On 11 September 2026, South Korea's amended Personal Information Protection Act (PIPA) and its enforcement decree took effect. They give the Personal Information Protection Commission (PIPC) a punitive tier: fines of up to 10% of a company's total revenue, up from a 3% ceiling. The higher tier applies in three situations: repeated intentional or negligent failures within three years, breaches affecting 10 million or more people, and leaks after a company has ignored an earlier corrective order, according to Korea JoongAng Daily.
The strongest case for the new tier
The case for a harsher ceiling is better than critics usually admit. Fines only change behaviour if they exceed the cost of prevention. The PIPC's own findings on Coupang show what weak prevention looks like. In its June 2026 decision, the Commission found the breach resulted from weak baseline protection rather than sophisticated hacking: a former employee used signing keys the company had failed to revoke to forge authentication tokens and access systems from April to November 2025. Coupang did not block anomalous traffic to pages holding personal data, and it missed the 72-hour regulator notification window. The PIPC's release also says the Chief Privacy Officer was excluded from the internal investigation. A regulator facing that pattern, and a company with global-scale revenue, can reasonably argue that a ceiling tied to violation-related revenue does not bite.
The scale of the penalties supports that view. The PIPC fined Coupang about KRW 624.7 billion, made up of KRW 423.575 billion for inadequate safeguards and KRW 201.106 billion for unlawfully collecting online behavioural data. About 33.22 million users had data exposed, plus roughly 4.33 million third parties whose shipping details leaked. UPI reports that the previous record was KRW 134.8 billion, imposed on SK Telecom in August 2025 over a leak affecting 23 million users. Fines are already escalating sharply under existing law.
Where the design is sound
The amendment is narrower than a blanket increase. The 10% tier is not the default. It is reserved for recidivism, defiance of a regulator's order, and the largest incidents. Punishing a company that ignores a corrective order is about the most defensible use of a fine there is: it enforces due process rather than substituting for it. The JoongAng Daily also reports that where a violation was not intentional or grossly negligent, a company's preventive investments will be considered when setting the fine. That is the right principle. It rewards security spending and does not treat every breach as equal.
Law-firm summaries from Shin & Kim add that, from 11 September, the CEO is designated as the person ultimately responsible for personal data protection, and that the burden of proof on intent or negligence in breach cases shifts to the company. Putting accountability with the CEO rather than a mid-level privacy officer is the single most useful governance change here. The Coupang finding that the privacy chief was sidelined during the investigation is exactly the failure it targets.
Where the risks are
Three concerns deserve attention.
- The 10-million threshold measures size, not fault. A breach affecting 10 million or more people can trigger the top tier, and in a country of roughly 51 million people that bar is reachable by any large platform. A well-run company that is the victim of a genuinely sophisticated attack could face the same ceiling as one that left signing keys active. The mitigation language protects against this only if the PIPC applies it consistently.
- The revenue base penalises diversified firms. Penalties are pegged to total revenue. For a conglomerate whose breached service is a small business line, a percentage of group-wide revenue has little connection to the harm. Shin & Kim also report that a separate decree change, in effect since 19 May 2026, sets the base at the higher of the preceding year's revenue or the three-year average, which pushes the ceiling up further.
- Discretion is wide and appeals are untested. Coupang has said it intends to clarify the facts through legal procedures. Courts will decide how far the PIPC's reasoning on proportionality holds. Until they do, firms cannot price compliance risk with confidence, and uncertainty falls hardest on domestic start-ups that lack Coupang's legal budget.
What a proportionate regime would do next
Korea does not need to retreat. It needs to make the top tier predictable. First, the PIPC should publish a methodology showing how it weighs prevention spending, speed of notification and cooperation against the 10% ceiling, so that companies can see what a mitigated outcome looks like. Second, it should apply revenue ceilings to the relevant business unit where one can be identified, rather than defaulting to group totals. Third, it should treat the 10-million threshold as a trigger for scrutiny, not as a presumption of culpability.
The PIPC is also working on the other side of the ledger. Its English notice board lists a 27 August 2026 item reporting that a PIPA amendment bill for AI development passed the National Assembly plenary, a sign that the Commission sees data rules as an innovation question too. The credibility of that balance will depend on how the 10% tier is used in its first cases. If it lands on repeat offenders and order-ignorers, it will deserve support. If it lands on victims of sophisticated attacks, it will become a tax on scale that pushes the next generation of Korean platforms toward caution rather than security.