Personal Information Protection Commission

Rule Changes

As of September 2026: Regulator implementing the amended law

South Korea can now fine companies up to 10% of their annual revenue for serious or repeated data breaches. The amended Personal Information Protection Act, in force since September 11, 2026, triples the old 3% cap.

Updated Sep 18

Rule Changes

As of June 2026: Issued the fine

South Korea's privacy regulator fined Coupang 624.7 billion won, roughly $409 million, for a breach that exposed data on 37.5 million accounts, more than 70% of the country's population. The penalty is the largest in Korea's privacy enforcement history. It landed below analyst projections of up to 1 trillion won, and Coupang shares jumped 14% on June 11, their best single-day gain since November 2022.

Updated Jun 12