Notice when a leak is only possible, and fines up to 10% of total sales: what the March 2026 amendment to the Personal Information Protection Act changes

What changed

Article 34(1) of the Personal Information Protection Act used to require a processor, on learning that personal information had been lost, stolen or leaked, to tell the affected data subjects without delay. Act No. 21445, promulgated on 10 March 2026, moves the defined term 'leak, etc.' to Article 23(2), where it covers loss, theft, leak, forgery, alteration and damage, so the duty also reaches forged, altered or damaged data. The notice must now give 'specific' information on the steps a data subject can take to minimise harm, information on legal rights arising from the leak, including damages claims under Articles 39 and 39-2 and dispute mediation under Article 43, and other decree-set matters. The former duty to minimise damage is now Article 34(3), and its measures must 'include steps to prevent the spread of harm, such as retrieval or deletion'.

The new Article 34(2) adds notice of a possible leak: notwithstanding Article 34(1), on learning of a 'possibility of a leak, etc.' prescribed by Presidential Decree in the light of the type of personal information, its impact on data subjects and the degree of risk, the processor must without delay tell every data subject exposed to that possibility the information for minimising harm and other decree-set matters; Article 28-7 keeps both paragraphs off pseudonymised information. The new Article 64-2(2) lets the Personal Information Protection Commission fine a processor up to 10% of total sales where a further violation of the same item of Article 64-2(1) occurs within three years of a fine disposition under that Article, both being intentional or due to gross negligence; where an intentional or grossly negligent violation harms 10 million or more data subjects; or where a violation of Article 64-2(1) item 9 follows failure to obey a corrective order under Article 64(1). With no sales, or where they cannot be calculated in decree-set cases, the cap is KRW 5 billion, and Article 64-2(6) obliges the Commission to reduce the fine where the processor invested in and operated budget, personnel, facilities and devices for privacy protection as the decree provides, except where the violation was intentional or due to gross negligence. The official reason gives the aim as stronger sanctions, clearer owner or representative responsibility, a stronger privacy officer, compulsory certification and easier redress; the remaining changes sit in the new Article 30-3, Article 31 and the proviso to Article 32-2(1).

What to read in the text

Addendum Article 1 brings the Act into force on 11 September 2026, six months after promulgation, except that the proviso to Article 32-2(1) and Article 75(2)(15), the certification duty and its penalty, start on 1 July 2027. Addendum Article 2 applies the amended Article 34(1) and 34(4) where the processor learns of a leak, etc. after entry into force, Article 34(2) where it learns of a possibility of a leak, etc. after that date, and Article 34(3) where the leak, etc. occurred after that date; awareness before 11 September 2026 therefore falls outside the amended paragraphs 1 and 2. Addendum Article 3 applies Article 64-2(2) item 1 where a fine disposition for a post-entry violation was followed by a further violation of the same item, item 2 also to violations not yet ended at entry into force, and item 3 where the corrective order under Article 64(1) came after that date. Addendum Article 4 conformingly amends two other Acts.

A file must show when the processor learned of the leak or of its possibility, when the leak occurred, and, for a fine, the date of any earlier fine disposition or corrective order. The scope of a 'possibility of a leak, etc.', the certification criteria, the privacy officer's reporting procedure, the notice contents and the grounds for reduction are left to Presidential Decree, which this note has not read.

Questions for the legislature

The proviso to Article 34(1) allows a substitute measure 'where there are justifiable grounds such as not knowing the data subject's contact details', while Article 34(2) requires notice to 'every data subject to whom the possibility of a leak, etc. exists'; the text, the addendum and the official reason do not say whether any substitute measure reaches that paragraph. Must that duty stand even for data subjects whose contact details are unknown?

Article 64-2(2) item 2 applies where 'the scale of harm to data subjects is 10 million persons or more', and Addendum Article 3 applies it to violations not yet ended at entry into force; neither the text, the addendum nor the official reason says how those persons are counted. Is the figure taken over a single violation, over linked violations, or only over harm arising after 11 September 2026?

When to revisit

We revisit this note when the Presidential Decree that defines a possibility of a leak, sets the certification criteria and the grounds for reduction is read against the Act, when a Commission or court decision explains the 10-million figure under Article 64-2(2) item 2 or the notice duty under Article 34(2), or if the certification duty is amended before 1 July 2027.