Cybersecurity Policy Report, South Korean Agency Faces Fine After Leaks of Kids’ Personal Data, (Aug 31, 2026)

By Tony Foley

The South Korean Personal Information Protection Commission (PIPC) has fined the National Center for the Rights of the Child (NCRC) 885.2 million won ($646,500) after the NCRC suffered three security incidents leading to the leakage of 1.17 million pieces of personal data.

In a Thursday press release, the PIPC said the NCRC underwent a process between 2013 and 2022 in which it converted previously print-based adoption records and missing children admission cards into Excel data and scanned files. The computerization project was conducted by a third-party vendor that stored the files on external media. During an internal inspection of allegations of mismanagement in the project, the NCRC discovered that the auxiliary storage media containing personal information had disappeared.

The PIPC’s subsequent investigation revealed that the NCRC stored the media in office cabinets or drawers, while managing the designation of a responsible manager and the creation of an intake and exit log, among other measures. The investigation further found that NCRC neglected to implement physical safety measures required under the Personal Information Protection Act (PIPA) and thus were unable to answer for the specific timing and route of the data leaks.

In addition, the PIPC found that, because there was no institution-level personal information management system in place, private information like resident registration numbers stored on the auxiliary media were not encrypted. Finally, the PIPC held that the NCRC failed to provide proper notification and reporting of the cyber incidents even after they became aware of them.

In addition to the fine, the PIPC issued a corrective order and a disciplinary recommendation, as well as requiring the publication of the results of its disposition.

News: InternationalLegislation LitigationEnforcement DataSecurity DataBreach