JIPYONG LLC

Jipyong News|KOREA LEGAL INSIGHT

Key Regulatory Developments in Korea’s Data Protection and ICT Laws

2026.04.20

<span style="font-size:18px;"><span style="color:#c0392b;"><strong>Introduction</strong></span></span>
<div><br />
<span style="font-size:18px;">Following a series of large-scale data breaches in 2025, Korea has enacted significant amendments to the Personal Information Protection Act (the “PIPA”), the Act on Promotion of Information and Communications Network Utilization and Information Protection (the “ICNA”), and the Telecommunications Business Act (the “TBA”).  These reforms collectively mark a shift toward heightened enforcement, expanded management liability, and earlier regulatory intervention, including at the stage of potential incidents.  For foreign companies operating in or targeting the Korean market, these changes increase compliance exposure and require alignment of governance, incident response, and data handling practices with Korean regulatory standards. </span></div>
<br />
<br />
<span style="font-size:18px;"><span style="color:#c0392b;"><strong>1. Personal Information Protection Act (PIPA)<sup><span style="color:#c0392b;">1)</span></sup></strong></span></span>

<div><br />
<span style="font-size:18px;">The PIPA amendments strengthen enforcement and elevate accountability for personal data protection at the executive level.  The reforms introduce higher penalty thresholds, earlier breach notification obligations, and clearer allocation of responsibilities between the CEO and CPO.  They also expand compliance requirements through mandatory certification and recognition of security investment.  Key changes are summarized below:</span></div>

<div><br />
<span style="font-size:18px;">The ICNA amendments establish a more structured and enforcement-oriented framework for managing cybersecurity incidents and regulating digital communications.  In addition to strengthening penalty mechanisms, the amendments impose prescriptive obligations on incident response, user protection, and internal governance.  They also expand regulatory oversight to include commercial electronic messaging, reflecting a broader effort to address emerging risks in the digital environment.  Key changes are summarized below:</span><br />
 </div>

<table cellpadding="8px" style="width:100%; text-align:center; border:1px solid #bbb; border-collapse:collapse;" width="100%">
	<tbody style="line-height: 16px;">
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); background-color: rgb(242, 242, 242); border-top: 2px solid #cc0000; padding: 4px; vertical-align: center;" width="30%"><span style="font-size:15px;"><strong>Category/Legal Basis</strong></span></td>
			<td style="border: 1px solid rgb(187, 187, 187); background-color: rgb(242, 242, 242); border-top: 2px solid #cc0000; padding: 4px; vertical-align: top;" width="70%"><span style="font-size:15px;"><strong>Details</strong></span></td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 16px; text-align: left; line-height: 25px; padding: 12px; vertical-align: middle">
			<div style="line-height: 25px; font-size: 15px">Administrative fines for repeated breach (Art. 48-8)</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 16px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">Administrative fines of up to 3% of total turnover may be imposed where two or more breach incidents occur within five years due to intent or gross negligence.  Failure to pay results in a surcharge equivalent to 6% per annum.</div>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: middle">
			<div style="line-height: 25px; font-size: 15px">Daily enforcement penalties (Art. 48-7)</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">Up to 0.03% of average daily turnover imposed for failure to comply with corrective orders, submit required materials, or cooperate with investigations.</div>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: middle">
			<div style="line-height: 25px; font-size: 15px">Breach reporting and user notification (Art. 48-3)</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">Cybersecurity incidents must be reported within 24 hours of awareness, with prompt notification to affected users.</div>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: middle">
			<div style="line-height: 25px; font-size: 15px">Incident response manuals (Art. 48-9)</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 16px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">Companies are required to establish and submit standardized incident response and management manuals.</div>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: middle">
			<div style="line-height: 25px; font-size: 15px">Damage mitigation and recovery (Art. 48-10)</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 16px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">Companies must implement post-incident mitigation and recovery measures and report results to regulators.</div>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: middle">
			<div style="line-height: 25px; font-size: 15px">Investigation Review Committee (Art. 48-2(7)–(9))</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 16px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">A Data Breach Investigation Review Committee is established to oversee: (i) assessment of investigation necessity, (ii) joint investigations, and (iii) on-site inspections.</div>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: middle">
			<div style="line-height: 25px; font-size: 15px">Information security governance (CISO framework)</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 16px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">(i) Mandatory appointment of an executive-level CISO with board reporting obligations.  (ii) Introduction of annual information security assessments, with potential public disclosure.  (iii) Strengthened ISMS regime, including revocation for violations and enhanced standards for high-risk entities.</div>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: middle">
			<div style="line-height: 25px; font-size: 15px">Administrative fines – commercial messaging (Art. 50-9)</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 16px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">The Korea Communications Commission may impose administrative fines of up to 6% of total turnover (as prescribed by Presidential Decree) for violations of restrictions on the transmission of commercial messages.</div>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: middle">
			<div style="line-height: 25px; font-size: 15px">Mandatory delegation to certified transmitters (Art. 50-3(1))</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 16px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">Commercial electronic messages sent for profit may only be outsourced to entities certified under the Telecommunications Business Act.</div>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: middle">
			<div style="line-height: 25px; font-size: 15px">Blocking and corrective measures for unlawful messaging (Art. 50-4(4))</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 16px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">Where a service is used for the transmission of commercial messages, operators must take specified measures, including: (i) immediate suspension of such transmission; (ii) denial of service or termination of the service agreement; (iii) inspection and remediation of security vulnerabilities; (iv) revision of terms and conditions; and (v) establishment and implementation of recurrence prevention measures.</div>
			</td>
		</tr>
	</tbody>
</table>
<br />
<br />
<span style="font-size:18px;"><span style="color:#c0392b;"><strong>3. Telecommunications Business Act (TBA)<sup><span style="color:#c0392b;">2)</span></sup></strong></span></span><strong> </strong>

<div><br />
<span style="font-size:18px;">The TBA amendments enhance user protection and strengthen operational compliance obligations for telecommunications service providers.  The reforms expand regulatory intervention powers in cybersecurity incidents while imposing stricter controls over subscriber management and sales channels.  They also introduce new consumer-focused measures aimed at improving pricing transparency and user outcomes.  Key changes are summarized below:</span><br />
 </div>

KOREA LEGAL INSIGHT Korea Tightens Delisting Rules: A New Era of Swift and Strict Enforcement 2026.05.04

KOREA LEGAL INSIGHT Key Regulatory Developments in Korea’s Data Protection and ICT Laws 2026.04.20

Back to List

JIPYONG LLC

Related Practices

Professionals

Related Practices

Professionals

SHARE

Disclaimer

Limited Liabilities