On 13 October 2026, at the National Assembly's Political Affairs Committee audit, Personal Information Protection Commission (PIPC) Chair Song Kyung-hee said the commission feels heavy responsibility for recent breaches at financial institutions and public bodies. MTN's report says the punitive surcharge in force since September will apply to serious violations. It adds that firms obstructing investigations face non-cooperation fines, that hiding or destroying evidence draws a separate surcharge, and that a dedicated team will handle major breaches. The commission also plans standards for new technologies, including agentic AI and smart glasses. Song said a fund will channel surcharge revenue to victim relief.
The strongest case for the stick
The regulator's frustration is easy to understand. In June 2026 the PIPC sanctioned Coupang with a surcharge of about 624.68 billion won over a breach affecting about 37.55 million people. That was the largest in the agency's history, ahead of the roughly 134.8 billion won imposed on SK Telecom in 2025. Yet the legal cap then was 3% of sales, and the regulator found basic failures such as weak signing-key management and access control. If a fine is a rounding error against revenue, boards will treat security as a cost to minimise. The steelman for a 10% ceiling is that deterrence only works when the downside is large enough to change budget decisions.
The amended Act, which took effect on 11 September, is narrower than the headline suggests. According to JoongAng Daily, the 10% cap reaches breaches of 10 million or more people caused by intent or gross negligence. Under the enforcement decree it also covers repeat intentional or grossly negligent violations within three years, and breaches that follow a failure to comply with a corrective order. The same reporting says companies that invested in security can earn reductions of up to 40%. That structure is the right instinct: it ties the largest penalties to culpability, not to the mere fact of being hacked.
Where the design risks bite
The risk is not the ceiling but the discretion beneath it. "Gross negligence" is a standard that will be argued case by case, and the amount depends on the violation's nature, circumstances and scale of damage. Firms need to know, before an incident, what a defensible security programme looks like. Otherwise the reduction for good practice is hard to plan around, and the cap becomes an unpredictable tax on holding personal data. Larger firms can absorb that uncertainty with legal teams. Startups and mid-sized platforms cannot, and that is how a strong privacy law quietly entrenches incumbents.
The obstruction rules are the most defensible new element. When the PIPC ordered evidence preserved on 21 November 2025, Coupang manually deleted five months of access logs six days later, and records covering 13% of the attacker's activity were lost. A regulator that cannot reconstruct a breach cannot size it, and an obstruction penalty is a proportionate response to deliberate destruction. But the line between destroying evidence and ordinary log rotation, or a good-faith dispute over scope, must be drawn in guidance before enforcement. Penalising honest ambiguity would push firms toward silence.
There is also a perverse incentive to watch. Lawmaker Lee Heon-seung warned at the 2025 audit that harsher surcharges could backfire by encouraging companies to conceal incidents, according to coverage of that session. Self-reporting should therefore be rewarded visibly, through the reduction schedule, the way breach-disclosure regimes elsewhere reward early notification. A 72-hour notification duty, which JoongAng Daily says now extends to cases where exposure is highly likely even without a confirmed leak, works only if prompt disclosure leaves a firm better off than silence.
The relief fund and the emerging-technology standards
Compensation for victims is a real gap. Collective mediation over the Coupang breach, paused while the PIPC investigated, resumed only on 12 June 2026, roughly seven months after the investigation began. Mediation there involves 1,676 initial applicants against a pool of about 37.55 million affected people. A relief fund could close part of that gap.
Funding it from surcharge revenue, however, creates a structural conflict. If a regulator's relief programme grows with the fines it levies, the public will question whether penalty size tracks harm or budget needs. A safer design would route surcharges to the general treasury, or cap and ring-fence the fund by statute with independent audit. The commission should also say how fund payouts interact with court damages and mediation awards, so victims are not paid twice and defendants are not penalised twice for the same harm.
On agentic AI and smart glasses, the reported plan is for standards, which is the right instrument if they stay principles-based and outcome-focused. Two failure modes are worth avoiding. One is technology-specific rules that are obsolete by the time they are finalised. The other is a guidance document that quietly becomes binding through enforcement. The PIPC should publish drafts, take comments, and tie the standards to existing duties such as purpose limitation and security safeguards, not invent parallel obligations for each gadget.
What to watch
The credibility of this regime will be set by its first cases. A transparent decision that explains why conduct was grossly negligent, how the 40% reduction was weighed, and why the sum was proportionate to harm will do more for deterrence than the number itself. Courts will also matter: Coupang has said it will challenge its fine, and SK Telecom has sued to cancel its penalty, so appellate review will test the PIPC's reasoning. Korea can protect its citizens and its technology sector at once, but only if the stick comes with a published rulebook, a rewarded path for honest disclosure, and a relief fund that does not depend on how hard the regulator hits.