South KoreaPersonal Information Protection Act, breach notification duties
Act No. 10465 (as amended by Act No. 19234, 2023), Art. 34; Enforcement Decree Arts. 39-40
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that suffers a leak, theft, loss, forgery, alteration or damage of Korean personal data must notify affected data subjects within 72 hours of becoming aware of it, or without delay once the cause ceases to exist where urgent containment measures are needed or an unavoidable cause such as a natural disaster prevents it (Enforcement Decree Article 39(1)).
- Where unauthorized access to a personal-information system or to a handler's device suggests a breach but the affected data subjects are hard to identify, or where some personal information is found traded unlawfully so that other data subjects' data may also have been breached, notify every data subject who may be affected within 72 hours of learning of it, stating that a further notice follows if the breach is confirmed (Article 34(2); Enforcement Decree Articles 39-2 and 39-3).
- Report the breach to the PIPC or the Korea Internet and Security Agency within 72 hours of becoming aware of it if it affects 1,000 or more data subjects, involves sensitive information or unique identification information, or resulted from unauthorized access from outside, or without delay once the cause ceases to exist where an unavoidable cause prevents it (Enforcement Decree Article 40(1)).
These lines are LexLint's reading of the law's text. Also read by: Personal Information Protection Commission (PIPC), Republic of Korea (guidance, recorded ); Supreme Court of Korea, judgment of , Case No. 2011Da24555 (recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.pipc.go.kr/np/cmm/fms/FileDown.do?atchFileId=FILE_000000000561437&fileSn=0&fileExtsn=pdf
- Case citation
- Supreme Court of Korea, judgment of , Case No. 2011Da24555
- Guidance body
- Personal Information Protection Commission (PIPC), Republic of Korea
- Open questions
- Where a controller learns of unauthorized access to its personal-information system and only later finds a circumstance in which a breach is suspected ("개인정보 유출등이 의심되는 정황", a circumstance in which a breach of personal information is suspected), does the 72-hour period for the possible-breach notice run from the time it learns of the access ("해당 불법적인 접근을 알게 된 때", when it learns of that unauthorized access) under Enforcement Decree Articles 39-2(1)(1) and 39-3(1), or from the time it learns of the suspicious circumstance?
What it makes you log
Logging duty
Article 34 requires the controller to notify data subjects, to prepare countermeasures and to file a report with the Protection Commission or the Korea Internet and Security Agency, and Enforcement Decree Articles 39 and 40 set the 72-hour period. The texts impose a duty to notify and report only; none asks the controller to document or register the breach, and none names a reader of a record. The sections carry no territorial clause, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
Article 34(1) requires a controller to notify the affected data subjects without delay on becoming aware that personal information has been breached. A breach here covers the loss, theft, divulgence, forgery, alteration or damage of personal information. Act number 21445 added forgery, alteration and damage to the cases that call for notice. Act number 21445 was promulgated on and took effect on .
Enforcement Decree Article 39(1) sets that notice at within 72 hours. A controller may notify later, once the cause is removed, where urgent measures to stop the spread of the breach are needed or a natural disaster or other unavoidable cause makes the 72 hours hard to meet. Article 34(2) separately requires a controller to notify, without delay, every data subject who may have been affected when it learns of a possible breach of a kind the Enforcement Decree sets.
Enforcement Decree Article 39-2(1) sets two such cases, unauthorized access to a personal-information system or a handler's device that suggests a breach where the affected data subjects are hard to identify, and the unlawful trading of some personal information that suggests other data subjects' data may also have been breached. Enforcement Decree Article 39-3(1) sets that notice at within 72 hours of the time Article 39-2(1) fixes.
Article 34(4) requires a controller that learns of a breach to report it without delay to the Personal Information Protection Commission or a specialized body the Presidential Decree names. Enforcement Decree Article 40(3) names the Korea Internet and Security Agency as that body.
Enforcement Decree Article 40(1) sets the report at within 72 hours, with a later report permitted where an unavoidable cause intervenes, and no report needed where recovery or deletion of the data makes harm to data subjects very unlikely. The report is due where 1,000 or more data subjects are affected, sensitive information or unique identification information is involved, or the breach came through unauthorized access from outside.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .