South Korea strengthens data privacy and anti-spam regulations

South Korea is implementing stricter regulations and punitive fines to enhance digital security and data protection. Under new enforcement decrees, companies responsible for large-scale personal information leaks involving more than 10 million individuals due to intentional or gross negligence may face fines of up to 10% of their total revenue.

To encourage compliance, the Personal Information Protection Commission has introduced a system where companies can receive up to a 40% reduction in fines if they demonstrate proactive investment in security infrastructure, personnel, and management systems. The new rules also increase penalties for repeat offenders and mandate that companies notify the public as soon as a leak is reasonably suspected, even before final confirmation.

In a separate regulatory move, the Korea Communications Commission has finalized measures to combat illegal spam. Starting in October, information and communication service providers that fail to take adequate measures to prevent their services from being used for illegal spam could face fines ranging from 1% to 6% of relevant revenue. These measures include requirements for security vulnerability checks, service restrictions, and improved terms of use to curb the spread of unsolicited messages.