South KoreaInformation and Communications Infrastructure Protection Act, Notification of Cyber Security Incidents
Act on the Protection of Information and Communications Infrastructure (정보통신기반 보호법, Act No. 6383, , as last amended by Act No… . 20068, ), Arts. 13 and 14
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to the head of an organization that manages information and communications infrastructure a central administrative agency has designated as critical information and communications infrastructure, which includes private operators and public bodies; reached by declaring that you operate an essential service.
- Notify a relevant administrative agency, an investigation agency or the Korea Internet and Security Agency when you recognize that a cyber security incident has disturbed, paralyzed or destroyed the designated infrastructure (Article 13(1)).
- Take swift measures to recover and protect the infrastructure after a cyber security incident, and comply with a recovery and protection order from the relevant central administrative agency (Article 14(1) and (2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 30(1) sets an administrative fine of up to 50 million won for failing to comply with a recovery and protection order under Article 14(2) or (3)
- Rule
- Fixed only
- As of
- Currency
- KRW
- Fixed cap
- 50,000,000
Who enforces it
Enforcement body
The relevant administrative agency, investigation agency or the Korea Internet and Security Agency that receives the notification, and the head of the relevant central administrative agency that may order recovery measures.
Settledness
- As of
- Open questions
- Within what time must the Article 13 notification be given, given that the Act states no time limit and no penalty for failing to give it?
What this law does
Article 13(1) of the Act requires the head of a management organization that recognizes a cyber security incident has disturbed, paralyzed or destroyed critical information and communications infrastructure to notify a relevant administrative agency, an investigation agency or the Korea Internet and Security Agency. Article 14(1) requires that head to take swift measures to recover and protect the infrastructure after a cyber security incident.
Article 8(1) lets the head of a central administrative agency designate information and communications infrastructure under its jurisdiction as critical information and communications infrastructure. Article 30(1) sets an administrative fine of up to 50 million won for failing to comply with a recovery and protection order under Article 14(2) or (3). The Act entered into force on .
When LexLint raises it
When your app profile says your app runs an essential service.