South Korea's Personal Information Protection Act (PIPA) now allows penalty surcharges of up to 10% of total revenue for the most serious breaches, and its regulator has shown in 2025 and 2026 that it will use record fines. PIPA applies to any controller processing the personal information of people in Korea, whether a domestic company or a foreign platform. It was rewritten in 2023 to unify online and offline rules and move from criminal to revenue-based sanctions, and amended again in 2026 to raise the cap, widen what counts as a breach and make management personally accountable. This guide covers scope, the core obligations, the 72-hour notification regime, the Personal Information Protection Commission (PIPC) enforcement record, ISMS-P certification, and what PIPA means for the machine identities and AI agents that process personal data. It is written for security, privacy and compliance teams at organisations with Korean customers, staff or operations.
Status line (checked 27 October 2026): the 2026 amendment to PIPA passed the National Assembly on 12 February 2026, was promulgated on 10 March 2026 and took effect with its amended Enforcement Decree on 11 September 2026. Mandatory certification provisions and related fines are reported to apply from 1 July 2027. The PIPC's English site still lists the 15 September 2023 version as the latest English text, so the Korean text on law.go.kr is authoritative.
Key takeaways
- The cap is now 10% of total revenue. Since 11 September 2026 the maximum surcharge rises from 3% to 10% for repeated intentional or grossly negligent violations within three years, intentional or grossly negligent conduct affecting 10 million or more people, or a breach after failing to comply with a corrective order.
- Notification runs on 72 hours. Data subjects must generally be told within 72 hours of a breach becoming known, and the PIPC must be notified within 72 hours where 1,000 or more people are affected, sensitive or unique identifying information is leaked, or the leak came from unlawful external access.
- A possible breach now triggers notice. The 2026 amendment adds a "breach possibility" notice where exposure is highly likely even before affected individuals are confirmed, and extends breach to forgery, alteration and destruction, which covers ransomware.
- Record fines follow identity failures. The PIPC fined SK Telecom KRW 134.8 billion in August 2025 over unencrypted SIM authentication keys and weak access control, and Coupang KRW 624.7 billion in June 2026 after a former engineer's unrevoked signing key was used to forge tokens.
- ISMS-P is the assurance route. The combined ISMS-P certification under PIPA Article 32-2 has 102 criteria, and the 2026 amendment makes certification mandatory for controllers above thresholds set by decree.
Scope: who and what is covered
PIPA governs "personal information controllers": public bodies, companies, organisations and individuals that process personal information for business purposes, directly or through processors. Since the 2023 amendment took effect on 15 September 2023, the former special provisions for online "information and communications service providers" were folded into the general rules, so the same standards for breach timelines, consent for children under 14 and sanctions apply to online and offline businesses alike.
| Concept | What PIPA covers | Practical note |
|---|---|---|
| Personal information | Information relating to a living individual that identifies them, alone or when easily combined with other information, plus pseudonymised information | Device identifiers, IMSI and account IDs can qualify when linkable |
| Sensitive information | Categories such as health, political views, union membership and biometric data, which need separate consent or a legal basis | Biometric templates used for login are in scope |
| Unique identifying information | Resident registration, passport, driver's licence and alien registration numbers | Processing is tightly restricted and leaks trigger PIPC reporting |
| Controllers | Domestic and foreign organisations processing data of people in Korea | Foreign platforms have been fined directly |
| Processors (entrusted persons) | Service providers acting for controllers | Have the same breach notification obligations as controllers |
| Large public systems | Public bodies operating systems with large data sets | Must analyse access records, name a manager per system and report unauthorised access |
Two other regimes often apply in parallel. Telecoms and network service providers under the Information and Communications Network Act must report electronic intrusion incidents to the Ministry of Science and ICT (MSIT) within 24 hours, whether or not personal data is involved, and credit information companies report to the Financial Services Commission where 10,000 or more credit information subjects are affected. See the Global Privacy Regulatory Map for how PIPA compares with other regimes.
Key obligations
Lawful processing and data subject rights
- Legal bases (Art. 15): consent, legal obligations, public functions, urgent protection of life or property, and, since 2023, necessity for performing a contract with the data subject (Art. 15(1)(iv)), which the controller must be able to demonstrate.
- Automated decisions (Art. 37-2): data subjects may refuse, or ask for an explanation of, fully automated decisions that significantly affect their rights, with details in the Enforcement Decree.
- Portability (Art. 35-2): a general right to data portability introduced in 2023, phased in by sector through separate decree provisions (MyData).
- Dispute mediation: all controllers, not only public bodies, must take part; a controller that does not respond within 15 days of a provisional mediation decision is deemed to accept it.
Security and accountability
- Safety measures (Art. 29): technical, administrative and physical measures, including access control, access logging, encryption of sensitive and identifying data and protection against malware, detailed in the PIPC's security measures standards.
- Management accountability (new Art. 30-3): the business owner or representative carries overall responsibility for privacy protection, including securing personnel and budget.
- Chief Privacy Officer (Art. 31): every controller designates a CPO. Since September 2026, large controllers need a board resolution to appoint, change or dismiss the CPO and must report it to the PIPC. Reported thresholds include annual revenue over KRW 180 billion with personal data of 1 million or more people, or sensitive or unique identifying data of 50,000 or more, plus universities with 20,000 or more students, tertiary hospitals and major public system operators.
- Certification (Art. 32-2): ISMS-P, now mandatory for controllers above decree thresholds from 1 July 2027.
Breach notification (Art. 34)
| Trigger | Recipient | Timing | Content |
|---|---|---|---|
| Any breach (loss, theft, leakage, and since 2026 forgery, alteration or destruction) | Affected data subjects, even if only one | Generally within 72 hours of becoming aware | Data categories, when and how it happened, steps to reduce harm, countermeasures, contact point |
| 1,000 or more data subjects, sensitive or unique identifying information, or unlawful external access | PIPC (or the designated body) | Generally within 72 hours | As above plus response measures |
| Breach possibility (new Art. 34(2)), where exposure is highly likely | All potentially affected data subjects | Promptly, per decree criteria (reported as 72 hours) | Harm-minimisation information |
| Electronic intrusion at a network service provider | MSIT | Within 24 hours | Date, cause, damage, response, contact |
Cross-border transfers (Arts. 28-8 and 28-9)
Overseas transfer needs a recognised basis. Since 2023, separate consent is not required where the PIPC recognises the destination country or recipient as providing equivalent protection, or the recipient holds a recognised certification. The PIPC can order a suspension of transfers after a violation. See the International Data Transfers Map.
Timeline and current status
| Date | Event |
|---|---|
| 7 November 2018 | Integrated ISMS-P certification begins, merging PIMS and ISMS |
| 5 August 2020 | Data 3 Acts amendments take effect; PIPC becomes the central independent regulator |
| 27 February 2023 | Major PIPA amendment passes the National Assembly |
| 15 September 2023 | Amended PIPA and Enforcement Decree take effect: unified rules, revenue-based surcharge up to 3%, new transfer bases; some provisions phased later |
| 28 August 2025 | SK Telecom surcharge of KRW 134.8 billion |
| 12 February 2026 | 2026 amendment passes the National Assembly |
| 10 March 2026 | 2026 amendment promulgated |
| 11 June 2026 | Coupang surcharge of KRW 624.7 billion |
| 11 September 2026 | 2026 amendment and Enforcement Decree take effect: 10% cap, breach possibility notice, CPO board approval |
| 1 July 2027 | Mandatory certification and related fines apply (as reported) |
The 2026 penalty provisions apply by conduct date: repeat-violation surcharges count only violations after the effective date that follow a prior surcharge, and breach-after-order surcharges apply to corrective orders received after it.
Enforcement and penalties
- Penalty surcharges (Art. 64-2): up to 3% of total revenue, with the 2023 change that the base is total revenue minus revenue the controller proves is unrelated to the violation. Since September 2026, up to 10% in the aggravated cases, and up to KRW 5 billion where revenue is absent or hard to calculate.
- Reductions: reported reductions of up to 40% for prior privacy investment, including an empowered CPO, and a separate up to 40% for early detection, prompt reporting and notification and stopping the spread. The PIPC must reduce surcharges for investment unless the violation was intentional or grossly negligent.
- Administrative fines: separate, smaller fines for procedural failures, raised by the 2026 decree. SK Telecom received a KRW 9.6 million fine alongside its surcharge.
- Corrective orders: the PIPC orders governance and security changes; SK Telecom was ordered to strengthen safeguards and give its CPO company-wide oversight.
- Civil claims and mediation: data subjects can claim damages and use mandatory dispute mediation.
| Case | Surcharge | Findings relevant to security teams |
|---|---|---|
| SK Telecom (August 2025) | KRW 134.8 billion | About 23 million subscribers; 25 data types including IMSI and SIM authentication keys; 26.1 million keys stored unencrypted; failures in access control and privilege management; internal servers connected to the HSS without restricting external access; delayed notification |
| Coupang (June 2026) | KRW 624.7 billion | About 37.5 million people counted by the PIPC; a former engineer forged access tokens with a signing key never revoked or rotated; authorities notified more than 53 hours after detection against a 24-hour requirement; logs deleted despite a preservation order |
What it means for AI agents and non-human identities
Both record cases were identity failures, not exotic attacks. In the Coupang breach a token signing key with a multi-year life stayed valid after its holder left, and roughly 140 million automated requests pulled account data. At SK Telecom the PIPC cited access privilege management and unencrypted subscriber keys. PIPA's Article 29 safety measures are written for "persons handling personal information", but the regulator judges the outcome, so machine credentials must meet the same bar.
- Signing keys and tokens: rotate signing keys on a schedule and on staff exit, validate every token against current keys and keep keys off developer laptops. See the Machine Identity, PKI and Certificate Lifecycle Guide.
- Service accounts with bulk read: any account that can enumerate customer records is a 10-million-person risk under the new cap. Scope queries, rate-limit and alert on volume. See the Service Account Security Guide.
- Access logs as evidence: the Coupang log loss became a finding in itself. Ship logs for NHIs and agents to tamper-resistant storage with retention that outlasts an investigation.
- AI agents and automated decisions: an agent that approves, denies or prices for a customer may engage Article 37-2 rights to refuse or demand an explanation. Record the logic and keep a human review route. See the South Korea AI Basic Act Guide for the parallel AI regime.
- Agents as processors: third-party AI services that receive personal data are entrusted persons or transfer recipients, so contracts, transfer bases and breach duties follow them.
Compliance steps
- Confirm applicability: list Korean data subjects, the legal basis for each processing purpose, and whether the Network Act or credit information rules also apply.
- Check thresholds: calculate revenue and data volumes against the CPO board-approval and mandatory certification thresholds, and plan for ISMS-P before July 2027 if in scope.
- Rewrite the breach playbook: add the breach possibility notice, forgery and ransomware triggers, the 72-hour PIPC and data subject deadlines and the 24-hour MSIT report, with pre-approved Korean-language templates.
- Close identity gaps first: inventory signing keys, API tokens and service accounts touching Korean personal data; revoke on exit, rotate, encrypt identifiers and keys at rest.
- Preserve evidence: set log retention and legal hold for access logs of humans and machines.
- Document investment: keep a record of privacy budget, staffing and tooling, which is now a statutory basis for surcharge reduction.
- Test: run a tabletop where a forged token pulls a million records and the clock starts on a Friday evening.
Framework mapping and measurement
| PIPA duty | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISMS-P area (as listed by PIPC) |
|---|---|---|---|
| Art. 29 access control | PR.AA-01, PR.AA-05 | AC-2, IA-5 | Protection measures |
| Art. 29 encryption | PR.DS-01, PR.DS-02 | SC-28, SC-8 | Protection measures |
| Art. 34 notification | RS.CO-02, RS.CO-03 | IR-6, IR-8 | Protection measures |
| Access log retention | DE.CM-01 | AU-11 | Protection measures |
| Art. 30-3 and 31 accountability | GV.OC-03 | PM-5 | Control system setup and operation |
- Notification timeliness: hours from awareness to data subject and PIPC notice, target under 72.
- Credential hygiene: percentage of signing keys and tokens rotated within policy, and zero valid credentials for departed staff.
- Encryption coverage: share of unique identifiers and authentication secrets encrypted at rest.
- Bulk access alerts: machine identities exceeding read baselines, and time to contain.
- Log completeness: percentage of systems holding personal data whose access logs reach central retention.
Common failure patterns
- Keys that outlive people: signing keys and tokens not revoked at exit, the root of the Coupang case.
- Plain-text secrets: authentication keys and identifiers stored unencrypted, as found at SK Telecom.
- Waiting for confirmation: holding notice until affected individuals are confirmed, now overtaken by the breach possibility duty.
- Treating Korea as one regime: meeting the PIPC 72 hours but missing the 24-hour MSIT report.
- Weak CPO mandate: a CPO without budget, staff or board access, which now costs reduction eligibility and can breach Article 31.
- Lost logs: short retention or manual deletion that leaves the regulator to assume the worst.
Practitioner checklist
- Check law.go.kr for the current Korean text of PIPA and the Enforcement Decree.
- Map Korean personal data, legal bases and overseas transfers.
- Assess CPO board-approval and mandatory certification thresholds.
- Update the incident plan for 72-hour, breach possibility and 24-hour MSIT notices.
- Inventory and rotate signing keys, API tokens and service account credentials.
- Encrypt unique identifiers and authentication secrets at rest.
- Centralise and protect access logs for human and machine identities.
- Record privacy investment for surcharge reduction.
- Review AI agents and automated decisions for Article 37-2 rights.
Standards and references
- PIPC: Laws and Regulations (English PIPA and Enforcement Decree)
- PIPC: Amended PIPA and its Enforcement Decree become effective
- PIPC: ISMS-P certification
- Bae, Kim and Lee: 2026 PIPA amendment passes the National Assembly
- Yulchon: Amended PIPA and Enforcement Decree take effect
- Shin and Kim: 2023 PIPA amendment
- Baker McKenzie: South Korea security requirements and breach notification
- Light Reading: Privacy watchdog hits SKT with record fine
Related NHI Mgmt Group resources: Global Privacy Regulatory Map · South Korea AI Basic Act Guide · Breach Notification Laws by Country Guide · NHI Offboarding and Decommissioning Guide. This guide summarises South Korea's Personal Information Protection Act as at 27 October 2026 and is not legal advice.