South Korea raises penalties for serious data breaches to up to 10% of total revenue under revised privacy rules.
South Korea is increasing the financial risk of serious data breaches under amendments to the Personal Information Protection Act.
From September 11, 2026, companies that leak personal data through intentional or grossly negligent violations could face fines of up to 10% of total revenue in certain serious or repeated cases.
The previous penalty cap was up to 3% of sales. The revised rules are designed to push companies to treat data protection as a preventive investment rather than a routine compliance cost.
The higher cap applies in cases such as repeated intentional or grossly negligent violations within three years, or where a company fails to comply with a corrective order and later suffers a breach as a result.
The changes also introduce a potential data breach notification system. If a company determines there is a high likelihood that personal data has been exposed, it must notify affected individuals within 72 hours.
The scope of reportable incidents is also expanding. Data that is forged, altered or damaged by ransomware or similar attacks can now trigger notification obligations.
Companies that invested in data protection before an incident may receive reductions in penalties. Regulators can consider privacy budgets, staffing, equipment, governance systems and the role of the chief privacy officer.
The rules also strengthen CPO governance for large companies and institutions, requiring board approval for certain CPO appointments, changes or dismissals.
The move follows a series of large-scale data breaches in South Korea, including major penalties against companies such as Coupang and KT.
For businesses operating in Korea, the message is clear: privacy risk is no longer only a legal issue. It is a board-level cybersecurity, governance and customer trust issue.
