GoKawiilSouth Korea triples maximum data-breach fine to 10% of company revenue
South Korea's Personal Information Protection Commission has enacted rules allowing fines of up to 10% of a company's annual revenue for major data leaks caused by intent or gross negligence, up from the previous 3% cap. The new rules, effective Friday, apply when 10 million or more people's data is exposed, and also require firms to notify users within 72 hours even if a breach is only suspected. The heightened penalty targets repeat offenders within three years or firms that ignore corrective orders and are subsequently breached.
GoKawiil's interpretation of the reporting above, not reported fact.
By tying fines directly to total revenue rather than a fixed penalty, regulators are signaling that lax data security can now threaten a company's core profitability, not just its reputation. The Coupang case, which drew a $466 million fine under the old formula, shows how the new standard could push penalties into the billions of dollars for major leaks, reshaping corporate risk calculations across retail and telecom sectors handling sensitive consumer data.
- Korea raised maximum data-breach fines from 3% to 10% of annual company revenue.
- The stricter penalty applies to breaches affecting 10 million+ people caused by intent or gross negligence.
- Companies must now notify users within 72 hours even if a breach is only suspected, not confirmed.
Source: koreajoongangdaily.com — News Team, 2026-09-18
Published there as: “Korea raises data breach fines to 10% of revenue”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.