JIPYONG LLC

Jipyong News|KOREA LEGAL INSIGHT

Preparation for the upcoming amendment to Korea’s Personal Information Protection Act

2026.09.07

Introduction
<div> 
The amendment to Korea’s Personal Information Protection Act (the “Amendment”) is expected to take effect on September 11, 2026. 
 
Companies should take note that the Amendment is intended to elevate the responsibility for personal information protection from a matter handled primarily by the Chief Privacy Officer (“CPO”) to a matter requiring oversight at the level of the board of directors (“BOD”).  This may have implications on the scope of potential liability of the directors under the Korean Commercial Act. 
 
Below is a summary of key aspects of the Amendment. </div>
 
 
1. Changes under the Amendment 
 
(1) Appointment and removal of the CPO

<div> 
In the case of a company with annual sales or revenue in the amount of KRW 180,000,000,000 or more that either (i) processes unique identifier or sensitive information of 50,000 or more individuals; or (ii) processes personal information of 1,000,000 or more individuals, the appointment and removal of the CPO must be resolved by the BOD, and such appointment or removal must be reported to the Personal Information Protection Commission within one (1) month.</div>
 
(2) Statutory duties of the CPO

<div> 
The CPO must report the “status of personal information protection and key matters” to the BOD.  For details on the matters that need to be reported to the BOD, please see Section 2.</div>
 
(3) Responsibility of the members of the BOD

<div> 
BOD is ultimately responsible for implementing comprehensive measures, such as providing the necessary human resources and sufficient budget, for the protection of personal information.  Under the Amendment, the BOD is required to resolve on the appointment and removal of the CPO, and the BOD is required to receive regular reports on the status of personal information protection.  As such, all members of the BOD may potentially be held responsible in the event of an incident such as a personal data breach.</div>
 
 
2. Matters that need to be reported to the BOD

<div> 
The Amendment does not specify the scope of the key matters that need to be reported to the BOD.  However, based on our experience in practice, reporting matters may be categorized into five (5) areas as follows: 
 
<table cellpadding="8px" style="width:100%; text-align:center; border:1px solid #bbb; border-collapse:collapse;" width="100%">
	<tbody style="line-height: 16px;">
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); background-color: rgb(242, 242, 242); border-top: 2px solid #cc0000; padding: 8px; vertical-align: center;" width="30%">Category</td>
			<td style="border: 1px solid rgb(187, 187, 187); background-color: rgb(242, 242, 242); border-top: 2px solid #cc0000; padding: 8px; vertical-align: center;" width="70%">Content</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 16px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">1. Plan, strategy and resourcess</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); padding: 10px 15px; vertical-align: middle;" width="70%">
			<ul>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Annual plan for the personal information protection and implementation results</li>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Mid to long term personal information protection strategy and roadmap</li>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Status of specialized personnel and recruitment plans</li>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Budget allocation and execution status</li>
			</ul>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">2. Governance and internal regulations</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); padding: 10px 15px; vertical-align: middle;" width="70%">
			<ul>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Enactment and amendment of the internal regulation relating to personal information protection</li>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Material changes to the personal information processing policy</li>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Training plans and implementation results</li>
			</ul>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">3. Risk and internal controls</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); padding: 10px 15px; vertical-align: middle;" width="70%">
			<ul>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Results of personal information processing audits and corrective measures</li>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Status of internal controls including access authorization, access logs and detection of anomalous behavior</li>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Results of impact assessments and internal risk assessments</li>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Status of compliance with sanctions and corrective orders from supervisory authorities</li>
			</ul>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">4. Response to incidents and dealing with data subjects</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); padding: 10px 15px; vertical-align: middle;" width="70%">
			<ul>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Current incidents such as personal information leaks, and status of response to such incidents</li>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Notice to data subjects; report to the Commission; and measures to prevent recurrence of incidents</li>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Status of complaints, dispute mediation and litigation</li>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Source of funds for remedies and compensation</li>
			</ul>
			</td>
		</tr>
		<tr>
			<td style="border: 1px solid rgb(187, 187, 187); font-size: 15px; text-align: left; line-height: 25px; padding: 12px; vertical-align: top">
			<div style="line-height: 25px; font-size: 15px">5. Third party risks</div>
			</td>
			<td style="border: 1px solid rgb(187, 187, 187); padding: 10px 15px; vertical-align: middle;" width="70%">
			<ul>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Status of overseas transfer of personal information</li>
				<li style="line-height: 25px; font-size: 15px; text-align: left;">Personal information risks associated with the use of cloud server and AI services</li>
			</ul>
			</td>
		</tr>
	</tbody>
</table>
</div>
 
 
3. Practical consideration for the reporting to the BOD

<div> 
It is not necessary to report all of the aforementioned items at the same level of detail.  A company should set the materiality criteria based on its industry and business objective, the scale of personal information processing, the level of exposure to unique identifiers and sensitive information etc., reflect the relevant contents into its internal policies, and implement measures to ensure compliance in practice. 
 
A company may consider designating a certain committee with the role and responsibility of reviewing and supplementing the reports prepared by the CPO prior to their submission to the BOD. 
 
The Amendment is silent as to how frequently the CPO must report to the BOD.  In practice, a company may consider having two (2) types of reporting as follows. 
 
<ul>
	<li>Periodic reporting: a comprehensive report at least once per annum, together with a summary report either on a semi-annual or quarterly basis covering annual plans, performance, budget, personnel, and risk assessment. </li>
	<li>Ad hoc reporting: report as and when necessary (eg: upon occurrence of an incident such as data breach, investigation or sanction by regulatory authorities, large scale complaints or disputes) </li>
</ul>
 
Record keeping is important.  A company should have a system in place to record and retain the following: 
 </div>

<div style="background:#eeeeee;border:0.5px solid #cccccc; padding:18px 25px 22px 25px;">
<ul>
	<li>Explanatory materials prepared by the CPO and submitted to the BOD </li>
	<li>Q&A between the CPO and the BOD </li>
	<li>Instructions from the BOD and outcome of the implementation of such instructions </li>
	<li>Revision history of the BOD policies and internal regulation on personal information protection </li>
</ul>
</div>
 
 
4. Penalties for violation 
 
<div>Under the Amendment, a failure to comply with the requirements for a BOD resolution or the requirement to report to the Personal Information Protection Commission, may result in an administrative fine of up to KRW 30,000,000. 
 
Also, if a company becomes liable for a fine or damages resulting from a significant breach of personal information, directors the company may face liability under the Korean Commercial Act. 
 </div>

<div style="background:#eeeeee;border:0.5px solid #cccccc; padding:18px 25px 22px 25px;">Important note: The contents of this article are based on the draft legislation.  Readers must check the full enacted version of the legislation before making any decision or implementing any policies based on this article. </div>
 
<a href="https://www.jipyong.com/kr/board/news_view.php?seq=15525" target="_blank">[Link to Korean Newsletter]</a>

</div>

News Jipyong Names Dong Ho YOO Vietnam Head, Joo Yeon SHIN HCMC Head 2026.02.13

KOREA LEGAL INSIGHT AI-Based Safety Management Systems and the Duty to Ensure Safety and Health under Korea’s Serious Accidents Punishment Act 2026.08.18

Back to List

Related Practices

Privacy & Data Protection

Related Practices

Professionals

SHARE

Disclaimer

Limited Liabilities