What are the South Korea PIPA compliance deadlines?

Mar 10, 2026: 2026 PIPA amendment promulgated (Act No. 21445). Sep 11, 2026: 2026 PIPA amendments take effect. Jul 1, 2027: Mandatory ISMS-P certification.

When does South Korea PIPA take effect?

South Korea PIPA took effect on Sep 30, 2011. The next milestone is Jul 1, 2027: Mandatory ISMS-P certification.

Who does South Korea PIPA apply to?

All personal information controllers (public and private) processing personal information of people in Korea; foreign controllers above set thresholds must designate a domestic representative. 10% fines apply to repeat intentional or grossly negligent violations within 3 years, intentional or grossly negligent conduct affecting 10 million+ people, or a breach after ignoring a PIPC corrective order.

What are the penalties under South Korea PIPA?

Before 11 Sept 2026: penalty surcharge up to 3% of total revenue (excluding revenue unrelated to the violation), in place since 2023. From 11 Sept 2026: up to 10% of total revenue in aggravated cases, with reductions for qualifying privacy investment. Criminal penalties also apply.

South Korea PIPA

Amended South Korea · In force Sep 30, 2011 · next deadline Jul 1, 2027 (in 8 months)

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Coming up

ComplianceJul 1, 2027 · in 8 months · Source

Mandatory ISMS-P certificationISMS-P certification becomes mandatory for private entities meeting the statutory criteria.

Already passed

Takes effectSep 11 · 46 days ago · Source

2026 PIPA amendments take effect10%-of-revenue fines, CEO accountability, and notice duties for possible breaches apply.

MilestoneMar 10 · 8 months ago · Source

2026 PIPA amendment promulgated (Act No. 21445)Amendment raising fines to 10% of revenue and adding CEO accountability promulgated.

Summaries for reference, not legal advice. Check the official text.

What it does

Korea's comprehensive privacy law, with consent-centric processing, breach notification, cross-border transfer rules, automated decision rights (since 2024), and revenue-based penalty surcharges. The 2026 amendment, effective 11 September 2026, raises the maximum fine to 10% of total revenue for aggravated cases, makes the CEO the ultimate responsible person, requires notice when a breach is merely possible, and makes ISMS-P certification mandatory for certain entities from 1 July 2027.

Who it applies to: All personal information controllers (public and private) processing personal information of people in Korea; foreign controllers above set thresholds must designate a domestic representative. 10% fines apply to repeat intentional or grossly negligent violations within 3 years, intentional or grossly negligent conduct affecting 10 million+ people, or a breach after ignoring a PIPC corrective order.
Penalties: Before 11 Sept 2026: penalty surcharge up to 3% of total revenue (excluding revenue unrelated to the violation), in place since 2023. From 11 Sept 2026: up to 10% of total revenue in aggravated cases, with reductions for qualifying privacy investment. Criminal penalties also apply.
Enforced by: Personal Information Protection Commission (PIPC)
Official name: Personal Information Protection Act (as amended by Act No. 21445, 2026)
Citation: Act No. 10465 (2011); latest amendment Act No. 21445 (promulgated 10 Mar 2026)
Topics: Privacy, Breach notification, Biometrics, Data residency

Verified 2026-09-22 pipc.go.kr hunton.com iapp.org yulchon.com

Research notes

The National Assembly passed the amendment on 12 Feb 2026 and the PIPC announced promulgation for 10 Mar 2026 with effect from 11 Sep 2026. Fact-check 2026-09-22 confirmed on law.go.kr; Addendum Art 1 sets effect 6 months after promulgation, except the Art 32-2(1) proviso (mandatory certification for controllers meeting Presidential Decree criteria on revenue and processing scale) and Art 75(2)15, which apply from 1 July 2027; Art 64-2(2) sets the 10% of total revenue cap (KRW 5 billion where revenue cannot be calculated) for repeat intentional or grossly negligent violations within 3 years, violations affecting 10 million+ people, or breaches after ignoring a corrective order. The 3% pre-existing cap comes from the 2023 amendment. The 2011 enactment and effective dates come from general knowledge. The ISMS-P scope criteria are set by decree.

In forceAustralia

Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024

AmendedAustralia

Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days

AmendedAustralia

Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018

In forceChina

China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022

In forceChina

China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026

In forceChina

China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024

In forceChina

China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025

AmendedChina

China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017

Questions about South Korea PIPA

What are the South Korea PIPA compliance deadlines?: Mar 10, 2026: 2026 PIPA amendment promulgated (Act No. 21445). Sep 11, 2026: 2026 PIPA amendments take effect. Jul 1, 2027: Mandatory ISMS-P certification.
When does South Korea PIPA take effect?: South Korea PIPA took effect on Sep 30, 2011. The next milestone is Jul 1, 2027: Mandatory ISMS-P certification.
Who does South Korea PIPA apply to?: All personal information controllers (public and private) processing personal information of people in Korea; foreign controllers above set thresholds must designate a domestic representative. 10% fines apply to repeat intentional or grossly negligent violations within 3 years, intentional or grossly negligent conduct affecting 10 million+ people, or a breach after ignoring a PIPC corrective order.
What are the penalties under South Korea PIPA?: Before 11 Sept 2026: penalty surcharge up to 3% of total revenue (excluding revenue unrelated to the violation), in place since 2023. From 11 Sept 2026: up to 10% of total revenue in aggravated cases, with reductions for qualifying privacy investment. Criminal penalties also apply.

Deadlines

What it does

Related