South Korea PIPA Amendments: PIPC Proposes Enforcement Decree, Fine Calculation Overhaul, and CPO Mandates Ahead of September 2026 Effective Date

South Korea PIPA Amendments: PIPC Proposes Enforcement Decree, Fine Calculation Overhaul, and CPO Mandates Ahead of September 2026 Effective Date

South Korea is finalizing its regulatory transition for the September 11, 2026 effective date of its sweeping amendments to the Personal Information Protection Act (PIPA). On June 1 and 2, 2026, the Personal Information Protection Commission (PIPC) released a draft amendment to the PIPA Enforcement Decree for public consultation, which closed on July 13, 2026. This proposed decree provides the critical operational details that compliance teams require—including the specific calculation methods for the landmark 10% total revenue administrative penalty, a new investment-based fine reduction mechanism, and strict triggers for board-level Chief Privacy Officer (CPO) approvals.

1. Administrative Penalties: Overhaul and the 10% Revenue Cap

The amended PIPA introduces severe economic sanctions, raising the administrative penalty cap to up to 10% of a company's total revenue for repeated or egregious violations. According to the PIPC's draft Enforcement Decree, the calculation of these penalties is highly structured:

"The PIPC will determine a 'base amount' by multiplying the revenue related to the violation (i.e., total revenue minus revenue unrelated to the violation) by a rate reflecting the severity of the violation (the 'base rate'). Under the Proposed Amendments, the base amount may be increased in certain cases, after which further adjustments (increases or reductions) will be applied to determine the final penalty."

The base amount will be increased to the aggravated 10% total revenue ceiling under three high-severity conditions:

1. Where a violator commits a willful or grossly negligent repeat violation within three years of a prior penalty;
2. Where a violator commits a willful or grossly negligent violation affecting 10 million or more data subjects; or
3. Where personal information is leaked due to non-compliance with a corrective order.

2. New Reduction Mechanism for Privacy-Protection Investments

To incentivize proactive data security, the draft decree introduces a mitigation mechanism. Companies can receive a reduction of up to 40% of the base penalty amount if they demonstrate qualifying investments in data protection:

"In applying reductions based on privacy protection investments, the PIPC will consider: (i) the scale and continuity of investments in budget, personnel, facilities, and equipment; (ii) the substance and effectiveness of the data controller's privacy protection framework, including the roles of the business owner or representative and the Chief Privacy Officer (CPO), organizational structure, and staffing; and (iii) additional efforts to enhance personal information security measures."

Importantly, this reduction is capped at 40% of the base amount and is completely unavailable if the violation is determined to be willful or grossly negligent.

3. Strict Board-Level Governance for CPO Designations

Under the amended PIPA, the business owner or representative director is designated as the "ultimate responsible person" for data protection. For major data processors, the draft Enforcement Decree mandates that the appointment, change, or removal of a CPO must obtain board approval and be reported to the PIPC within one month. This board-approval trigger applies to:

• Data controllers with annual revenue or income of KRW 180 billion or more that process either:
  1. Sensitive information or unique identification information of at least 50,000 data subjects, or
  2. Personal information of at least 1 million data subjects.
• Universities with 20,000 or more enrolled students.
• Tertiary general hospitals processing large volumes of sensitive information.
• Public system operating institutions.

4. Mandatory ISMS-P Certification

The draft decree establishes mandatory Personal Information & Information Security Management System (ISMS-P) certification for critical digital operators, with a final compliance deadline of December 31, 2028. This mandate targets:

• Operators of major public systems designated by the PIPC.
• Mobile telecommunications carriers and identity verification agencies.
• Companies with prior-year total revenue of at least KRW 1 trillion and at least KRW 10 billion in revenue from information and communications services, provided they manage average daily personal data of 30 million or more domestic data subjects.

5. Early-Stage "Likelihood of Breach" Notifications

Under Article 34 of the amended PIPA, reporting obligations are expanded to cover not only confirmed data breaches, but also cases of "forgery, alteration or damage." Crucially, companies must notify data subjects and the PIPC within 72 hours of recognizing a meaningful "likelihood" of a breach, even before individual data subjects can be identified:

"Where a data controller becomes aware of unauthorized access to its personal information processing systems or devices used by personnel, and objective circumstances indicate that personal information may have been breached, notification must be made within 72 hours of awareness, even if affected data subjects cannot yet be identified."

Compliance Action Items

As the September 11, 2026 effective date arrives, multinational compliance teams operating in South Korea must:

1. Document Privacy Investments: Maintain rigorous, auditable records of data security budgets, personnel, and infrastructure to leverage the 40% penalty reduction mechanism.
2. Review CPO Governance: Confirm if local revenue and processing volumes exceed the KRW 180 billion threshold, triggering mandatory board resolutions and PIPC reporting for CPO changes.
3. Update Incident Response Playbooks: Re-engineer breach response procedures to trigger notifications within 72 hours of a suspected "likelihood" of a breach, and expand reporting triggers to include data forgery or alteration.