South Korea Data Protection & Privacy Regulation

Controller/Processor Duties

An amendment to the Act on Promotion of Information and Communications Network Utilization and Information Protection, promulgated 31 March 2026 and effective 1 October 2026, imposes a distinct set of obligations on covered information and communications technology and telecommunications-sector controllers. It is understood to require the designation of an executive-level Chief Information Security Officer and to introduce a 24-hour incident-reporting deadline, backed by turnover-based fines of up to 3% for repeated incidents. This operates alongside, rather than in place of, the Personal Information Protection Act's existing general duty to report to the regulator within 72 hours where personal information of 1,000 or more data subjects has been leaked, or where sensitive or unique-identification information has been leaked. The practical effect for covered sector controllers is two overlapping but procedurally distinct reporting clocks running from the same incident, one triggered under general data-protection law and a materially faster one under the sector-specific network-security regime.

Outlook

Covered ICT and telecommunications entities face a tightened compliance calendar from 1 October 2026 onward, with the shorter 24-hour window and the named executive-liability design of the CISO role likely to shape how quickly and how formally incidents are escalated internally. How the two notification regimes are reconciled in practice — and whether the faster Network Act clock becomes the de facto operating standard across the sector — is the development to track.

Controller/Processor Duties

South Korean controller and processor obligations are under active scrutiny following an ongoing wave of AI-assisted banking breaches. The Personal Information Protection Commission's Chair, Song Kyoung-hee, acknowledged during an audit on 13 October 2026 that security systems at Korean financial institutions lag considerably, a statement made amid the live breach wave that reportedly prompted a presidential-level investigation order on 4 October 2026. Separately, a Network Act amendment effective 1 October 2026 introduced a 24-hour incident-reporting deadline for in-scope online and network service providers, alongside government investigation powers that can be exercised without the company having filed a prior report. This 24-hour deadline operates in parallel with, and is understood to partially overlap with, PIPA's own breach-notification regime, creating a dual-track compliance obligation for providers that fall within scope of both instruments.

Outlook

How the dual-track reporting obligation under the Network Act and PIPA is applied in practice to entities implicated in the current banking-breach wave will clarify the practical compliance burden facing in-scope providers, and the PIPC Chair's acknowledgment of sectoral security shortcomings suggests continued regulatory attention to controller-side security obligations in the near term.

Controller/Processor Duties

Core security-governance and breach-notification obligations under the Network Act amendment (Act No. 21500) entered into force on 1 October 2026. Internet service providers must now notify affected users within 24 hours of discovering a cybersecurity breach involving personal information — a materially shorter window than typical breach-notification standards in other jurisdictions. The same amendment grants government investigation powers exercisable without requiring a prior company report, meaning authorities can initiate an investigation into a suspected breach independently of whether the affected company has self-reported.

Alongside the notification obligation, mid-sized and larger information-and-communications service providers must appoint an executive-level Chief Information Security Officer and establish a CISO-chaired information-security committee. Newly captured providers — those brought within scope for the first time — receive a six-month grace period before these governance requirements bind them. Repeat or grossly negligent security incidents under this regime carry fines of up to 3% of related revenue, a penalty structure distinct from, and in addition to, the PIPA-level fine tiers.

In parallel, the PIPC opened a public-comment period, running from 16 September 2026 to 26 October 2026, on proposed amendments to the PIPA Enforcement Decree intended to strengthen ISMS-P certification and audit requirements. This consultation is live during the current period and precedes the later, separately commencing mandatory ISMS-P certification provision under Act No. 21445, due 1 July 2027. Together, the Network Act's now-effective governance obligations and the PIPC's live ISMS-P consultation represent a controller/processor duties landscape that is tightening on both the incident-response and the certification-infrastructure fronts simultaneously.

Outlook

Whether the ISMS-P Enforcement Decree consultation, closing 26 October 2026, will change DPO or CPO board-reporting thresholds is not yet resolved. The six-month grace period for newly captured providers under the Network Act's CISO and committee requirements means some firms will face a phased rather than immediate compliance deadline, even though the core obligations are already in force for providers already within scope.

Controller/Processor Duties

A draft PIPA Enforcement Decree amendment proposes that organisations with annual revenue of at least KRW180 billion, approximately $131 million, processing sensitive data of 50,000 or more people or personal data of 1,000,000 or more people, and universities with 20,000 or more students, must obtain board approval and notify the Personal Information Protection Commission on the appointment, change or removal of a Chief Privacy Officer. This duty remains at the draft stage: the final enacted text and its in-force date were not located this cycle, so the obligation is understood to be proposed rather than binding at this point.

The same draft Enforcement Decree amendment mandates that certain entities obtain ISMS-P certification by 31 December 2028. A further, separate amendment strengthening ISMS-P audit requirements opened for public comment from 16 September to 26 October 2026, indicating that the certification regime itself is still being refined even as its outer deadline is fixed.

Separately, the March 2026 PIPA amendment package strengthens breach-notification rules and prevention of personal-data leaks, effective 11 September 2026. The specific notification deadline and the recipient-threshold detail for this strengthened rule were not located this cycle, so the precise operative mechanics of the new breach-notification duty cannot yet be stated with confidence.

Outlook

The ISMS-P audit-strengthening consultation closes 26 October 2026, and its outcome will determine the final shape of the audit regime underlying the 31 December 2028 certification deadline. Whether the draft CPO governance provisions are finalised, and with what in-force date, remains the principal open item for this module; until the final Enforcement Decree text is located, affected organisations face confirmed deadline pressure on ISMS-P certification without full clarity on the governance-notification mechanics that will accompany it.

Cross-Border & Adequacy

On 8 October 2026 the Personal Information Protection Commission initiated an Equivalence Recognition Review of the United Kingdom under Article 28-8(1)(5) of the Personal Information Protection Act. This is the mechanism that, where equivalence is recognised, permits cross-border transfer of personal data from Korea to the reviewed jurisdiction without separate data-subject consent. The review's outcome and timeline are not yet known as at the date of this review's opening.

This development follows the PIPC's earlier equivalence recognition of the European Union, formalised in Announcement No. 2025-68 on 16 September 2025 under the same Article 28-8(1)(5) mechanism. That EU recognition excludes resident registration numbers and personal credit information from its scope — meaning even where equivalence is recognised, certain categories of especially sensitive Korean-specific data remain outside the consent-free transfer mechanism — and is itself subject to a PIPC-initiated review beginning three months before its 15 September 2028 anniversary. The EU recognition's bounded scope and built-in future-review structure provides the template against which the newly opened UK review is likely to be assessed and against which its eventual terms, if equivalence is recognised, might be structured.

The sequencing here — EU recognition completed, UK review now opened — indicates the PIPC is actively expanding its network of consent-free cross-border transfer partners rather than treating the EU arrangement as an isolated exception. This is a structurally significant signal for any organisation relying on Korea-to-UK personal-data flows, since the current legal basis for such transfers, absent a recognised equivalence determination, would need to rest on other PIPA cross-border transfer mechanisms such as consent or contractual safeguards.

Outlook

The timeline for the PIPC's UK equivalence review to conclude is not yet established. Given the EU recognition took the form of a formal PIPC announcement following its own review process, a similarly structured outcome — recognition, non-recognition, or recognition with specific exclusions analogous to the EU's resident-registration-number and credit-information carve-outs — is a plausible structural outcome for the UK review, though its specific terms cannot be anticipated from the current record.

Sectoral Watch

The principal sector-specific development in the period is the Network Act overhaul applying to information and communications technology and telecommunications operators: an amendment promulgated 31 March 2026 and effective 1 October 2026 that is understood to layer a mandatory executive-level Chief Information Security Officer designation, a 24-hour incident-reporting deadline, and turnover-based fines of up to 3% for repeated incidents onto this sector specifically, distinct from the general data-protection breach-notification regime applicable across other industries. The financial sector also features prominently in current enforcement activity, with the Commission's fine against Kakao Pay and its order compelling Alipay to delete both transferred personal data and a credit-scoring model built on it illustrating active regulatory attention to cross-border data flows in payments and consumer-finance services.

Outlook

Telecommunications and ICT operators are the clearest sectoral focus for the immediate period given the 1 October 2026 effective date of the Network Act changes, while financial-services and payments platforms should expect continued scrutiny of cross-border data-sharing arrangements of the kind seen in the Kakao Pay and Alipay matter.

Sectoral Watch

The financial sector is the focus of sectoral attention in South Korea. The Financial Services Commission ordered banks and credit-card issuers to carry out sweeping security reviews on 13 October 2026, following cyberattacks on Shinhan Bank and KB Kookmin Bank. This FSC-led security-review order operates alongside the Personal Information Protection Commission's own data-breach jurisdiction over the same incidents, meaning the same underlying breach events are subject to parallel attention from both the financial-sector regulator and the data-protection regulator.

Outlook

The coexistence of FSC-led financial-sector security requirements and PIPC-led data-breach jurisdiction over the same incidents will be worth watching for signs of coordinated or divergent regulatory outcomes as the current banking-breach wave is resolved.

Sectoral Watch

The financial sector is the focus of sectoral attention this cycle in South Korea. The Financial Services Commission ordered banks and credit-card issuers to carry out sweeping security reviews on 13 October 2026, following cyberattacks on Shinhan Bank and KB Kookmin Bank. This FSC-led security-review order operates alongside the Personal Information Protection Commission's own data-breach jurisdiction over the same incidents, meaning the same underlying breach events are subject to parallel attention from both the financial-sector regulator and the data-protection regulator.

Outlook

The coexistence of FSC-led financial-sector security requirements and PIPC-led data-breach jurisdiction over the same incidents will be worth watching for signs of coordinated or divergent regulatory outcomes as the current banking-breach wave is resolved.

Algorithmic, Biometric & Surveillance Governance

The Commission's action against Kakao Pay and Alipay is the notable development in this area: the Commission is reported to have fined Kakao Pay KRW 5.97 billion for the unlawful transfer of personal data to Alipay, and separately to have ordered Alipay to destroy a model used to calculate Non-Sufficient Funds scores that had been built using personal information obtained without valid consent. The Commission's own notice frames this as a correction order requiring destruction of the scoring model itself, not merely cessation of its use or deletion of the underlying data, which extends the remedy beyond a conventional data-deletion order into the algorithmic artifact built from the unlawfully obtained information.

Outlook

This order is a precedent worth tracking closely: a regulator compelling destruction of a trained scoring model, rather than confining its remedy to the input data, signals that algorithmic systems built on non-compliant data collection may themselves be treated as unlawful artifacts subject to disgorgement-style correction. Whether the Commission applies this model-deletion approach in future cases involving other automated credit or risk-scoring tools will be a key indicator of how far this precedent extends.

Enforcement & Redress

Korea's data-protection enforcement regime has escalated sharply in both statutory reach and practical activity. The PIPA amendment passed by the National Assembly's plenary session on 20 August 2026, promulgated 10 March 2026 and effective 11 September 2026, raises the maximum administrative fine for aggravated cases from 3% to 10% of total revenue, applying where violations are repeated and intentional or grossly negligent, where a breach affects ten million or more people, or where a controller disregards a corrective order. This sits against a backdrop of record active cases: a KRW 134.8 billion fine against SK Telecom following an April data-breach incident, now under challenge; an open Commission investigation into Coupang over a breach affecting 33.7 million users, with a potential fine reported to approach KRW 1 trillion; a KRW 5.97 billion fine against Kakao Pay tied to unlawful data transfer to Alipay, paired with a correction order requiring destruction of a scoring model built on that data; and a fine against TikTok Pte in July 2026 connected to domestic-representative non-compliance. There is also a single, more tentative report that access logs relevant to the Coupang investigation may have been deleted during the course of the Commission's fourteen-investigator inquiry; this should be treated as an unverified allegation rather than an established finding pending stronger corroboration.

Outlook

The combination of a tenfold increase in the top-end fine ceiling with several concurrent large-scale investigations suggests the Commission is positioning itself for a period of markedly higher-stakes enforcement than in prior years. The outcomes of the SK Telecom appeal and the Coupang investigation will be the clearest signals of whether the Commission is prepared to use the new 10% ceiling at the scale the statute now permits, and whether allegations of evidence-handling issues in the Coupang matter develop into a separate point of scrutiny on the Commission's own investigative conduct.

Enforcement & Redress

South Korea's data protection enforcement regime has recently undergone a material increase in maximum financial exposure. A National Assembly amendment adopted on 12 February 2026, effective from 11 September 2026, raised the PIPA administrative-fine ceiling from 3% to 10% of total turnover for high-severity violations; the 10% ceiling applies only where intent or gross negligence is found together with an aggravating factor. That newly raised ceiling now faces its first substantial live test amid the ongoing AI-assisted banking-breach wave, with the Personal Information Protection Commission's Chair having acknowledged security shortcomings at financial institutions during an audit on 13 October 2026. The enforcement decree accompanying PIPA is reported to allow companies that demonstrate strong compliance investment to reduce an assessed fine by up to 40%, offering a mitigation pathway alongside the higher headline ceiling. The enforcement history also includes a Personal Information Protection Commission fine against Coupang of KRW624.6 billion ($400 million), issued 10 June 2026 over a 2025 data breach; reported figures for the number of affected users vary between approximately 37.5 million in one account and a combination of roughly 33.2 million registered members plus over 4.3 million non-member data subjects in another, a discrepancy not reconciled against the Commission's own decision text.

Outlook

The first application, if any, of the new 10% turnover-based fine ceiling to an entity connected to the current banking-breach wave will be the clearest indicator yet of how the Commission intends to use its expanded penalty power, particularly set against the Chair's own public acknowledgment of sectoral security shortcomings.

Enforcement & Redress

South Korea's data protection enforcement regime has recently undergone a material increase in maximum financial exposure. A National Assembly amendment adopted on 12 February 2026, effective from 11 September 2026, raised the PIPA administrative-fine ceiling from 3% to 10% of total turnover for high-severity violations; the 10% ceiling applies only where intent or gross negligence is found together with an aggravating factor. That newly raised ceiling now faces its first substantial live test amid the ongoing AI-assisted banking-breach wave, with the Personal Information Protection Commission's Chair having acknowledged security shortcomings at financial institutions during an audit on 13 October 2026. The enforcement decree accompanying PIPA is reported to allow companies that demonstrate strong compliance investment to reduce an assessed fine by up to 40%, offering a mitigation pathway alongside the higher headline ceiling. This cycle's enforcement history also includes a Personal Information Protection Commission fine against Coupang of KRW624.6 billion ($400 million), issued 10 June 2026 over a 2025 data breach; reported figures for the number of affected users vary between approximately 37.5 million in one account and a combination of roughly 33.2 million registered members plus over 4.3 million non-member data subjects in another, a discrepancy not reconciled against the Commission's own decision text this cycle.

Outlook

The first application, if any, of the new 10% turnover-based fine ceiling to an entity connected to the current banking-breach wave will be the clearest indicator yet of how the Commission intends to use its expanded penalty power, particularly set against the Chair's own public acknowledgment of sectoral security shortcomings.

Enforcement & Redress

The Personal Information Protection Act's new Article 64-2(2), introduced by Act No. 21445 and in force since 11 September 2026, permits the Personal Information Protection Commission to impose a fine of up to 10% of a company's total annual revenue where a violation repeats the same category within three years of a prior fine and is intentional or grossly negligent. This operates in addition to the general 3%-of-relevant-revenue cap under Article 64-2(1), giving the PIPC a materially more severe penalty tier available for repeat or egregious non-compliance than existed previously.

This new fine tier enters force against a backdrop of what is, on current record, the PIPC's most active enforcement year to date. On 11 June 2026 the PIPC fined Coupang KRW 624.68 billion — approximately US$409 million — the largest PIPA fine to date, comprising approximately KRW 423.6 billion for an underlying data breach, approximately KRW 201.1 billion for covertly collecting third-party browsing data of approximately 11.2 million users via its affiliate-marketing programme, and a smaller late-notification fine. While the Coupang fine itself predates the current period, it establishes the scale of penalty the PIPC is willing to impose under the pre-existing framework, immediately before the 10%-of-revenue tier took effect.

Read together, the Coupang precedent and the newly effective 10%-of-revenue tier indicate that any controller with a repeat compliance failure following a prior PIPC fine now faces a materially higher potential penalty ceiling than at any point before 11 September 2026. The combination of a demonstrated willingness to impose fines at the hundreds-of-billions-of-won scale and a new statutory tier specifically targeting repeat violations represents a structural escalation in the PIPC's enforcement posture, not merely an isolated large fine.

Outlook

Controllers that have previously been fined by the PIPC now face a materially elevated risk profile for any subsequent violation within the same three-year, same-category window, given the 10%-of-revenue tier's availability. Whether the PIPC applies this new tier in a forthcoming enforcement action, and against what kind of repeat violation, is the next material development to watch in this module.

Enforcement & Redress

For repeated, intentional or grossly negligent data leaks, the maximum administrative fine rises from 3 percent to 10 percent of the controller's total revenue, not profit, effective 11 September 2026; the pre-existing 3 percent ceiling remains the baseline for standard violations. This is a confirmed, core penalty-escalation provision of the March 2026 amendment package, and it represents a more than threefold increase in the maximum exposure facing a controller found to have committed the most serious category of data-leak violation.

Separately, the Personal Information Protection Commission fined NCRC KRW885.2 million for data breaches caused by inadequate security measures and multiple violations of the Personal Information Protection Act. The decision date and the specific breached provision underlying this fine were not located this cycle; the finding rests on a jurisdiction news-feed headline rather than a located decision document.

Outlook

The 11 September 2026 commencement of the tenfold punitive-fine ceiling increase is the defining enforcement-exposure development for South Korea this cycle. Organisations handling personal data at scale face materially higher maximum exposure for the most serious category of leak from that date forward. Whether further enforcement decisions of the scale of the NCRC fine follow, and whether their decision documents become locatable at primary source, remains to be seen.