Amendments To Korea’s Personal Information Protection Act: Turnover-Based Fines, CEO Accountability And Earlier Breach Notification

Introduction

In the Republic of Korea (“Korea”), amendments to the Personal Information Protection Act (the “PIPA”) were promulgated on 10 March 2026 as Act No. 21445 and take effect on 11 September 2026. One element — mandatory certification, discussed below — takes effect separately on 1 July 2027.

The official statement of reasons sets out both the background and the objective. Large-scale breaches at “major telecommunications carriers, financial companies and platform operators” have occurred one after another and damage to the public has continued to expand; the amendment responds by supplementing the limits of the existing sanctioning tools, clarifying the responsibility of the business owner or representative, strengthening the authority and independence of the Chief Privacy Officer, making certification mandatory above a certain scale, and introducing notification of the possibility of a leak. The stated aim is to put the personal data protection framework in order, and the subordinate legislation has been drafted along the same line.

Background: Recent Breach Incidents And The Rise In Sanctions

The Personal Information Protection Commission (the “PIPC”) recorded 447 breach notifications in 2025, up 45.6% from 307 in 2024, with hacking accounting for 62%. Across 2025 it imposed administrative fines in 40 cases totaling KRW 167.7 billion; the combined amount of administrative fines and penalties imposed rose 172% year on year.

The individual cases give the figures more concrete shape. SK Telecom disclosed a breach of USIM-related data affecting some 23.24 million subscribers in April 2025, and was fined KRW 134.79 billion that August — a record at the time. Coupang disclosed a breach in November 2025 that the PIPC assessed as affecting approximately 37.55 million people, and was fined KRW 624.68 billion in June 2026, the largest fine imposed under the PIPA to date.

Two parallel developments frame the amendment. The Act on Promotion of Information and Communications Network Utilization and Information Protection (the “Network Act”) was substantially overhauled by an amendment promulgated on 31 March 2026 and taking effect on 1 October 2026, introducing a 24-hour incident reporting deadline, government investigation powers exercisable without a company report, turnover-based fines of up to 3% for repeated incidents, and mandatory executive-level CISO designation. And since 2 October 2025, an overseas controller that has established, or exercises dominant influence over, a Korean entity must appoint that Korean entity as its domestic representative; the PIPC publicly identified 16 global companies whose appointments did not comply. In July 2026 it fined TikTok Pte. Ltd. KRW 10.31 billion and Apple Distribution International KRW 252 million, stating that it applies the same standards to domestic and foreign companies.

What The Amendment Changes

The amendment raises the ceiling on administrative fines to 10% of total revenue for repeated or serious violations. The 3% cap under Article 64-2(1) remains the general rule, and new Article 64-2(2) allows a fine of up to 10% of total revenue in three situations: a repeat violation of the same category within three years of a prior fine (each intentional or grossly negligent); an intentional or grossly negligent violation harming 10 million or more data subjects; and a leak resulting from failure to comply with a corrective order. The reference point is total revenue, rather than revenue related to the violation.

The amendment also requires the PIPC to reduce a fine where the controller has invested in data protection in advance. Under new Article 64-2(6), where a controller has invested in and operated budget, personnel, facilities and equipment for data protection, the PIPC shall reduce the fine, except where the violation was intentional or grossly negligent. Article 64-2(5) separately lists eleven factors the PIPC must weigh, including encryption efforts, certification and voluntary protection activities, and cooperation with the PIPC. This is the provision of the amendment that operates in a controller’s favor.

New Article 30-3 names the business owner or representative as the person ultimately responsible for personal data protection. It provides that the business owner or representative of a controller, “as the person ultimately responsible for the safe processing of personal information and the protection of data subjects’ rights, shall effectively implement comprehensive management measures, including the provision of specialized personnel and sufficient budget necessary for personal information protection.” The duty attaches to the representative director and cannot be discharged by delegation. It does not introduce personal monetary sanctions or imprisonment, and fines continue to be imposed on the company.

CPO governance is strengthened at two levels, one applying to every controller and one only above a threshold. Amended Article 31(4) restates the Chief Privacy Officer’s statutory duties to include management of specialized personnel and securing of budget, and reporting on the status of personal information protection to the business owner or representative and to the board of directors; these apply to every CPO, with no threshold. Separately, Article 31(3) requires controllers meeting criteria to be set by Enforcement Decree to obtain board approval for the designation, change or removal of the CPO and to file that matter with the PIPC.

ISMS-P certification becomes mandatory for certain controllers with effect from 1 July 2027. A proviso added to Article 32-2(1) converts that certification — the joint information security and personal data management system certification administered by the Korea Internet & Security Agency — from voluntary to mandatory for controllers meeting Enforcement Decree criteria. The proviso, and the related penalty under Article 75(2)15, take effect on that date rather than on 11 September 2026.

The notification regime now extends to integrity and availability incidents, and can be triggered before a leak is confirmed. “Forgery, alteration or damage” now sit alongside loss, theft and leakage in the defined term “leakage etc.”, which brings ransomware and similar incidents within the regime. New Article 34(2) further requires a controller that becomes aware of a possibility of leakage etc., as prescribed by Enforcement Decree, to notify all potentially affected data subjects without delay. Notifications must also now set out the rights to claim damages or statutory damages and to apply for dispute mediation.

The Enforcement Decree

The criteria that determine which controllers are caught by the CPO, certification and notification requirements are delegated to the Enforcement Decree. The PIPC has published draft amendments setting out those delegated details, covering the designation and filing of the CPO, the scope of mandatory certification, notification of the possibility of a leak, and the calculation of fines and administrative penalties. Their direction may be summarized as follows.

• On CPO governance, the board approval and filing requirement is proposed to apply to the controllers already subject to the specialist CPO designation requirement — broadly, annual revenue or income of KRW 180 billion or more together with processing of sensitive or unique identifying information of 50,000 or more data subjects, or personal data of 1 million or more data subjects — with filing due within one month.
• On certification, mandatory ISMS-P is proposed for certain public system operators, mobile network operators, identity verification agencies, and controllers meeting all of prior-year revenue of KRW 1 trillion or more, prior-year ICT services revenue of KRW 10 billion or more, and a daily average of 30 million or more domestic data subjects over the preceding three months, with certification due by the end of 2028.
• On notification, the possibility notification is proposed to arise where a controller becomes aware of unlawful access to a processing system or to a device used by a person handling personal data, or of unlawful trading or circulation of its data — subject in each case to further qualifying conditions — with notification within 72 hours.
• On sanctions, administrative penalty levels are proposed to be raised, with a corrective order or warning issued in place of a penalty counting towards the violation count; and the reduction of a fine for prior investment is proposed to be capped at 40% of the base amount, assessed by reference to the scale and continuity of the investment and the roles of the business owner or representative and the CPO.

What Foreign Businesses Should Do

For a foreign-invested business in Korea, the practical significance of the amendment lies less in any single provision than in the record it makes relevant: under Article 64-2(5) and (6), a company’s governance record becomes a factor in the assessment of any future fine. Four steps may be considered.

• Document a reporting line to the Korean representative director — periodic written reporting of Korea privacy status, risks, incidents and remediation, retained as a record. Article 30-3 places the duty on the business owner or representative, and delegation to a regional or global officer would not be expected to discharge it.
• Confirm the Korea CPO designation. A global DPO function does not automatically satisfy the PIPA. Confirm that a named individual is formally designated for Korea, that the qualification requirements are met against the Korean categories of experience, and that authority over personnel and budget is recorded in internal governance documents.
• Review incident response against the earlier trigger. The notification clock may now start at the point of suspicion rather than confirmation, and integrity and availability incidents are covered. Escalation criteria, notification templates and the 72-hour path are best tested ahead of September.
• Document protection investment. Budget, headcount, equipment, training records and audit output form the basis of the Article 64-2(6) reduction, and contemporaneous records are likely to carry more weight than material assembled after an investigation has begun. The draft decree points to the scale and continuity of that investment.
•  

Conclusion

The 2026 amendment does not redraw the PIPA’s substantive processing rules. What it adjusts is the allocation of responsibility and the consequence of non-compliance. A cap of 10% of total revenue, a reduction that must be granted for demonstrable prior investment, and a statutory duty running to the representative director together position personal data protection as a matter for senior management and the board rather than for the compliance function alone. On the government’s own account, the objective is a framework in which protection is established before an incident rather than assessed after one, and the period before 11 September offers time to put the corresponding records in place.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.