JIPYONG LLC

Jipyong News|KOREA LEGAL INSIGHT

Higher Fines, New Incentives: How South Korea’s Amended PIPA Reshapes Corporate Data Breach Exposure

2026.10.19

Introduction
<div> 
The amended Personal Information Protection Act (the “PIPA”) and its Enforcement Decree (the “Enforcement Decree”) took effect on September 11, 2026, amid a rise in both the frequency and the impact of personal data breaches.  The number of reported personal data breaches rose from 163 in 2021 to 447 in 2025.1)  The financial consequences of serious violations have also grown substantially.  Since the Personal Information Protection Commission (the “PIPC”) was established in August 2020, twelve cases have resulted in administrative fines of KRW 10 billion or more, totaling approximately KRW 1.02 trillion.2)  Eight of those cases have occurred since 2025, accounting for approximately 86.6 percent of the total amount.3) 
 
Against this backdrop, the amended regime increases the potential financial exposure for serious violations and requires personal information controllers to respond at an earlier stage of a potential breach.  In doing so, it places greater emphasis on preventive investment, privacy governance, and management-level responsibility. </div>
 
 
1. New Compliance Threshold: From a Confirmed Breach to a Possible Breach 
 
<div>The amended regime introduces a new notification obligation – personal information controllers must notify data subjects within seventy-two hours of becoming aware of circumstances indicating that a personal information breach may have occurred, even if the breach has not yet been confirmed.4)  Under Article 34(2) of the PIPA, to minimize potential harm, the controller must notify all data subjects whose personal information may possibly have been breached in the circumstances prescribed by the Enforcement Decree. 
 
The seventy-two-hour notification obligation is triggered when a personal information controller becomes aware of either of the following: 
   
<table border="0" cellpadding="0" cellspacing="0">
	<tbody>
		<tr>
			<td valign="top" width="3%">  </td>
			<td width="97%">(a) unauthorized access to a personal information processing system, or to a device used by a person handling personal information, in circumstances indicating that personal information may have been compromised, where the affected data subjects cannot readily be identified; or</td>
		</tr>
		<tr>
			<td valign="top">  </td>
			<td>(b) confirmation that some of the personal information processed by the controller has been compromised (including where it has been unlawfully traded by a third party), and that personal information relating to other data subjects may also have been compromised.5)</td>
		</tr>
	</tbody>
</table>
 
The amended regime also imposes heavier sanctions for delayed breach responses.  If a controller fails to report or notify a breach within the statutory deadline and also fails to take measures to prevent the spread of harm, the administrative fine may be increased by up to 30 percent.  A separate increase of up to 30 percent may apply if the controller obstructs the PIPC’s investigation, for example by concealing or destroying evidence.6)  As a result, personal information controllers may need to make notification decisions while the cause and scope of an incident, and the individuals affected, are still under investigation.</div>
 
 
2. Higher Financial Exposure and New Incentives for Prevention and Response 
 
<div>Under the amended PIPA, an administrative fine of up to 10 percent of total revenue (or up to KRW 5 billion where there is no revenue or revenue is difficult to calculate) may be imposed where: (i) a controller commits the same type of violation, intentionally or through gross negligence, within three years of receiving an administrative fine for such a violation; (ii) a violation committed intentionally or through gross negligence affects 10 million or more data subjects; or (iii) a breach-related violation results from a failure to comply with a corrective order issued by the PIPC.7)  This ceiling is more than three times the general ceiling of 3 percent of total revenue. 
 
At the same time, the amended regime introduces incentives.  Fines may be reduced by up to 40 percent of the base amount for preventive investment in personal information protection, and by a further reduction of up to 40 percent for a prompt and effective post-incident response.8) 
 
Factors relevant to the investment-based reduction include the scale, proportion, and continuity of the investment; the extent to which the business owner or representative fulfills their responsibilities; the role of the Chief Privacy Officer (the “CPO”) and the structure and staffing of the privacy organization; and any additional efforts to safeguard personal information. </div>
 
 
3. Management-Level Privacy Governance 
 
<div>The amended regime also gives senior management a stronger role in privacy governance.  For certain personal information controllers, the appointment, replacement, or removal of a CPO requires board approval and must be reported to the PIPC within six months.9)  The CEO’s responsibility for the company’s personal information protection framework has also been strengthened. 
 
As a result, privacy governance is no longer solely the responsibility of a company’s privacy or information security staff.  For companies subject to the new requirements, decisions on the appointment and role of the CPO, the organization and staffing of the privacy function, and the allocation of resources to personal information protection may require involvement at the management or board level. </div>
 
 
Conclusion 
 
<div>The amended PIPA regime changes both the potential consequences of a personal information breach and the point at which a company is expected to respond.  Notification based on the possibility of a breach, a higher fine ceiling for specified serious violations, reductions for qualifying privacy investments and incident response, and stronger management-level governance requirements together make preparation for, and response to, personal information incidents more important than ever.  For foreign companies operating in Korea, the practical question is therefore not only how to respond once a breach has been confirmed, but also whether their existing privacy governance and incident response framework enables them to make the required decisions within the applicable timeframe. </div>

<div style="margin-bottom: 8px; font-size: 16px; line-height: normal; text-align: left;">1) Jin-hyeong Park, [이슈플러스] 사후 제재서 사전 예방으로…개인정보 보호 판 바뀐다 [[Issue Plus] From After-the-Fact Sanctions to Prevention: The Personal Information Protection Landscape Is Changing], Electronic Times (Sept. 9, 2026), <a href="https://www.etnews.com/20260909000263">https://www.etnews.com/20260909000263</a>.</div>

<div style="margin-bottom: 8px; font-size: 16px; line-height: normal; text-align: left;">2) Dong-sik Kang, 개인정보 유출 대가 눈덩이…과징금 1조 넘었다 [Soaring Costs of Personal Data Breaches: Fines Exceed 1 Trillion Won], Datanews (Sept. 14, 2026), <a href="https://www.datanews.co.kr/news/article.html?no=146433">https://www.datanews.co.kr/news/article.html?no=146433</a>.</div>

<div style="margin-bottom: 8px; font-size: 16px; line-height: normal; text-align: left;">4) PIPA, art. 34 para. 2 (Act No. 10465, Mar. 29, 2011, as last amended by Act No. 21445, Mar. 10, 2026) (S. Kor.); Enforcement Decree of the PIPA, arts. 39-2, 39-3 (Pres. Decree No. 30509, Mar. 3, 2020, as last amended by Pres. Decree No. 33671, Sept. 10, 2026) (S. Kor.).</div>

<div style="margin-bottom: 8px; font-size: 16px; line-height: normal; text-align: left;">5) Enforcement Decree of the PIPA, arts. 39-2, 39-3.</div>

<div style="margin-bottom: 8px; font-size: 16px; line-height: normal; text-align: left;">6) 개인정보 보호법 위반에 대한 과징금 부과기준 [Criteria for Imposing Administrative Fines for Violations of the Personal Information Protection Act], PIPC Notice No. 2026-12 (Sept. 11, 2026), art. 10 para. 1 subparas. 1, 2 (S. Kor.).</div>

<div style="margin-bottom: 8px; font-size: 16px; line-height: normal; text-align: left;">7) PIPA, arts. 64-2, paras. 1, 2. </div>

<div style="margin-bottom: 8px; font-size: 16px; line-height: normal; text-align: left;">8) PIPC Notice, supra note 6, arts. 10-3, para. 1, 10-2, para. 5.</div>

<div style="margin-bottom: 8px; font-size: 16px; line-height: normal; text-align: left;">9) PIPA, art. 31, para. 3; Enforcement Decree, art. 32, paras. 3, 4.</div>

</div>

News Jipyong Names Dong Ho YOO Vietnam Head, Joo Yeon SHIN HCMC Head 2026.02.13

GLOBAL LEGAL INSIGHT EU Foreign Investment Screening Reform: What It Means for Korean Investors in CEE 2026.10.15

Back to List

JIPYONG LLC

Related Practices

Professionals

Related Practices

Professionals

SHARE

Disclaimer

Limited Liabilities