닫기

Resources

Publications

Amendments to the Personal Information Protection Act, Its Enforcement Decree, and the Network Act

2026.04.10.

In our previous Legal Update, we introduced the key provisions of numerous proposed amendments to the Personal Information Protection Act (the “PIPA”) and the Act on Promotion of Information and Communications Network Utilization and Information Protection (the “Network Act”), which were introduced in response to recent high-profile personal data breaches and security incidents. 

Among these, the amendment to the PIPA was promulgated as Act No. 21445 on March 10, 2026, and is scheduled to take effect on September 11, 2026 (however, the provisions mandating ISMS-P will take effect on July 1, 2027) (hereinafter the “Amended PIPA”). In addition, on March 16, 2026, the Personal Information Protection Commission announced a draft amendment to the Enforcement Decree of the Personal Information Protection Act (hereinafter the “Amended Enforcement Decree”) to revise provisions regarding revenue calculation for the imposition of administrative fines and reduction of such fines, which is scheduled to take effect on the date of promulgation.

Meanwhile, the amendment to the Network Act (Bill No. 14896) passed the plenary session on March 12, 2026, was approved by the State Council on March 24, 2026, and was promulgated on March 31, 2026 (hereinafter the “Amended Network Act”), and will take effect on October 1, 2026 (however, the information security level assessment system will take effect on April 1, 2027). The main provisions of this amendment include expanding the responsibilities of the Chief Information Security Officer (“CISO”), establishing a system of administrative fines for data breaches, and strengthening regulations on transmission of commercial information (illegal spam).

Below, we will summarize the strengthened provisions regarding (i) management systems and (ii) incident response mechanisms under the amended PIPA and the amended Network Act, which are scheduled to take effect as described above. Additionally, regarding (iii) the strengthening of sanctions, such as administrative fines, we will provide guidance that includes details specified in the draft amendment to the Enforcement Decree of the PIPA. In addition, we will provide guidance focused on the key provisions of the amended Network Act regarding (iv) the transmission of advertising information.

For more details, please refer to the full report attached below.