닫기

Resources

Publications

TMT Regulatory Briefing: Amended Personal Information Protection Act Taking Effect on September 11 — Penalty Surcharge of Up to 10% of Revenue, Strengthened CEO and CPO Responsibilities, and More

2026.09.16.

The Personal Information Protection Commission (the “PIPC”) promulgated the partial amendment to the Personal Information Protection Act (the “Amended Act”) on March 10, 2026. The Amended Act and the amendment to the Enforcement Decree of the Personal Information Protection Act (the “Enforcement Decree”), which specifies the delegated matters under the Amended Act, came into force on September 11, 2026. The Amended Act raises the upper limit of administrative surcharges for repeated or serious personal information infringements up to 10% of total revenue under certain conditions, and strengthens the ultimate liability of the business owner or representative as well as the role of the Chief Privacy Officer (“CPO”).


In addition, the Amended Act also expands the scope of “breach incidents,” which encompasses not only the leakage of personal information but also its forgery, alteration, and damage, and establishes a new obligation to notify data subjects of the possibility of the data breach even before the data controllers are able to confirm the list of data subjects affected by the breach. 


The Enforcement Decree specifies in detail: the specific scope of entities subject to board resolution and reporting to the PIPC upon the appointment or dismissal of a CPO; the criteria, timing, and methods for notifying data subjects of potential breach incidents; the standards for mitigating penalty surcharges based on investments in personal information protection; and the increased levels of administrative fines. 


This Legal Update examines the Amended Act and the Enforcement Decree together and summarizes the practical matters that businesses should prioritize immediately following implementation.


For more details, please refer to the full report attached below.