What new penalty will Korea impose on companies with massive personal data leaks?

Companies that suffer personal information leaks affecting more than 10 million people can be punished with a penalty of up to 10 percent of sales. The rule applies when the leak results from intentional misconduct or gross negligence.

Why is Korea tightening penalties for data leaks now?

The privacy watchdog said the move comes as Seoul seeks stronger protection of personal information after high-profile cases, including Coupang’s data breach that affected more than 37 million users. The revised law is intended to strengthen accountability for large-scale leaks and repeat violations.

How can the privacy watchdog reduce the new penalty for companies?

The watchdog said it may cut up to 40 percent of the penalty by considering how much a company invested in personal information protection and other safety measures. The reduction is part of the enforcement framework under the revised law.

Korea to introduce strengthened penalties for large-scale data leaks

Listen

Summary

Korea will impose strengthened penalties this week on companies whose personal information leaks affect more than 10 million people. The revised personal information protection law takes effect Friday and raises the maximum penalty to 10 percent of sales from 3 percent. The privacy watchdog said the rule targets intentional misconduct, gross negligence, repeated violations within three years, and failures to follow corrective orders. It also said penalties may be cut by up to 40 percent depending on a company’s investment in protection and other safety measures.

Key Facts

The revised personal information protection law is set to take effect Friday.
Companies facing the new penalty can be fined up to 10 percent of sales.
Before the revision, the maximum penalty was 3 percent of sales.
The rule applies to companies with leaks affecting more than 10 million people and to repeated violations within three years or failures to follow corrective orders.
The Personal Information Protection Commission said penalties can be reduced by up to 40 percent based on investment in personal information protection and other safety measures.

By Yonhap

Published Sep 10, 2026 12:20 pm KST

Personal Information Protection Commission Chairperson Song Kyung-hee, center, speaks during a plenary session of the watchdog at the government complex in central Seoul, Wednesday. Yonhap

Korea will introduce strengthened penalties this week for companies that suffer personal information leaks affecting more than 10 million people, the privacy watchdog said Thursday.

The move comes as Seoul has sought to strengthen protection of personal information in the wake of high-profile cases, including e-commerce operator Coupang's data breach that affected more than 37 million users.

Under the revised personal information protection law set to take effect Friday, companies that suffer such large-scale leaks due to intentional misconduct or gross negligence can be punished with a penalty up to 10 percent of their sales, according to the Personal Information Protection Commission.

Companies that repeatedly violate personal information laws within three years or those that suffer data leaks by failing to follow corrective orders are also subject to the punishment.

Before the revision, companies were subject to a penalty of up to 3 percent of sales.

The watchdog, however, noted that it could reduce up to 40 percent of the penalty by taking into account the level of investment companies took for personal information protection and other safety measures.

Explore More