📋 Korean Law Insight | Data Privacy
By Attorney NOH UJIN | HANBYOL LAW LLC, Seoul
Personal Data Breach Response Under PIPA in Korea: A Complete 2026 Legal Guide for Foreign Businesses
South Korea's Personal Information Protection Act (PIPA, 개인정보 보호법) is widely recognized as one of Asia's most stringent data protection frameworks. For foreign businesses operating in Korea — whether through a local branch, subsidiary, or direct digital services — a personal data breach can trigger complex legal obligations, significant financial penalties, and lasting reputational damage. Understanding how to respond effectively and lawfully is essential.
This guide provides a comprehensive overview of the breach notification requirements, regulatory processes, enforcement mechanisms, and best practices under PIPA, with a focus on practical guidance for international companies.
1. Overview of PIPA and Its Applicability to Foreign Entities
PIPA was first enacted in 2011 and has undergone significant amendments — most recently in 2023 — substantially enhancing its enforcement powers and aligning it more closely with global standards such as the EU's GDPR. The Act governs any person or organization that processes personal information of individuals located in Korea, regardless of whether the data controller is physically located within the country.
This extraterritorial reach means that foreign companies providing online services, e-commerce platforms, SaaS products, or any digital service that collects data from Korean residents are subject to PIPA. The Personal Information Protection Commission (PIPC, 개인정보보호위원회), established as an independent regulatory body in 2020, is the primary enforcement authority.
Key definitions under PIPA:
- Personal information (개인정보): Any information relating to a living individual that can identify that person, directly or in combination with other data.
- Personal information processor (개인정보처리자): Any public institution, corporation, organization, or individual that processes personal information as part of its activities.
- Sensitive information (민감정보): Includes health/medical data, biometric data, racial/ethnic origin, criminal records, sexual orientation, and political/religious views — subject to heightened protections.
2. What Constitutes a Personal Data Breach Under PIPA?
PIPA defines a breach broadly. Article 34 of PIPA requires notification whenever personal information is lost, stolen, leaked, falsified, altered, or damaged. This includes:
- Unauthorized access or hacking resulting in data exfiltration
- Insider theft or accidental disclosure by employees
- Loss of physical storage media (laptops, USB drives) containing personal data
- Accidental transmission of personal information to the wrong recipient
- Ransomware attacks that result in encryption or exposure of personal data
- Third-party vendor breaches where the vendor processes data on behalf of the controller
Even a suspected breach — where it is not yet confirmed whether data was actually exfiltrated — may trigger notification obligations once the organization becomes aware of a security incident that likely compromised personal data.
3. Notification Obligations: Timelines and Recipients
PIPA imposes two distinct notification obligations following a breach:
A. Notification to Data Subjects (Individual Notification)
Under Article 34(1) of PIPA, a personal information processor must notify affected data subjects "without delay" upon discovering a breach. The 2023 amendments introduced a 72-hour notification deadline for large-scale processors (those handling personal information of 1 million or more individuals) — mirroring the GDPR's standard.
The notification to data subjects must include:
- The type of personal information that was breached
- The time and circumstances of the breach
- Damage that may occur as a result of the breach
- Response measures taken by the processor
- Contact information for the person in charge of data protection (DPO or equivalent)
- Steps the data subject can take to mitigate harm
If individual notification is practically impossible (e.g., because contact information is unavailable), the processor must post a prominent notice on its homepage for at least 30 days as a substitute measure.
B. Notification to the PIPC (Regulatory Notification)
Where a breach affects 1,000 or more data subjects, the processor must also notify the PIPC within 72 hours of awareness. The notification must include the same elements as the individual notification, plus an assessment of the scope of the breach, a list of breached data fields, and the processor's remediation plan.
For smaller-scale breaches involving fewer than 1,000 individuals, while immediate regulatory notification may not be mandatory, processors are still advised to document the breach and may be subject to follow-up investigation if complaints arise.
4. Appointment of a Personal Information Protection Officer (DPO)
PIPA requires processors that meet certain size and activity thresholds to designate a Personal Information Protection Officer (PIPO, 개인정보 보호책임자). For foreign companies operating in Korea, the PIPO must be an individual located in Korea who can communicate with the PIPC and respond to data subject inquiries.
Failure to designate a PIPO or to have a PIPO available to respond during a breach investigation can result in additional administrative penalties. Foreign companies should ensure their Korean entity or local representative is properly designated and trained.
5. Regulatory Investigation and Enforcement Process
Following a breach notification, the PIPC may initiate a formal investigation. The investigation process typically includes:
- Initial review: The PIPC reviews the notification and may request supplementary information or documents within days of receiving the report.
- On-site inspection: Investigators may conduct on-site visits to examine systems, records, and data processing procedures.
- Written inquiry: The processor receives written questions requiring detailed responses about its security measures, breach response, and compliance posture.
- Deliberation and decision: The PIPC committee deliberates and issues a decision on whether violations occurred and what sanctions apply.
- Disposition: Sanctions range from corrective orders and public disclosure of the violation to administrative fines and, in severe cases, criminal referral.
6. Penalties and Sanctions Under PIPA
The 2023 PIPA amendments significantly strengthened the penalty regime:
- Administrative fines (과태료): Up to KRW 30 million (approximately USD 22,000) for failures such as non-notification or inadequate notification.
- Penalty surcharges (과징금): Up to 3% of the processor's global annual revenue related to the violation — a major change from the prior domestic revenue cap that dramatically increases exposure for large multinational companies.
- Criminal penalties: Intentional or gross negligent breaches of PIPA's core provisions can result in criminal prosecution with penalties of up to 5 years imprisonment or fines up to KRW 50 million.
- Class action/representative suits: Data subjects may bring collective claims through designated consumer protection organizations or directly through civil litigation.
High-profile enforcement actions in recent years have targeted global tech companies, domestic portals, and healthcare providers, demonstrating that the PIPC is increasingly active and willing to impose substantial sanctions.
7. Technical and Organizational Security Measures Required by PIPA
PIPA and its implementing regulations (the Personal Information Safety Measures Notification) mandate that processors implement both technical and administrative safeguards. Key requirements include:
- Access control systems limiting who can view or process personal data
- Encryption of sensitive personal information and passwords
- Installation and management of anti-malware software and intrusion detection systems
- Regular security vulnerability assessments
- Physical security measures for facilities containing personal data
- Employee training on personal data protection at least annually
- Maintenance of access logs with retention for a minimum of 6 months (for sensitive information, 2 years)
Failure to maintain these safeguards prior to a breach is frequently cited as an aggravating factor in PIPC enforcement proceedings and can dramatically increase penalties.
8. Data Processing Agreements with Third Parties
Where a personal information processor delegates data processing tasks to a third-party processor (수탁자), PIPA requires a written contract specifying the purpose of processing, prohibited activities, security measures, and the processor's right to supervise the third party. If a vendor breach causes the exposure of a controller's data, both the controller and vendor may face regulatory scrutiny.
Foreign companies using Korean-based cloud providers, HR platforms, or other SaaS vendors should ensure appropriate data processing agreements (DPAs) are in place and that vendor security postures have been assessed.
9. Cross-Border Data Transfers and Breach Implications
PIPA imposes specific requirements for transferring personal data overseas. Article 28-8 (introduced by the 2023 amendments) requires that cross-border transfers be accompanied by one of the following legal bases: data subject consent, adequacy determination, standard contractual clauses (SCCs), or binding corporate rules (BCRs).
In a breach scenario involving data that was improperly transferred overseas, the PIPC may treat the unauthorized transfer as a compounding violation, increasing enforcement risk considerably.
10. Incident Response Best Practices for Foreign Companies
When a potential breach is detected, foreign companies operating in Korea should follow these immediate steps:
- Containment: Immediately isolate affected systems to prevent further data exposure. Preserve forensic evidence.
- Internal escalation: Notify your PIPO, legal counsel, and executive leadership within hours of initial detection.
- Breach assessment: Determine what data was compromised, how many individuals are affected, and whether sensitive data was involved.
- Engage legal counsel: Korean-qualified attorneys should be involved immediately to assess notification obligations and manage regulatory communications.
- Notify within 72 hours: If the breach exceeds 1,000 data subjects, file the PIPC notification and begin individual notifications without delay.
- Document everything: Maintain detailed records of the breach timeline, notification actions, and remediation steps — these will be critical in any subsequent investigation.
- Remediation: Address the security vulnerability, implement enhanced controls, and prepare a detailed post-incident report.
Frequently Asked Questions (FAQ)
Q1. Does PIPA apply to my foreign company if we only market to Korean consumers online?
Yes. PIPA applies to any organization that collects or processes personal data of Korean residents, regardless of where the company is physically located. If you operate a website, app, or digital service accessible to Korean consumers, PIPA likely applies to you.
Q2. What is the difference between "personal information" and "sensitive information" under PIPA?
Personal information includes any data that can identify an individual, directly or in combination. Sensitive information is a subset that includes health data, biometric data, race/ethnicity, criminal records, and sexual orientation. Sensitive information requires explicit consent for collection and is subject to stricter security requirements and higher penalties for breaches.
Q3. What happens if we cannot notify all affected individuals within 72 hours?
If individual notification is impractical (e.g., contact details are unavailable), you may substitute a homepage notice posted prominently for at least 30 days. You should also document the reasons why individual notification was not feasible and report this to the PIPC.
Q4. Can we face criminal penalties for a data breach?
Criminal penalties apply primarily where there is intentional or grossly negligent conduct — for example, deliberately failing to notify despite being aware of a large-scale breach, or employees intentionally leaking data. Accidental breaches typically result in administrative sanctions, but aggravating factors like prior violations or inadequate security can increase risk.
Q5. How do PIPA's penalties compare to GDPR penalties?
Prior to 2023, PIPA's domestic revenue cap on penalty surcharges was much lower than GDPR. The 2023 amendments introduced a global revenue-based cap (up to 3% of global revenue), making PIPA penalties more comparable to GDPR in scale for large multinational companies. Administrative fines remain lower than GDPR's maximum, but the combination of surcharges, criminal exposure, and reputational damage creates significant overall risk.
Q6. Do we need to appoint a local representative if we have no Korean entity?
Foreign businesses with no Korean entity but that process data of Korean residents in significant volumes must designate a local representative who can act as the point of contact with the PIPC and data subjects. This representative effectively assumes the PIPO role for Korean regulatory purposes.
Q7. What documents should we prepare in advance of a breach?
Proactive preparation should include: a breach response plan, a list of all personal data categories processed and their locations, a register of data processing activities, template notification letters, contact details for the PIPC and Korean legal counsel, and pre-executed data processing agreements with all vendors.
📌 Official References
📚 Related Articles
Need Legal Assistance?
HANBYOL LAW LLC provides expert Korean legal counsel for international clients navigating data privacy compliance, breach response, and PIPC investigations.
📧
ujin95@hanbl.co.kr | 🌐
www.hanbl.co.kr
Initial consultations are complimentary.
📋 韩国法律洞察 | 数据隐私
作者：律师 NOH UJIN | HANBYOL LAW LLC，首尔
韩国PIPA下的个人数据泄露应对：外资企业完整法律指南（2026年）
韩国《个人信息保护法》（PIPA，개인정보 보호법）被广泛认为是亚洲最严格的数据保护法律之一。对于在韩国运营的外资企业——无论是通过本地分支机构、子公司还是直接提供数字服务——个人数据泄露可能引发复杂的法律义务、重大经济处罚以及持久的声誉损害。
1. PIPA概述及其对外资企业的适用性
PIPA于2011年首次颁布，并于2023年进行重大修订，大幅强化了执法权力，与欧盟GDPR等全球标准更加接轨。该法适用于任何处理韩国境内个人信息的人员或组织，无论数据控制方是否实际位于韩国境内。
这一域外管辖权意味着，提供面向韩国居民的在线服务、电商平台、SaaS产品或任何数字服务的外资企业均受PIPA约束。个人信息保护委员会（PIPC）是主要执法机构。
2. 何为PIPA下的数据泄露？
PIPA对泄露的定义十分宽泛。第34条要求，当个人信息遭到丢失、盗窃、泄漏、篡改、变更或毁损时，必须发出通知。包括：未经授权的访问或黑客攻击、员工内部盗窃或意外披露、存储介质丢失、误发个人信息给错误收件人、勒索软件攻击等。
3. 通知义务：时限与对象
PIPA规定了两项独立的通知义务：
- 通知数据主体：须在发现泄露后"立即"通知受影响的数据主体。2023年修订案对大规模处理者引入了72小时通知期限。
- 通知PIPC：涉及1,000名或以上数据主体的泄露，须在72小时内通知PIPC，并提供泄露详情及补救计划。
4. 技术与组织安全措施
PIPA及其配套法规要求处理者实施访问控制、加密、反恶意软件防护、定期安全评估、物理安全措施及员工年度培训，并保留访问日志至少6个月（敏感信息为2年）。
5. 处罚与制裁
- 行政罚款：最高3,000万韩元
- 过征金（Penalty surcharge）：最高全球年营业额的3%（2023年修订后）
- 刑事处罚：故意或重大过失违规，最高5年有期徒刑或5,000万韩元罚款
常见问题解答
Q1. PIPA适用于仅在网上向韩国消费者营销的外资企业吗？
是的。PIPA适用于收集或处理韩国居民个人数据的任何组织，无论公司实际位置在哪里。
Q2. "个人信息"与"敏感信息"有何区别？
个人信息包括任何可识别个人身份的数据；敏感信息是其子集，包括健康数据、生物特征数据、种族/民族、犯罪记录和性取向，受更严格保护。
Q3. 无法在72小时内通知所有受影响个人怎么办？
如果单独通知不可行，可在官网显著位置发布公告，保留至少30天，并向PIPC说明原因。
Q4. 数据泄露会面临刑事处罚吗？
刑事处罚主要适用于故意或重大过失行为，如明知发生大规模泄露却故意不通知，或员工故意泄露数据。意外泄露通常导致行政制裁。
Q5. 跨境数据传输与泄露有何关联？
如果泄露涉及未经合法授权的跨境数据传输，PIPC可能将其视为复合违规，大幅增加执法风险。
📌 官方参考
📚 相关文章
📋 韓国法律インサイト | データプライバシー
弁護士 NOH UJIN | HANBYOL LAW LLC、ソウル
韓国PIPAに基づく個人データ侵害への対応：外資系企業のための完全法律ガイド（2026年）
韓国の「個人情報保護法」（PIPA）は、アジアで最も厳格なデータ保護法の一つとして広く認識されています。韓国で事業を展開する外資系企業にとって、個人データ侵害は複雑な法的義務、多額の制裁、そして深刻なレピュテーション損害を引き起こす可能性があります。
1. PIPAの概要と外資系企業への適用
PIPAは2011年に制定され、2023年に大幅改正されました。この法律は、データ管理者が韓国国内に物理的に所在するかどうかに関わらず、韓国居住者の個人情報を処理するすべての組織に適用されます。個人情報保護委員会（PIPC）が主要な執行機関です。
2. PIPAにおけるデータ侵害とは？
PIPAは侵害を広く定義しており、個人情報の紛失、盗難、漏洩、改ざん、変更、または損傷が発生した場合に通知が求められます。不正アクセスやハッキング、従業員による内部漏洩、記録媒体の紛失、誤送信、ランサムウェア攻撃なども含まれます。
3. 通知義務：期限と対象
- データ主体への通知：侵害発見後「遅滞なく」通知が必要。2023年改正により、大規模処理者には72時間以内の通知期限が導入されました。
- PIPCへの通知：1,000人以上の個人に影響する侵害の場合、72時間以内にPIPCへ通知し、侵害の詳細と対応計画を提出する必要があります。
4. 技術的・組織的安全措置
PIPAおよびその関連規則は、アクセス制御、暗号化、マルウェア対策、定期的なセキュリティ評価、物理的セキュリティ対策、年次従業員教育、そしてアクセスログの最低6ヶ月（機微情報は2年）保持を義務付けています。
5. 制裁と罰則
- 行政罰金：最高3,000万ウォン
- 課徴金：2023年改正後、全世界年間売上高の最大3%
- 刑事罰：故意または重大な過失による違反には、最長5年の懲役または5,000万ウォンの罰金
よくある質問（FAQ）
Q1. 韓国の消費者にオンラインでマーケティングするだけの外資系企業にもPIPAは適用されますか？
はい。PIPAは、会社の物理的な所在地に関わらず、韓国居住者の個人データを収集・処理するすべての組織に適用されます。
Q2. 「個人情報」と「機微情報」の違いは何ですか？
個人情報は個人を識別できるあらゆるデータを含み、機微情報はそのサブセットで、健康データ、生体認証データ、人種/民族、犯罪歴、性的指向が含まれ、より厳格な保護が適用されます。
Q3. 72時間以内にすべての影響を受けた個人に通知できない場合はどうすればよいですか？
個別通知が実行不可能な場合は、ウェブサイトに30日間以上の公告掲載が代替手段として認められ、PIPCへその理由を報告する必要があります。
Q4. データ侵害で刑事罰を受ける可能性はありますか？
刑事罰は主に故意または重大な過失がある場合に適用されます。大規模侵害を知りながら通知を怠るケースや従業員による意図的な漏洩などが該当します。偶発的な侵害は通常、行政制裁の対象となります。
Q5. 国境を越えたデータ転送と侵害はどのように関連しますか？
合法的な根拠のない越境データ転送を含む侵害の場合、PIPCは複合的な違反として扱い、執行リスクが大幅に増加する可能性があります。
📌 公式参照資料
📚 関連記事
📋 Perspectiva Legal Coreana | Privacidad de Datos
Por el Abogado NOH UJIN | HANBYOL LAW LLC, Seúl
Respuesta a Violaciones de Datos Personales bajo la PIPA de Corea: Guía Legal Completa para Empresas Extranjeras (2026)
La Ley de Protección de Información Personal de Corea del Sur (PIPA) es ampliamente reconocida como uno de los marcos de protección de datos más estrictos de Asia. Para las empresas extranjeras que operan en Corea, una violación de datos personales puede desencadenar obligaciones legales complejas, sanciones económicas significativas y daños duraderos a la reputación.
1. Visión General de PIPA y su Aplicabilidad a Entidades Extranjeras
PIPA fue promulgada en 2011 y fue objeto de importantes enmiendas en 2023, reforzando sus poderes de aplicación y alineándola con estándares globales como el RGPD de la UE. La ley se aplica a cualquier persona u organización que procese información personal de individuos ubicados en Corea, independientemente de si el responsable del tratamiento se encuentra físicamente en el país. La Comisión de Protección de Información Personal (PIPC) es la principal autoridad de control.
2. ¿Qué Constituye una Violación de Datos bajo PIPA?
PIPA define las violaciones de manera amplia: cualquier pérdida, robo, filtración, falsificación, alteración o daño de información personal. Esto incluye accesos no autorizados, filtraciones por empleados, pérdida de medios de almacenamiento, transmisiones accidentales a destinatarios incorrectos y ataques de ransomware.
3. Obligaciones de Notificación: Plazos y Destinatarios
- Notificación a los interesados: "Sin demora" tras descubrir la violación. Las enmiendas de 2023 introdujeron un plazo de 72 horas para los grandes procesadores.
- Notificación a la PIPC: Cuando la violación afecte a 1.000 o más personas, debe notificarse a la PIPC en un plazo de 72 horas.
4. Medidas de Seguridad Técnicas y Organizativas
PIPA exige controles de acceso, cifrado, software antimalware, evaluaciones periódicas de seguridad, medidas de seguridad física, formación anual de empleados y mantenimiento de registros de acceso durante al menos 6 meses (2 años para información sensible).
5. Sanciones bajo PIPA
- Multas administrativas: Hasta 30 millones de KRW
- Recargos por sanciones: Hasta el 3% de los ingresos anuales globales (tras las enmiendas de 2023)
- Sanciones penales: Hasta 5 años de prisión o multas de hasta 50 millones de KRW por conducta dolosa o gravemente negligente
Preguntas Frecuentes (FAQ)
P1. ¿Se aplica PIPA a mi empresa extranjera si solo comercializamos en línea a consumidores coreanos?
Sí. PIPA se aplica a cualquier organización que recopile o procese datos personales de residentes coreanos, independientemente de dónde esté ubicada físicamente la empresa.
P2. ¿Cuál es la diferencia entre "información personal" e "información sensible" bajo PIPA?
La información personal incluye cualquier dato que pueda identificar a un individuo. La información sensible es un subconjunto que incluye datos de salud, datos biométricos, origen racial/étnico, antecedentes penales y orientación sexual, sujeta a mayores protecciones.
P3. ¿Qué ocurre si no podemos notificar a todos los afectados en 72 horas?
Si la notificación individual no es factible, puede publicarse un aviso prominente en el sitio web durante al menos 30 días y reportar a la PIPC las razones por las que no fue posible la notificación individual.
P4. ¿Pueden imponerse sanciones penales por una violación de datos?
Las sanciones penales se aplican principalmente cuando existe conducta dolosa o gravemente negligente, como no notificar deliberadamente una violación masiva conocida. Las violaciones accidentales suelen resultar en sanciones administrativas.
P5. ¿Cómo se relacionan las transferencias internacionales de datos con las violaciones?
En caso de violación que involucre transferencias internacionales sin base legal adecuada, la PIPC puede tratarlo como una infracción compuesta, aumentando considerablemente el riesgo de aplicación.
📌 Referencias Oficiales
📚 Artículos Relacionados
¿Necesita Asistencia Legal?
HANBYOL LAW LLC ofrece asesoramiento jurídico coreano experto para clientes internacionales en cumplimiento de privacidad de datos, respuesta a violaciones e investigaciones de la PIPC.
📧
ujin95@hanbl.co.kr | 🌐
www.hanbl.co.kr
Las consultas iniciales son gratuitas.
Comments
Post a Comment