Three Situations Where Korea's Data Breach Penalty Cap Climbs From 3% to 10%

Read only the headline, that the penalty cap rises from 3% to 10%, and it sounds like a story for large companies. But what an early-stage company should look at first in this amendment is not the cap itself but the baseline that decides whether a violation counts as a repeat. Once a penalty has been imposed, a repeat of the same type of violation brings the special cap and the aggravation rate into play together, and the window is three years from the date of the disposition. Whether you only sealed the one place that leaked, or also cleaned up every other system where the same type of problem could occur, comes back as cost inside those three years.

Korea's amended Personal Information Protection Act took effect on September 11, 2026. The penalty cap is not the only thing that changed. The core question is under which circumstances the cap changes. The general cap of 3% of total revenue stays as it is, and on top of it a special provision was added that allows a penalty of up to 10% of total revenue. Article 64-2, Paragraph 2 of the act sets this out.

Only Three Situations Reach 10%

There are three cases in which the special provision applies.

First, committing the same type of violation again within three years of the date a penalty surcharge was imposed. Second, causing harm to 10 million or more people through intent or gross negligence. Third, a breach that occurs because a corrective order was not carried out.

Put the three side by side and a common thread appears. Only the second reaches 10% on the scale of a single incident alone. The other two look at what happened before. The first presupposes an earlier disposition; the third, an earlier order. The threshold for a higher cap takes in not only the size of the incident but also the record of how it was handled.

Repeats Stack as Multipliers

PIPC Notice No. 2026-12 sets the imposition base rates together with the aggravation rates for repeat violations. The more times a penalty surcharge has been imposed for a violation under the same subparagraph within three years of the disposition date, the higher the aggravation rate: 20% for one prior case, 40% for two, and 80% for three or more.

The same notice also divides the base rate by the severity of the violation: 1.5% or more but under 2.1% for a serious violation, and 2.1% up to and including 2.7% for a very serious one.

Because the two are multiplied, the same incident can end in a very different final amount depending on how many prior dispositions there were. Repeat the same type of violation within three years of one penalty, and the second penalty costs far more than the first.

Three Years Is the Baseline for the Design

Because the repeat-counting period is fixed at three years, date management matters in practice. The reference date is not the day of the incident but the day the disposition was received. If the same type of violation reappears within three years of that date, the case enters the aggravated range.

Here the scope of the response decides the outcome. If you only block the spot where the leak happened, the same type of problem can repeat in another system. The three years after a disposition are the period in which to clear that possibility, and the period in which the cost comes back multiplied if you do not.

The Most Dangerous Stretch Comes After a Corrective Order

The third of the three special grounds is different in kind. The first two ask about the violation itself; the third applies when a breach occurs while an order already received has not been carried out. From the moment the order is received until compliance is complete is the reach of this clause.

In this stretch the size of the incident does not decide the cap. Even below the 10-million-person threshold, even without any repeat, the fact alone that the order was not carried out takes the cap to 10%.

What Could Not Be Confirmed

Some items cannot be settled without opening the notice itself and its annexed tables: the detailed scoring that separates severity grades, the upper and lower bounds of the aggravation ratio applied under the 10% special provision, how intent and gross negligence are each scored, the alternative formula for operators whose total revenue cannot be calculated, and the order in which mitigation and aggravation are combined into the final amount. Whether public institutions and overseas operators are treated the same way also needs to be checked against the source text.

Write Down Two Dates First: the Disposition and the Completion of Compliance

Even before you open the annexed tables, there is something you can do now: record the date a disposition was received and the date compliance with a corrective order was completed. The three-year repeat window starts on the day of the disposition, not the day of the incident, and the third ground for the 10% special provision can apply right up until the order has been carried out. Without those two dates you cannot tell which stretch you are standing in.

Next comes scope. List not just the one system that leaked but every system where the same type of violation could occur, and schedule clearing that list within three years of the disposition date. How soon the list is emptied changes whether the next violation lands in the aggravated range.