Personal Information Protection Act, enforcement and private civil remedy

Criminal exposureYes

Private right of actionYes

Criminal exposure note

PIPA Chapter X, Penalty Provisions, confirmed current: Art. 70 punishes causing suspension, paralysis or severe hardship to a public institution's work by altering or erasing its data, or comparable unauthorized-access conduct, with imprisonment with labor of up to 10 years or a fine up to KRW 100,000,000; Art. 71 punishes several unauthorized processing and disclosure offenses (including providing personal information to a third party without consent) with imprisonment up to 5 years or a fine up to KRW 50,000,000; Art. 72 (misuse of visual data processing devices and related conduct) carries imprisonment up to 3 years or a fine up to KRW 30,000,000; Art. 73 (various safeguard and procedural failures) carries imprisonment up to 2 years or a fine up to KRW 20,000,000. Art. 74 imposes joint liability: where a corporation's representative, agent or employee commits an Art. 70 offense in the course of the corporation's business, the corporation itself is also fined up to KRW 70,000,000, absent due care.

Penalty structure

Art. 64-2(1), confirmed against the KLRI English consolidation that reflects Act No. 20897 (Apr. 1, 2025): the Protection Commission may impose a penalty surcharge on a personal information controller not exceeding 3/100 (3 percent) of total sales, or up to KRW 2,000,000,000 where no sales exist or sales cannot be calculated. Act No. 20897 (in force 2 October 2025) changed the domestic agent rules and left this article as it was. A further amendment that the PIPC announced for promulgation on 10 March 2026 adds a special provision for repeated or significant data breaches with sanctions of up to 10 percent of annual turnover, and the PIPC announced that it takes effect on September 11, 2026; the KLRI English consolidation does not yet carry it, so the 3 percent figure above is the general cap that the English consolidation confirms.

Rule

Turnover pct only

As of

15 October 2026

Currency

KRW

Turnover percentage cap

3

Statutory damages

Art. 39-2(1), confirmed unchanged in the KLRI consolidation reflecting Act No. 20897 (still reads 'three million won'): a data subject who suffers damage from loss, theft, divulgence, forgery, alteration or damage of their personal information caused by a controller's intention or negligence may claim a reasonable amount of damages not exceeding KRW 3,000,000, without needing to prove the controller's fault; the controller bears the burden of proving the absence of intention or negligence. The reversed burden of proof, not a negligence finding by the plaintiff, is what unlocks this ceiling. A separate remedy sits at Art. 39(3): where the loss, theft, divulgence, forgery, alteration or damage of personal information was caused by the controller's intention or negligence, the court may determine compensation of up to five times the damage, unless the controller proves the absence of intention or negligence. Art. 51 authorizes an injunction-only group action by qualified consumer or civic organizations to stop an ongoing infringement, not a damages class action, so no class action is available for a damages claim.

As of

2 September 2026

Currency

KRW

Per person negligent

3,000,000

Enforcement body

Personal Information Protection Commission (PIPC), Korea's independent data protection authority, established under the Prime Minister as a central administrative agency under PIPA Art. 7.

Settledness

As of

20 October 2026

Guidance link

https://www.pipc.go.kr/np/cmm/fms/FileDown.do?atchFileId=FILE_000000000556898&fileSn=0&fileExtsn=pdf

Guidance body

Personal Information Protection Commission (PIPC), Republic of Korea

Open questions

How does a court fix "a reasonable amount of damages not exceeding three million won" under Article 39-2(1) of the Personal Information Protection Act for each data subject when one divulgence affects many data subjects?

Logging duty

Articles 39 and 39-2 give a damages claim and a statutory damages claim and leave the controller liable unless it proves the absence of intention or negligence; Article 64-2 lets the Protection Commission impose a penalty surcharge. A burden of proof in a civil claim is not a duty to keep a record, and none of the cited sections names a log, a register or a reader of one. The sections carry no territorial clause, so the row carries no jurisdiction hook.

Kind

None

As of

28 October 2026