Korea's Data Protection Rules Just Got Harder: Cross-Border Transfers and the September 2026 Amendments

Every foreign company operating in Korea moves Korean personal data across a border. A global HR system, a cloud CRM, a group data warehouse, a support team in another time zone with read access to Korean customer records — each of these is a cross-border transfer under Korean law, and each requires a legal basis.

As of 11 September 2026, getting this wrong costs considerably more than it did.

What counts as a transfer is broader than you think

The Personal Information Protection Act (PIPA) regulates the transfer of personal information outside Korea, and Korean regulatory practice reads "transfer" expansively.

Remote access is transfer. If staff outside Korea can view Korean personal data held on a Korean server, that is a cross-border transfer even though no file was sent anywhere. Storage with an overseas cloud provider is a transfer. Onward transfer by an overseas recipient to a further recipient is separately regulated.

One narrow carve-out matters: where an overseas operator collects personal data directly from Korean data subjects, that collection is not itself treated as a cross-border transfer — but a subsequent transfer by that operator to another party is caught again.

PIPA provides several bases for transfer, including specific and separately obtained consent (with disclosure of the destination country, the recipient, the purpose, the categories of data and the retention period), transfer necessary to perform a contract with the data subject, certification, and an adequacy determination. The Personal Information Protection Commission (PIPC) can also order a transfer to be suspended.

Enforcement is active and not confined to technology companies — the PIPC imposed a fine of KRW 210 million on a Korean virtual asset exchange in June 2026 for cross-border transfer violations arising from order book sharing with an overseas exchange.

What changed today

The amended PIPA (Act No. 21445, promulgated 10 March 2026) took effect on 11 September 2026. Four changes matter for foreign-invested businesses.

1. A 10% turnover ceiling for serious cases. The administrative fine ceiling remains 3% of total turnover as the general rule, but rises to 10% (or KRW 5 billion where turnover cannot be calculated) in three situations: repeating the same type of violation within three years of a previous fine, with intent or gross negligence; a violation committed with intent or gross negligence affecting 10 million or more data subjects; and a leak resulting from failure to comply with a corrective order. Note also that refusing to provide turnover data does not help — the authority may then calculate on total turnover and estimate.

2. Prior investment in data protection is now a mitigating factor. The amendment requires fines to be reduced where the controller has invested in budget, personnel, facilities and systems, with the draft Enforcement Decree setting a reduction of up to 40% of the base amount, applied before other adjustments. The exclusion is significant: it does not apply to violations committed with intent or gross negligence. The practical consequence is that spending on privacy is now directly convertible into reduced exposure — but only if it is documented in a form the regulator can assess.

3. The owner or representative is the ultimate responsible person. A new provision designates the business owner or representative as ultimately responsible for the safe processing of personal information and for providing the expertise and budget required. It carries no standalone penalty, but it interlocks with expanded CPO duties — the CPO must now manage privacy personnel and budget and report privacy status and material issues to the representative and the board — and with the investment-based mitigation above. Privacy has been moved from a departmental function to a board matter as a matter of law.

4. Notification at the "possibility" stage, within 72 hours. The definition of a reportable incident has been widened beyond loss, theft and leakage to include forgery, alteration and damage. More consequentially, notification is now required when the controller becomes aware of the possibility of such an incident — not only when one is confirmed. Under the draft Decree, the trigger is knowledge of unlawful access where there is objective indication of compromise but affected individuals cannot be identified, or confirmation that the controller's data is being illegally traded, with notification due within 72 hours.

This defeats the standard playbook of investigating first and notifying afterwards. It requires a pre-drafted notice that distinguishes what is confirmed from what is not, and an escalation path that reaches a decision-maker within three days — which for a foreign group means a decision-maker who may be asleep in another hemisphere when the clock starts.

And a second deadline on 1 October

Amendments to the Network Act take effect on 1 October 2026, adding turnover-linked fines of up to 6% for violations of the rules on commercial advertising messages, on top of existing administrative fines. The prohibition applies to anyone sending commercial messages — so any company marketing to Korean customers by SMS, email or app push is in scope, and outsourcing to an agency does not necessarily transfer responsibility.

What to do now

• Map your transfers, including remote access and group-internal flows, and identify the legal basis for each. Most companies find at least one flow with no basis at all.

• Rebuild the incident procedure around 72 hours from possibility, and pre-draft the notices.

• Document your privacy investment — budget, headcount, systems, board reporting — in a form usable in a mitigation submission.

• Check the CPO position: whether designation, board approval and notification to the PIPC are required for your entity, and whether your CPO meets the qualification requirements. These duties also apply to processors handling personal data on behalf of others.

• Separate your revenue by business line, so that turnover unrelated to a violation can actually be demonstrated.

• Watch the subordinate legislation. Several details above sit in draft Decrees and PIPC guidance that are still being finalised.

  
  

How we work on these matters. We advise foreign companies and their Korean subsidiaries on PIPA compliance with a focus on the places where a global privacy programme built for GDPR does not map onto Korean requirements — and cross-border transfer, incident notification and the new governance obligations are exactly those places. We work directly with headquarters privacy teams in English and with Korean operations in Korean, and we give a clear view of where the real exposure sits rather than a checklist of everything the statute mentions.

For companies that have not reviewed their Korean data flows since the amendments were passed, the useful first step is a transfer map and a gap assessment. It is a contained piece of work, and the mitigation credit now available makes it a better investment than it was last week.