Korea Enforces Hefty Fines for Major Data Breaches

• •Korea's new privacy rules impose fines up to 10% of annual revenue for major data breaches.
• •Coupang was fined 642.68 billion won for a breach affecting over 33 million users.
• •Companies can reduce fines by demonstrating prior investment in data protection measures.

Under revised privacy rules effective September 18, 2026, companies in Korea can face fines of up to 10% of their annual revenue for significant data breaches. This law targets firms that leak personal data of 10 million or more individuals due to intent or gross negligence. The Personal Information Protection Commission (PIPC) aims to enhance accountability and encourage proactive data protection investments. Coupang, a major e-commerce platform, was recently fined 642.68 billion won for a breach affecting over 33 million users. Despite this, Coupang rejected a consumer agency's proposal to compensate affected users with 100,000 won each. The company has already provided 50,000 won in shopping vouchers to those impacted. The new regulations also allow for reduced fines for companies that demonstrate prior investment in data protection. The overall goal is to prevent future breaches and hold violators strictly accountable.