Korea's PIPA Overhaul Takes Effect Friday: CEO Liability, 10% Fines

South Korea's amended Personal Information Protection Act takes legal effect Friday, 11 September 2026 — three days out — naming the CEO as ultimately responsible for data protection and adding fines of up to 10% of total annual turnover for systemic failures.

For the first time in a major Asia-Pacific privacy regime, accountability is written to the top of the org chart. Korea's Personal Information Protection Commission (PIPC) can now hold the CEO — not just the data-protection function — ultimately responsible for compliance, and can pursue penalties of up to 10% of total annual turnover for the most serious failures. The 3% baseline penalty stays; the 10% tier is reserved for repeat serious violations within three years, single incidents affecting 10 million or more people, or blatant disregard of a prior corrective order.

The governance mechanics matter as much as the fines. For larger controllers, appointing, reassigning, or dismissing the Chief Privacy Officer now requires board approval and a report to the PIPC — a structural check boards must own, not delegate. Verified, documented privacy investment can mitigate penalties where a violation is not intentional or grossly negligent, so the evidence you keep now is what limits exposure later. Mandatory ISMS-P certification for designated large-scale controllers follows on 1 July 2027.