SOUTH KOREA Trends and Developments Contributed by: Hwan Kyoung Ko, Sunghee Chae, Kyung Min Son and Matt Younghoon Mok, Lee & Ko
Lee & Ko Hanjin Building 63 Namdaemun-ro Jung-gu Seoul 04532 South Korea Tel: +82 2 772 4000 Fax: +82 2 772 4001 2 Email: mail@leeko.com Web: www.leeko.com
Korea’s 2026 Amendments to the Personal Information Protection Act: Strengthened Corporate Accountability and Developments in AI-Related Data Use Introduction In 2025, Korea experienced a series of unprecedented large-scale personal data breaches across sectors closely connected to everyday life, including telecom - munications, e-commerce and financial services. A major telecommunications company, SK Telecom, suffered a hacking incident affecting approximately 23 million users. An e-commerce platform, Coupang, reported the exposure of approximately 33 million customer records, and a credit card company, Lotte - Card, experienced a breach involving approximately 2.97 million individuals. These cross-sector incidents revealed significant weaknesses in corporate data protection governance. The regulatory response was substantial. While the investigations by the Personal Information Protection Commission (PIPC) concerning Coupang and Lotte - Card remain ongoing, the PIPC imposed an adminis - trative penalty exceeding KRW134.7 billion (approxi - mately USD93 million) in relation to the SK Telecom data breach. More recently, it imposed administrative penalties totalling KRW36.033 billion (approximately USD25 million) against Korean subsidiaries of Lou - is Vuitton, Dior and Tiffany & Co for personal data breach. These enforcement actions underscored that inadequate data protection systems may give rise to significant regulatory, commercial and reputational exposure.
The recurrence of large-scale breaches prompted criticism that existing corporate governance and inter - nal control mechanisms were insufficient to prevent systemic data protection failures. In response, the National Assembly pursued legislative reform aimed at strengthening accountability and enhancing the effectiveness of the Personal Information Protection Act (PIPA). On 12 February 2026, the National Assembly passed a bill partially amending the PIPA (the “Amended PIPA”). The amendments extend beyond increasing adminis - trative penalties and instead revise core elements of the statutory framework. Key changes include: • express clarification of the responsibility of repre - sentative directors; • strengthened authority and reporting functions of the Chief Privacy Officer (CPO); • mandatory Personal Information and Information Security Management System (ISMS-P) certifica - tion for data controllers meeting prescribed thresh - olds; • restructuring of the personal data breach notifica - tion regime; • introduction of an aggravated administrative pen - alty of up to 10% of total turnover for repeated or serious violations; and • revision of administrative fine provisions. Through these measures, the Amended PIPA clarifies that personal data protection is not limited to techni - cal compliance obligations but forms part of corpo - rate management and governance responsibility. The
447 CHAMBERS.COM
Powered by FlippingBook