The amended Personal Information Protection Act (the “PIPA”) and its Enforcement Decree (the “Enforcement Decree”) took effect on September 11, 2026, amid a rise in both the frequency and the impact of personal data breaches. The number of reported personal data breaches rose from 163 in 2021 to 447 in 2025. The financial consequences of serious violations have also grown substantially. Since the Personal Information Protection Commission (the “PIPC”) was established in August 2020, twelve cases have resulted in administrative fines of KRW 10 billion or more, totaling approximately KRW 1.02 trillion. Eight of those cases have occurred since 2025, accounting for approximately 86.6 percent of the total amount.

Against this backdrop, the amended regime increases the potential financial exposure for serious violations and requires personal information controllers to respond at an earlier stage of a potential breach. In doing so, it places greater emphasis on preventive investment, privacy governance, and management-level responsibility.