Amendments to the Personal Information Protection Act Passed by National Assembly

On February 12, 2026, the National Assembly passed amendments to the Personal Information Protection Act ("PIPA") that significantly strengthen corporate obligations and liability, including raising the maximum administrative penalty to 10% of the total revenue, following approval by the Legislation and Judiciary Committee of the National Assembly on February 11, 2026. The key provisions of the amendments are summarized below.

Clarification of CEO Accountability

The amended PIPA explicitly designates the business owner or the representative of a data controller as the "ultimate person responsible for the processing and protection of personal information" and requires the owner of the representative to take comprehensive management measures, including the provision of personnel and budget to personal information protection. Additionally, for data controllers meeting criteria to be specified in the Presidential Decree of the PIPA, amended PIPA requires that the appointment and dismissal of the Chief Privacy Officer ("CPO") be approved by the board of directors and that the designation of the CPO be reported to the Personal Information Protection Commission ("PIPC").

Expanded Scope of Notification Obligations

Previously, the defined term "breach, etc." in the PIPA referred only to the "loss, theft, or leakage" of personal information. The amended PIPA expands this definition to include "forgery, alteration, or damage" of personal information. Accordingly, notification to data subjects is now required not only in cases of loss, theft, or leakage, but also in cases of forgery, alteration, or damage. Data breach reporting obligations will also apply based on such factors as the type of personal information involved, the pathway of the breach, and the scale of the incident.

Furthermore, while the pre-amendment PIPA required notification to the affected data subjects only upon learning that "a breach, etc. has occurred", the amended PIPA requires notification upon becoming aware of a "possibility of a breach, etc.", to be further defined in the Presidential Decree, taking into account such factors as the type of personal information, the impact on data subjects, and the level of risk.

Increase in Maximum Administrative Penalties

The amended PIPA raises the maximum administrative penalty from the previous 3% to 10% of the total revenue in the following circumstances: (1) if a party that has previously been subject to an administrative penalty under the PIPA violates the PIPA again within three years due to willful misconduct or gross negligence; (2) if a violation due to willful misconduct or gross negligence affects 10 million or more data subjects; or (3) if a data breach occurs due to failure to comply with a corrective order issued by the PIPC.

The amended PIPA also includes provisions allowing for reduction of administrative penalties where there is evidence of proactive investment in personal information protection, such as budget, personnel, facilities, and equipment. This amendment is intended to encourage preventive investment by companies.

The amendments will generally take effect six months after promulgation by the President. However, with respect to the increased 10% ceiling on administrative penalties: (1) for repeated violations, the higher ceiling applies only to the violations occurring after receiving an administrative penalty under the amended PIPA; (2) for violations affecting 10 million or more data subjects, the higher ceiling applies to the violations that have not been concluded as of the effective date of the amended PIPA; and (3) for failure to comply with corrective orders, the higher ceiling applies only to the corrective orders issued after the amended PIPA takes effect.

As obligations and liability for personal information protection continue to intensify, companies should take this opportunity to review their personal information processing and protection frameworks, ensure adequate budget and personnel, and develop proactive compliance strategies to mitigate legal risks.

[Korean Version]

Share

Professionals

Professionals