Amended Personal Information Protection Act (개인정보 보호법) takes effect on September 11, 2026 — notification of a possible breach within 72 hours, punitive fines of up to 10% of revenue
Source material is a Korean government announcement (in Korean).
The amended Personal Information Protection Act (개인정보 보호법) and its enforcement decree and notices took effect on September 11, 2026. Where a breach is judged reasonably likely, users must be notified within 72 hours of becoming aware of it, and repeated or large-scale breaches can draw a fine of up to 10% of total revenue.
Key facts
| Effective date | September 11, 2026 (amended Personal Information Protection Act, enforcement decree and notices) |
|---|---|
| Possible-breach notification | Where objective circumstances such as illegal system access or illegal trading of personal information make a breach reasonably likely, users must be notified within 72 hours of becoming aware of it, even before final confirmation |
| Punitive fine | Violations repeated within 3 years through intent or gross negligence, large-scale harm affecting 10 million people or more, a breach after failure to carry out a corrective order, and similar cases — up to 10% of total revenue |
| Reductions | Advance investment and strengthened protection systems allow a reduction within 40% of the base amount, with a further reduction of up to 50% taking into account the content and degree of the violation and the scale of the harm |
| Small businesses and SMEs | For minor violations, the fine can be waived where the violation is corrected with technical support |
| CPO reporting duty | Designation, change or removal must be reported within 6 months of the date the reason arose, after a board resolution — a CPO designated before the law took effect can be reported within 6 months of the effective date without a board resolution |
| Guidance period | Until December 31, 2027 |
| Inquiries | Personal Information Protection Policy Division, Personal Information Protection Commission (개인정보보호위원회 개인정보보호정책과) 02-2100-3057 |
Last checked:
The Personal Information Protection Commission (개인정보보호위원회) said on September 10, 2026 that the amended Personal Information Protection Act (개인정보 보호법) and its enforcement decree and notices take effect on September 11, 2026. Where a violation is repeated within 3 years through intent or gross negligence, where large-scale harm affecting 10 million people or more occurs, or where a personal information breach occurs because a corrective order was not carried out, a fine of up to 10% of total revenue can be imposed. Efforts to invest in advance in personal information protection and to strengthen protection systems can reduce the fine within 40% of the base amount, and a further reduction of up to 50% is possible taking into account the content and degree of the violation and the scale of the harm. For minor violations by small businesses and SMEs, the fine can be waived where the violation is corrected with technical support. When a chief privacy officer (CPO, 개인정보 보호책임자) is designated, changed or removed, the decision must go through a board resolution and be reported to the commission within 6 months of the date the reason arose; a CPO designated before the law took effect can be reported within 6 months of the effective date without a separate board resolution. The commission will run a guidance period until December 31, 2027. In addition, a possible-breach notification system has been introduced: where objective circumstances such as illegal system access or illegal trading of personal information make a breach reasonably likely, users must be notified within 72 hours of becoming aware of it, even before the breach is finally confirmed.
Summaries below are factual notes based on government announcements and primary sources — not evaluations or opinions.
FAQ
When will I be contacted if my information may have been breached?
Where objective circumstances such as illegal system access or illegal trading of personal information make a breach reasonably likely, users must be notified within 72 hours of becoming aware of it, even before the breach is finally confirmed.
In which cases is a fine of 10% of revenue imposed?
Up to 10% of total revenue can be imposed where a violation is repeated within 3 years through intent or gross negligence, where large-scale harm affecting 10 million people or more occurs, or where a personal information breach occurs because a corrective order was not carried out.
Is notification required whenever a security vulnerability is found?
Notification is not required merely because a security vulnerability was found or because there is a vague possibility of a breach; objective circumstances giving rise to suspicion are required.