Cybersecurity Policy Report, South Korea’s Privacy Regulator Modifies Fine Calculation Policy, (May 18, 2026)

By Tony Foley

The South Korean Personal Information Protection Commission (PIPC) has adopted amendments to the Enforcement Decree of the Personal Data Protection Act (PIPA) and the Standards for Imposing Fines for Violations of the Personal Information Protection Act that are aimed at enhancing the effectiveness and appropriateness of fine imposition decisions concerning PIPA violations.

In a press release today announcing the changes, which will take effect tomorrow, PIPC said the amendments would strengthen the criteria for calculating sales revenue used as a basis for imposing fines in light of repeated large-scale personal information leaks, as well as to enable stricter sanctions for very serious violations.

Specifically, PIPC said the current version of the Enforcement Decree calculated fines based on the annual average sales of the three fiscal years immediately preceding the fiscal year in which the violation occurred. The agency modified this formula to provide that a penalty is calculated based on the larger of the annual sales revenue of the previous fiscal year and the annual average sales of the three previous fiscal years. In this manner, PIPC said, the modification will ensure that for companies with increasing sales, penalties will be calculated based on an appropriate sales figure.

With respect to fines related to very serious violations, PIPC said it had established a basis in the Standards for Imposing Fines for Violations of the Personal Information Protection Act to exclude any reduction in such cases, positing that current criteria allowing for such reductions even in cases involving serious violations lowered the effectiveness of sanctions and weakened the incentives for companies to avoid violations.

“This amendment to the Enforcement Decree and [Standards] is intended to enhance the effectiveness and accountability of sanctions against companies for violating the law,” PIPC said. “We will respond more strictly to serious personal information infringements by imposing fines corresponding to the company’s current economic capacity and the severity of the violation.”

News: InternationalLegislation LitigationEnforcement DataPrivacy DataSecurity DataBreach