← Data protection and cybercrime laws by country, compared

South Korea: data protection law, cybercrimes, fines and penalties

The PIPC has imposed record fines: SK Telecom (KRW 134.8bn, 2025) and Coupang (about KRW 625bn, 2026).

Law

PIPA (Personal Information Protection Act)

Authority

PIPC (Personal Information Protection Commission)

Max fine

—

Breach notification

—

DPO

—

Risks

• Record fines for large-scale breaches (Coupang: 37.56M people)
• Destroying logs after a preservation order treated as aggravating
• Authentication-key security (SKT: unencrypted keys)
• Late notification to affected users

• SK Telecom has challenged its fine in court

Source: Light Reading – SKT · SBS Star – Coupang · Light Reading – contestação da SKT