TL;DR
Regulators in South Korea and Japan are shifting from passive oversight to highly structured, proactive frameworks that redefine corporate data liability. While South Korea is finalizing strict board-level oversight rules and severe revenue-based penalties, Japan is advancing a major legislative overhaul to ease data restrictions for artificial intelligence development while introducing strict commercial surcharges. These parallel shifts force multinational compliance teams to move beyond basic consent models toward active, structurally aligned governance.
South Korea's Implementation Blueprint for CEO Liability and Board-Level Governance
South Korea is codifying the exact operational thresholds that will force multinational corporations to elevate privacy compliance directly to the board of directors and the executive suite.
"This amendment establishes a severe penalty ceiling of up to 10% of total revenue for severe data breaches and designates the business representative or CEO as the 'ultimate responsible person' carrying personal supervisory liability." — South Korea Promulgates Sweeping PIPA Amendments
"The draft decree establishes strict criteria for organizations that must obtain formal board-of-directors approval and notify the PIPC within one month of appointing, changing, or removing a CPO." — South Korea Promulgates Sweeping PIPA Amendments
By linking massive fines to a company's total revenue and establishing a strict 72-hour breach notification window, the Personal Information Protection Commission (PIPC) is making data security an existential corporate issue. According to an analysis published by the IAPP, these rules legally solidify the personal accountability of the CEO, ensuring that compliance can no longer be delegated to siloed IT departments.
What to watch: How the PIPC handles public feedback from the consultation ending in July before the final enforcement decree takes effect in September.
Japan's Strategic Deregulation of AI Training alongside Targeted Biometric and Commercial Surcharges
Japan is attempting to secure its position in the global artificial intelligence race by carving out broad consent exceptions for model training while simultaneously tightening penalties for commercial data abuse.
"To prevent Japan from falling behind in the global AI race and becoming an 'AI colony,' the bill introduces a powerful deregulatory exception for data handled solely for 'statistical compilation, etc.,' which explicitly includes AI model training..." — Japan APPI 2026 Amendments
"For the first time in APPI history, the PPC is empowered to impose administrative surcharges (monetary fines) to confiscate ill-gotten gains from serious violations" — Japan APPI 2026 Amendments
This dual-track approach, highlighted in a legal analysis by Baker McKenzie, allows businesses to scrape publicly available sensitive personal data for AI training without consent, but balances this freedom with strict parental consent rules for children under 16 and a new administrative surcharge system. Compliance teams must navigate this bifurcated landscape, where backend research is highly deregulated but customer-facing biometric and youth data face unprecedented restrictions.
What to watch: The progression of the bill through the House of Councillors and the subsequent drafting of specific Personal Information Protection Commission rules regarding biometric disclosures.
What surprised us
- Japan is legalizing consent-free scraping of sensitive data for AI. To keep pace globally, the new APPI framework allows companies to collect publicly available sensitive personal data and share it with third parties for statistical and model training purposes without obtaining user consent, provided strict contract safeguards are in place Japan APPI 2026 Amendments
.
- Privacy regulators are adopting antitrust-style leniency programs. Japan's upcoming APPI surcharge system features a leniency program that slashes administrative fines by half if a business voluntarily self-reports its data violation before an official investigation begins Japan APPI 2026 Amendments
- South Korea's CPO mandate requires formal board-of-directors intervention. Rather than letting companies appoint a Chief Privacy Officer as a mid-level IT role, the draft enforcement decree legally mandates formal board approval and direct notification to the regulator for CPO appointments at large-scale and high-exposure entities South Korea Promulgates Sweeping PIPA Amendments
.
Open threads worth a vote
- Japan APPI 2026 Amendment Bill Final Passage — Monitor the House of Councillors vote on the APPI amendment bill to confirm its official enactment into law, and track the publication of subsequent cabinet orders and PPC rules.