1.

Data Controllers Subject to the Obligation

Under the Amended PIPA, the data controllers that must designate, change, or remove a CPO by board resolution and report the same to the PIPC are the following:
 

• Data controllers with annual revenue exceeding KRW 180 billion that (i) process the sensitive information or unique identification information of at least 50,000 data subjects or (ii) process the personal information of at least 1 million data subjects;

• Schools under Article 2 of the Higher Education Act with 20,000 or more enrolled students as of the end of the preceding year;

• Tertiary general hospitals under Article 3-4 of the Medical Services Act; or

• Public system operating institutions.

For reference, the Guide states that the number of data subjects under these thresholds is not limited to customers, but also includes officers and employees, and that, if a single company operates multiple services, the number of data subjects processed in connection with each service is aggregated to determine whether a threshold is met.
 

2.

Details of the Obligation

A data controller within the scope described above must obtain a board resolution when it designates, changes, or removes a CPO.
 

• The Guide explains that there is no particular restriction on the method or timing of the board resolution and that a corporation whose governance structure does not includes a board of directors needs not obtain a board resolution, but in that case, it must submit a supporting document evidencing the absence of a board.

Matters concerning the designation, change, or removal of a CPO must be reported to the PIPC within six months from the date on which the relevant cause arises.
 

• The report is filed online through the website operated by the PIPC, and the reporting data controller should note that documents evidencing the board resolution and documents proving the CPO's satisfaction of the qualification requirements must be submitted together with the report.

• A data controller that already designated a CPO before the Amended PIPA took effect does not need to obtain a board resolution for that past designation, but must still file the report with the PIPC within six months from the effective date, September 11, 2026.

• The Guide further explains that when there is a temporal gap between a CPO's resignation and the designation of a successor, the six-month reporting period is calculated separately from the date on which each cause arose. If a successor CPO can be designated within six months of the resignation, the removal and the designation can be reported simultaneously.

3.

Administrative Fines and Grace Period

A violation of the resolution and reporting obligations may be subject to an administrative fine of up to KRW 30 million. The PIPC stated, however, that in order to ease the burden on the affected entities arising from the introduction of this new system and to promote its stable implementation, it will operate a grace period until December 31, 2027, during which it will not impose administrative fines for violations such as failure to designate a CPO, failure to meet the CPO qualification requirements, violation of the board resolution obligation, and delay in reporting a designation, change, or removal.
 

4.

Implications and Next Steps

Data controllers subject to this obligation should review their internal procedures and rules so that the obligations arising from the designation, change, and removal of a CPO can be performed in a timely manner.