The amendment to Korea’s Personal Information Protection Act (the “Amendment”) is expected to take effect on September 11, 2026.

Companies should take note that the Amendment is intended to elevate the responsibility for personal information protection from a matter handled primarily by the Chief Privacy Officer (“CPO”) to a matter requiring oversight at the level of the board of directors (“BOD”).  This may have implications on the scope of potential liability of the directors under the Korean Commercial Act.