First announced: Amendments passed in 2025; phased enforcement through 2026.
Submitted by: NYBACS Compliance Desk
What changed
Updates clarify mandatory breach reporting timelines, enhance user rights, and introduce stricter requirements for overseas data transfers. Administrative penalties and corrective orders have increased.
Who’s affected
Global businesses processing Korean residents’ personal data, e-commerce operators, fintech platforms, cloud providers and multinationals with Korean operations.
Immediate actions
• Review consent and privacy notice language.
• Update cross-border transfer safeguards.
• Align breach notification workflow with new timelines.
• Conduct internal privacy compliance audit.
Practical notes & timeline
Phased enforcement began in 2025 and continues into 2026. PIPC guidance and sector bulletins should be monitored.



