Find XO: From September 11, Personal Information Notification Obligations Begin Before Confirming a Leak (law.go.kr)

- The amended Personal Information Protection Act, effective September 11, adds forgery, alteration, and damage to the notification targets, and requires alerts even at the possibility stage before confirming a leak. - The enforcement ordinance setting the activation conditions for the 72-hour deadline has only completed its legislative notice stage. - The real challenge for small teams lies more in record keeping than in fines. - Start by developing the habit of recording who and when viewed unfamiliar login alerts accumulating in Slack.