CookieGate
Start free trial

Korea’s amended PIPA: 10 percent fines, CEO accountability and earlier breach notice

5 min read By Comply Ark

In this post

What changed on 11 September

South Korea’s amended Personal Information Protection Act (PIPA), Act No. 21445, took effect on 11 September 2026. The National Assembly passed it on 12 February 2026 and it was promulgated on 10 March 2026. Amendments to the Enforcement Decree and the Personal Information Protection Commission’s (PIPC) revised fine standards took effect alongside it.

Three changes matter most. Aggravated violations can now be fined up to 10 percent of revenue rather than 3 percent. The business owner or representative director is named in the statute as ultimately responsible for data protection. And breach notification now covers more incident types and can be triggered before a leak is confirmed.

The new 10 percent tier

Article 64-2(1) keeps the ordinary ceiling at 3 percent of total revenue, or KRW 2 billion where revenue is absent or cannot be calculated. The new Article 64-2(2) raises the ceiling to 10 percent of total revenue, or KRW 5 billion in the no-revenue case, in three situations:

  1. the company repeats a violation of the same type within three years of an earlier fine, with intent or gross negligence;
  2. a violation committed with intent or gross negligence harms 10 million or more data subjects; or
  3. the company fails to comply with a PIPC corrective order and a breach follows.

One detail is easy to miss in English-language coverage. Article 64-2(3) directs the PIPC to calculate both the 3 percent and the 10 percent fines on total revenue minus revenue unrelated to the violation. The 10 percent tier raises the percentage. It does not switch the base to the whole group’s turnover. That is a real difference from GDPR Article 83, which caps fines at a percentage of total worldwide annual turnover with no such exclusion.

The PIPC’s June 2026 decision against Coupang shows how much the base matters. It fined the company about KRW 624.7 billion over a breach affecting roughly 37.5 million people, calculated on e-commerce revenue only, with Coupang Eats and Coupang Play excluded. That decision was made under the old 3 percent ceiling, before the amendment took effect.

Investment now reduces fines

The amendment also directs the PIPC to reduce a fine where the company has invested in privacy protection, through budget, staffing, facilities or equipment, unless the violation was intentional or grossly negligent. Under the revised Enforcement Decree and PIPC fine standards, this reduction can reach 40 percent of the base amount. The factors weighed include the scale and continuity of the investment, how the representative has discharged their responsibility, and how the Chief Privacy Officer (CPO) function is organised.

In practice, a documented privacy budget and an empowered CPO are now direct inputs to the fine calculation, not just good governance.

The CEO and the board

The new Article 30-3 makes the business owner or representative the person with final responsibility for the safe processing of personal data and the protection of data subjects’ rights, and requires them to put in place overall management measures such as staffing and budget. Public summaries of the amendment do not describe a separate personal penalty attached to this duty. Its practical weight comes through the fine-reduction factors above and through the CPO rules.

Under amended Article 31, larger companies must have the board resolve on the appointment, change or dismissal of the CPO, and report it to the PIPC. According to law-firm briefings on the Enforcement Decree, this applies to companies with annual revenue above KRW 180 billion that process sensitive or unique identifying information of 50,000 or more people, or personal information of 1 million or more people, as well as to large universities, tertiary hospitals and certain public system operators.

Breach notification starts earlier

The definition of a reportable incident now covers forgery, alteration and damage alongside loss, theft and leakage. A new notification duty in Article 34(2) applies once a company becomes aware that a leak is possible, for example after unauthorised access to a system where the affected individuals cannot yet be identified. Law-firm briefings describe a 72-hour window for this notice under the Enforcement Decree, followed by a final notice once the facts are established. The duty to report to the regulator has moved from Article 34(3) to Article 34(4).

Why this matters beyond breaches

PIPA treats data collected through cookies and other tracking technologies as personal information when it is identifiable, and the PIPC has used that power. In September 2022 it fined Google KRW 69.2 billion and Meta KRW 30.8 billion for collecting behavioural data from third-party websites and apps for targeted advertising without valid consent.

The new tier does not change the ordinary exposure for a single consent failure, which remains under the 3 percent ceiling. It does mean that ignoring a PIPC corrective order, or letting the same violation recur, can now move a company into the 10 percent tier. For organisations already running GDPR- or DPDPA-grade compliance programmes, the operative lesson is documentation: record what you invest in privacy, how the CPO is appointed and resourced, and how quickly you can notify on a suspected incident. Under the amended PIPA, all three now feed directly into the fine.

As of this post, we have not seen the PIPC impose a fine under the new 10 percent tier. Companies with Korean users should confirm scope with Korean counsel.

Sources

enforcementfinesbreach-notificationgovernance

Comply Ark Regulatory infrastructure company. Builds CookieGate.

If this applies to your site.

CookieGate holds non-essential tags until the visitor decides, resolves the right law by location, and prints a receipt per decision.

Start free trial

15 days. Card required. Nothing is charged before day 15.

How CookieGate handles each regulation