends.

Employees should cooperate appropriately, but they should also understand the context of the questions.

Before answering, it may be appropriate to clarify:

• Whether the question is directed to the employee personally or to the company
• Whether the employee is being asked as a witness, suspect, or company representative
• Whether the question concerns facts personally known to the employee
• Whether legal counsel may be present
• Whether the employee needs time to check records

Accurate answers are generally better than quick but uncertain answers.

---

What Should Companies Avoid During a Dawn Raid?

Companies should avoid conduct that may worsen the situation.

In particular, companies should not:

• Obstruct investigators physically
• Destroy, alter, or conceal documents
• Delete emails, messages, or files
• Instruct employees to give false or coordinated answers
• Provide speculative explanations
• Allow uncontrolled interviews without internal coordination
• Ignore the scope of the investigation
• Fail to keep records of what was reviewed or taken

The response should be cooperative but disciplined.

---

What Should Companies Do Before a Dawn Raid Happens?

Preparation is often the best protection.

Companies should consider:

• Establishing a dawn raid response protocol
• Designating an internal response team
• Training reception, IT, legal, and management personnel
• Preparing procedures for electronic data preservation
• Maintaining organized document systems
• Creating internal escalation channels
• Identifying outside counsel in advance
• Conducting compliance reviews in high-risk areas

A company that prepares in advance can respond more calmly and reduce unnecessary legal risk.

---

Practical Considerations

If investigators arrive unexpectedly, the company should focus on the following:

• Identify the authority
• Confirm the legal basis
• Review the scope of the warrant, notice, or request
• Contact senior management and legal counsel
• Preserve relevant documents and electronic data
• Prevent deletion or alteration of records
• Keep a detailed log of the raid
• Monitor electronic data collection
• Request or confirm inventories of seized or copied materials
• Coordinate employee interviews carefully

The first few hours often shape the rest of the investigation.

---

Conclusion

A dawn raid in Korea may involve either a criminal search and seizure or a regulatory on-site investigation.

Companies should cooperate with lawful investigations, but they should also understand the legal basis, scope, and procedure being used.

The most important steps are to identify the investigating authority, review the warrant or official notice, preserve relevant evidence, manage employee communications, and carefully document what investigators review, copy, or seize.

For foreign companies doing business in Korea, a prepared dawn raid response plan can significantly reduce legal risk and business disruption.

---