Korea raises data breach fines to 10% of revenue
South Korea's revised privacy law now allows fines up to 10% of annual revenue for major negligent data leaks, up from 3%.
South Korea's revised Personal Information Protection Act enforcement decree, effective Friday, allows fines up to 10% of total annual revenue for companies leaking data of 10 million or more people through intent or gross negligence, up from the previous 3% cap. Companies must notify users within 72 hours of a potential breach with high exposure risk, and data altered by ransomware now triggers the same reporting duties. The change follows Coupang's 624.6 billion won ($466.3 million) fine in June for leaking data of 37.55 million people.
- Fines up to 10% of revenue apply to intentional or grossly negligent leaks of 10M+ people
- Potential-breach notification required within 72 hours when exposure risk is high
- Companies with proactive data protection investment can receive up to 40% fine reductions
- Firms above 180 billion won revenue processing 1M+ people need board approval for privacy officers
- Coupang's $466.3 million fine under old rules could have reached trillions of won
- Tags
- breach-notificationcoupangdata-breachpersonal-information-protection-actpipcprivacy-regulationsouth-korea
- Vendors
- Coupang
- Organizations
- Personal Information Protection Commission
- Countries
- South Korea
From the original article
3 min read at koreajoongangdaily.com
Companies behind major negligent data leaks can now face fines of up to 10 percent of annual revenue under revised privacy rules. Personal Information Protection Commission Chairperson Song Kyung-hee speaks during a plenary session of the watchdog at the government complex in Jongno District, central Seoul, on Sept. 9.
By throw7 · koreajoongangdaily.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.