South Korea. Comprehensive data protection. Act (amendment)
PIPA Amendment 2026Personal Information Protection Act Amendment (March 2026)
Partly verified
Medium confidence.Some provisions may have later dates; thresholds set by Presidential Decree. [Link: official Korean current PIPA (law.go.kr); KLRI English is the Apr 2025 version, pre-2026 amendment]
§1Summary
- Synopsis
Raises the penalty ceiling to 10% of total revenue for repeat wilful violations, breaches affecting 10 million or more people or ignoring PIPC orders. It widens the breach definition, triggers notice on possible breaches, makes the representative ultimately responsible and requires board approval of the CPO at larger controllers.
- Key themes
- Unique features
10% of revenue cap exceeds GDPR's 4%; mandatory ISMS-P certification for qualifying private entities.
- SaaS relevance
Large SaaS platforms serving Korea face greater penalty exposure and governance duties from September 2026.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Expanded to forgery/alteration/damage and possible breaches
- DPO
- Yes
- Maximum penalty
- 10% of total revenue (aggravated cases)
§3Dates
- Key dates
- Adopted
- In force
- Mandatory ISMS-P for qualifying private entities from 2027-07-01
§4Text and authority
- Text
- Authoritative text law.go.kr
- English text elaw.klri.re.kr
- Authority
- Personal Information Protection Commission (PIPC)
§5Where it applies
- Domestic law of
- South Korea
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.Some provisions may have later dates; thresholds set by Presidential Decree. [Link: official Korean current PIPA (law.go.kr); KLRI English is the Apr 2025 version, pre-2026 amendment]