1.

Strengthening the Effectiveness of Administrative Penalties
 

(1)

Detailed Standards and Procedures for Calculating Administrative Penalties

The Amended PIPA provides that administrative penalties of up to 10% of total revenue may be imposed for repeated or serious violations (Article 64-2(2)). The Proposed Amendments set out detailed standards and procedures for calculating and imposing such penalties (Article 60-2 and Annex 1-5).
 

• Calculation procedure: The PIPC will determine a “base amount” by multiplying the revenue related to the violation (i.e., total revenue minus revenue unrelated to the violation) by a rate reflecting the severity of the violation (the "base rate"). Under the Proposed Amendments, the base amount may be increased in certain cases, after which further adjustments (increases or reductions) will be applied to determine the final penalty.

(2)

New Reduction Mechanism for Privacy-Protection Investments

The Amended PIPA allows for reductions in administrative penalties where “grounds prescribed by Presidential Decree” exist, including investments in and operation of budget, personnel, facilities, and equipment for personal information protection (Article 64-2(6)). The Proposed Amendments require that such reductions be applied to the base amount prior to first- and second-stage adjustments, and set out detailed criteria, thresholds, and limits (Articles 60-2(5) and (7) and Annex 1-5).
 

• Factors considered: In applying reductions based on privacy protection investments, the PIPC will consider: (i) the scale and continuity of investments in budget, personnel, facilities, and equipment; (ii) the substance and effectiveness of the data controller's privacy protection framework, including the roles of the business owner or representative and the Chief Privacy Officer (CPO), organizational structure, and staffing; and (iii) additional efforts to enhance personal information security measures.

• Ceiling and conditions: Reductions may not exceed 40% of the base amount. No reduction is available where the violation was willful or grossly negligent.
   

In addition, with respect to grounds for not imposing penalties under the Amended PIPA (Article 64-2(7)(4)), the Proposed Amendments provide that penalties may be waived where no harm has occurred to data subjects (or any harm is minor), the data controller has remedied the violation (including through technical assistance in the case of SMEs and small businesses), and the criteria set forth in PIPC guidelines are satisfied (Article 60-2(6)).
 

2.

Strengthening Prevention of and Response to Data Breaches
 

(1)

Board Resolution and PIPC Reporting for CPO Designations

The Amended PIPA requires certain data controllers to obtain board approval for the designation, change, or removal of a CPO and to report such actions to the PIPC (Article 31). The Proposed Amendments specify the entities subject to these requirements and the applicable procedures (Article 32).
 

• Scope of application: These obligations apply to the following entities (aligned with those required to designate a qualified CPO):

• Procedures and methods: Reports must be submitted to the PIPC within one month from the date the reporting obligation arises, with a possible extension of up to one additional month where unavoidable circumstances exist.
   

(2)

Mandatory ISMS-P Certification

The Amended PIPA requires major data controllers with significant impact to obtain personal information protection certification (ISMS-P certification) on a mandatory basis (Article 32-2). The Proposed Amendments define the entities subject to this requirement (Article 34-9).
 

• Scope of application: ISMS-P certification is mandatory for: (i) operators of major public systems designated by the PIPC; (ii) mobile telecommunications carriers; (iii) identity verification agencies; and (iv) entities with prior-year total revenue of at least KRW 1 trillion and at least KRW 10 billion in revenue from information and communications services, where the average daily number of domestic data subjects whose personal information was stored or managed during the three months preceding the end of the prior year was 30 million or more.

• Deadline: Entities subject to mandatory certification must obtain ISMS-P certification by December 31, 2028 (Supplementary Provisions, Article 3).
   

(3)

Changes to Data Breach Notification and Reporting Requirements

The Amended PIPA requires data controllers to notify data subjects without delay not only upon becoming aware of a data breach, but also upon recognizing a likelihood of a breach (Article 34). The Proposed Amendments elaborate on notification requirements, timing, and content (Articles 30-2, 39, 39-2, 40, and 48-7).
 

• Notification requirements and timing: Notifications must be made at early stages where a likelihood of breach is identified. Specifically:
  (i) Where a data controller becomes aware of unauthorized access to its personal information processing systems or devices used by personnel, and objective circumstances indicate that personal information may have been breached, notification must be made within 72 hours of awareness, even if affected data subjects cannot yet be identified.
  (ii) Where it is objectively confirmed that personal information is being unlawfully traded or distributed, and there is a high likelihood that additional data subjects beyond those already identified are affected, notification must be made within 72 hours of awareness.

• Content of notifications: Notifications and reports must cover not only cases where personal information has been lost, stolen, or leaked, but also where it has been forged, altered, or damaged.

The Proposed Amendments also revise penalty standards so that cases resulting only in corrective orders or warnings (without monetary penalties) will be treated as prior violations, thereby increasing penalties for repeat offenses. Penalty amounts for individual violations have also been increased (Article 63 and Annex 2).