Cybersecurity Policy Report, South Korea Seeks Comments on Data Protection Amendments, (Jun 2, 2026)

By Tony Foley

The South Korean Personal Information Protection Commission (PIPC) today said it had prepared for public comment an amendment to the Enforcement Decree of the Personal Information Protection Act (PIPA) to strengthen prevention and response to personal information breaches and provide more robust protection for the rights of citizens.

Background. Amendments to PIPA adopted in March and taking effect in September enhanced the authority and independence of chief privacy officers (CPOs) by requiring processors larger than a certain size to obtain a resolution from the board of directors and report to the PIPC when designating, changing, or revoking a CPO. They further required personal information protection certification for major personal information processors with significant impact in the public and private sectors and required that data subjects be notified without delay from the potential personal information leakage stage of an incident to ensure a rapid response.

CPO board resolution and PIPC reporting requirements. As described in the PIPC’s news release, the amendments to the Enforcement Decree are designed as a follow-up measure to the PIPA amendments. Specifically, the amendments to the Enforcement Decree establish the criteria for the obligation to obtain a board resolution and reporting to PIPC regarding CPO changes, applying these requirements to entities with annual revenue of at least 180 billion won ($11.9 million) that process the sensitive data of 50,000 people or the personal data of 1 million people, universities with 20,000 or more students, tertiary general hospitals, and operators of public information systems. Such organizations must submit a report to PIPC within one month of the date that the reporting obligation arises, subject to a potential one-month extension.

Certification requirements. With respect to the PIPA’s certification requirements, the Enforcement Decree was amended to specify the entities subject to mandatory certification, including public system operating agencies designated and notified by the PIPC, identity verification agencies, organizations with annual sales of 1 trillion won ($66 million) or more, annual sales of 10 billion won ($6.6 million) or more in the information and communications sector, and organizations with an average daily number of domestic data subjects whose personal information is stored and managed during the three months preceding the end of the previous year of 30 million or more.

Notification and reporting of personal data leakage. The amendments to the Enforcement Decree require organizations to inform data subjects within 72 hours when illegal access to a processing system is discovered or when personal information is discovered to be illegally traded or distributed. Notification is required in cases of forgery, alteration, or damage (previously, the requirement applied only to cases of loss, theft, or leakage).

Administrative fines. Finally, the Enforcement Decree was amended to establish certain criteria for imposing fines to enhance the effectiveness of sanctions. In cases where fines are waived and a warning is issued for minor violations, this is reflected in the number of times the same violation is aggravated in the future. In addition, the amount of fines per violation were revised to align with the guidelines of the Ministry of Government Legislation.

Feedback. Interested parties may submit comments on the proposed Enforcement Decree amendments by July 13 through the Citizen Participation in Legislation Center, via e-mail to the PIPC (kjy260529@korea.kr), or by regular mail.

News: InternationalLegislation DataSecurity DataBreach