Korea raises data breach fines to 10% of revenue

Overview

Updated Sep 18

South Korea can now fine companies up to 10% of their annual revenue for serious or repeated data breaches. The amended Personal Information Protection Act, in force since September 11, 2026, triples the old 3% cap.

The top band applies when a breach stems from intent or gross negligence, hits more than 10 million people, or repeats within three years. Companies that invested in security before an incident get up to a 40% discount. CEOs, not just privacy officers, now carry formal responsibility for compliance.

Why it matters

South Korean firms now face revenue-based fines for data breaches, forcing security budgets and executive accountability to reset.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

10%

Maximum fine as share of annual revenue

New top penalty for repeat or catastrophic breaches, up from the previous 3% cap.

Previous fine cap

The old ceiling under Article 64-2, which regulators found too weak to deter large leaks.

10 million

Affected-people threshold for top fine

Damage to more than 10 million individuals through intent or gross negligence triggers the 10% band.

40%

Maximum fine reduction for prevention investment

Documented spending on budgets, staff, and security equipment can cut the base penalty—unless negligence was gross.

80%

Repeat-violation surcharge at third offense

Surcharges escalate from 20% to 40% to 80%, up from the previous 15%/30% scale.

Voices

Curated perspectives — historical figures and your fellow readers.

Organizations Involved

Personal Information Protection Commission

Independent administrative data protection authority

Regulator implementing the amended law

South Korea's central privacy regulator, which promulgates and enforces the Personal Information Protection Act.

Timeline

December 2025 July 2027

5 events Latest: September 11th, 2026 · 2 months ago

Tap a bar to jump to that date

July 2027
ISMS-P certification becomes mandatory
Upcoming Regulatory

Designated public and private data processors must obtain security certification, per the amendment's deferred provision.
July 1st, 2027
September 2026
Law takes effect, tripling fine cap
Latest Regulatory

The amended act and its enforcement decree enter force. Fines can reach 10% of revenue; CEO and CPO duties strengthen.
September 11th, 2026
March 2026
Amended act promulgated
Legislative

Government publishes the final text and sets the enforcement date for September 11, 2026.
March 10th, 2026
February 2026
National Assembly passes PIPA amendment
Legislative

The plenary session approves the revised law authorizing fines of up to 10% of total revenue.
February 12th, 2026
December 2025
Amendment clears policy committee
Legislative

South Korea's National Assembly policy committee advances punitive fines after a series of mass data breaches.
December 17th, 2025

Scenarios

First 10% fine lands on a major telecom or platform

Possible Resolves by End of 2027

Discussed by: South Korean business media, including Korea JoongAng Daily and DigitalToday

Telecoms and large platforms hold the customer volumes needed to cross the 10 million threshold. A repeat violation within three years combined with gross negligence would trigger the top band. Regulators have discretion on timing, so the first case may take months to process.

Prevention incentives reshape security spending

Likely Resolves by Q1 2028

Discussed by: Legal analyses from Yulchon LLC and Hunton Andrews Kurth

The up-to-40% reduction for documented prevention investment gives compliance teams a concrete lever. Companies must show budgets, staff, and equipment deployed before an incident. Firms that treat certification as a paperwork exercise miss the discount, while serious spenders bank it.

Court challenge tests the 10% cap

Possible Resolves by Q2 2029

Discussed by: South Korean administrative law commentators

A company hit with a top-band fine would likely argue the 10% figure or the gross-negligence finding is disproportionate. Administrative court appeals could suspend or reduce specific penalties, setting precedent for how regulators apply the new ceiling.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

May 2018

GDPR turnover-based fines (2018)

The European Union's General Data Protection Regulation introduced fines up to 4% of global annual turnover for serious privacy breaches. Enforcement built slowly, with regulators favoring settlements in early years.

Then

Regulators issued modest fines while companies prepared compliance programs.

Now

The first top-band penalty took five years to land, showing revenue-based fines arrive slowly but reshape board-level priorities.

Why this matters now

Korea's 10% cap follows the GDPR template of linking fines to revenue. The GDPR's slow enforcement arc suggests Korean penalties may also build gradually.

May 2023

Meta's €1.2 billion GDPR fine (2023)

Ireland's regulator fined Meta €1.2 billion for transferring European user data to the US, the first penalty near the GDPR's 4% ceiling. Meta appealed and contested the finding through multiple courts.

Then

Meta challenged the decision, extending the case for years.

Now

The case set a precedent that top-band fines get litigated hard and take years to finalize.

Why this matters now

A parallel for how Korea's first 10% fine might be fought: expect appeals and long delays before any top penalty becomes final.

2011-2014

Korea's privacy crackdown after telecom and card breaches (2011-2014)

A string of breaches at SK Communications, KT, and card issuers exposed tens of millions of records. The public outcry pushed Korea to strengthen its privacy law and eventually set the 3% fine cap.

Then

Regulators levied fines and ordered security overhauls at affected firms.

Now

Korea repeatedly tightened PIPA after mass breaches, with enforcement following each legislative wave.

Why this matters now

Korea has a pattern of legislating after major leaks. The open question now is whether the new 10% ceiling deters repeat breaches or just raises the cost of getting caught.