South Korea to raise fines to 10% of sales for massive data breaches

South Korea is set to tighten sanctions on corporations that experience massive personal data breaches, with the Personal Information Protection Commission stating that the amended personal information protection law will take effect on Friday. Under the new rules, firms responsible for leaks affecting more than 10 million individuals due to intentional wrongdoing or gross negligence can be fined up to 10 percent of their annual sales, a significant increase from the previous 3 percent cap.

The amendment was prompted by notable incidents, including an e-commerce giant’s breach that exposed over 37 million users. Companies that repeatedly breach privacy regulations within a three-year window or fail to comply with corrective orders will also be subject to the heightened penalties. However, the commission may lower the fine by up to 40 percent if a company can demonstrate substantial investment in personal information protection and related safety measures. The move signals Seoul’s effort to bolster privacy safeguards amid growing cyber-risk concerns.