Personal Information Protection Commission

Press Release

The PIPC to Investigate Data Breaches in a Faster, Fairer, and More Transparent Manner

- The PIPC will push for a ‘Plan to Expedite Data Breach and Infringement Investigations and Strengthen Investigative Capabilities’

October 2, 2026

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Personal Information Protection Commission (PIPC) will push for a ‘Plan to Expedite Data Breach and Infringement Investigations and Strengthen Investigative Capabilities’ to establish a trustworthy investigative system by responding swiftly and professionally to data breaches and infringements while ensuring fairness and transparency throughout the investigative process.

Recently, the proliferation of AI technologies has made attacks targeting personal information more advanced and sophisticated, increasing the number of data breaches and leaks as well.

Data breach reports rose from 318 in 2023 to 447 in 2025. In 2026, the figure rose significantly to 432 in the first half of 2026, which is almost equivalent to that of 2025.

In particular, organizations holding vast amounts of personal information in the communications, platform, and distribution sectors have experienced or been involved in data breaches, affecting millions to tens of millions of data subjects.

Against this backdrop, the PIPC established the ‘Plan to Expedite Data Breach and Infringement Investigations and Strengthen Investigative Capabilities’ and will push for five key tasks that include:

i) Strategic management of data incident cases

ii)  Introduction of expedited case handling procedures 

iii) Enhancing transparency throughout the investigative procedures 

iv) Capacity building for enforcement and investigations 

v) Disclosure of case-handling status

The following explains the PIPC’s five key tasks.

1. Prioritizing Investigations into Massive Data Incidents and Expediting the Handling of General Data Incidents

Data incidents affecting 1 million or more data subjects, having a significant impact on society, or involving hacks into major public systems will be categorized as serious cases. To address such data incidents, the PIPC will organize a dedicated investigation group to mobilize investigative resources. 

In principle, the PIPC will complete investigations into general data incidents within 6 months and simple data incidents within 4 months.

The PIPC will also organize an on-site response team immediately after a data incident to identify the impacted system and preserve associated evidence. Meanwhile, the PIPC will review an entity’s post-incident measures, including breach notifications and measures to prevent secondary harm.

General data incidents will be categorized depending on the specificity and similarities of each case. The PIPC will also establish violation and sanction criteria to allow similar incidents to be mapped and handled together.

At the same time, the PIPC will address other data incidents involving small and medium enterprises (SMEs) and micro business owners by waiving administrative fines and providing technical support to identify root causes and prevent future incidents. 

* The PIPC has secured budgets to prevent secondary harm and recover from a data breach or incident for 2027.

2. Responding Flexibly to Soaring Data Incidents by Operating Subcommittees

To reduce the burden of holding plenary meetings amid soaring data incidents and handle each case swiftly, subcommittees will be held to deal with cases involving a small-amount of administrative fines. 

First, subcommittees will resolve incidents expected to incur administrative fines of up to KRW 100,000,000. If it works, subcommittees may handle incidents expected to incur administrative fines of up to KRW 1 billion.

With this flexibility, subcommittees can cover approximately 54% to 85% of cases expected to incur administrative fines, ensuring swift enforcement of violations and encouraging entities to take corrective measures.

3. Transparency from Initiating to Closing Investigations

The PIPC will further strengthen procedural transparency to ensure that entities subject to investigation have predictability and are able to exercise their right to defense

To prevent delays in initiating an investigation, the PIPC will designate dedicated staff in each division to receive and review cases early and decide whether to launch an investigation.

If an incident is not serious enough to launch an investigation, the PIPC will notify entities that the case is closed. When an investigation period is extended, the PIPC will notify the extended period on a six-month or twelve-month cycle to increase predictability of investigations.

Moreover, for massive and complex data breaches, the PIPC will brief entities on investigation results to improve understanding of how investigations work and increase acceptance. After briefing the investigation results, the PIPC will give the entities opportunities to voice their views on the incident to help them exercise their right to defense. 

4. Fostering Dedicated Investigators to Strengthen Investigative Capabilities

The PIPC will provide field-specific, tailored training and strengthen basic training with newly appointed investigators to foster dedicated experts. To address discontinuity from job rotations, key investigators will be designated as professional officials to ensure continuity and expertise.

At the same time, the Report Management System (run by the Korea Internet & Security Agency), the Investigation Information System (run by the PIPC), and the Forensics Lab will be platforms for information sharing required for investigations to increase productivity. In the mid-to-long term, the PIPC will review introducing an AI-powered search database during investigations.

5. Being Transparent in Case Handling and Stronger Prevention of Recurring Data Incidents

The PIPC will move away from information disclosure of the number of sanctions and shift toward comprehensive information disclosure that includes:

● Year-and-Entity-Specific Case Handling and Sanctions 

● Investigation Periods on Average 

● Status of Challenging the PIPC’s Decision to the Court 

● Major Data Breaches/Leaks

To calculate administrative fines, the PIPC will disclose imposition criteria, rates, and reduction rates for investment in privacy protection, along with severity assessment and adjustment rates for aggravating and mitigating factors. This change will respect data subjects’ right to know and help companies and public institutions prevent similar data incidents and raise their personal data protection levels.

Chairperson Kyung Hee Song said, “Amid the growing data leaks and breaches that are more complex and large-scale, privacy regulators need flexibility to allocate readily available investigative resources (investigative capabilities) tailored to severity and specificity, rather than taking a one-size-fits-all approach.

She added, “The PIPC will allocate sufficient investigative resources to severe data incidents while handling general and minor incidents on a shorter timeline. At the same time, the PIPC will ensure clarity and predictability in operationalizing the case-handling process and disclose investigation results to establish an investigation system grounded in fairness and transparency.”

* A PDF file, formatted for better readability, is attached.