The amended Personal Information Protection Act, revised in March, and an amended enforcement decree detailing delegated matters will take effect from Sept. 11.

Under the revised act, punitive administrative fines of up to 10 percent of total revenue will be introduced for personal data leaks caused by repeated conduct or by intent or gross negligence, to strengthen responses and encourage proactive preventive investment. A mandatory system to reduce fines in connection with preventive personal data protection investment will also be introduced.

To strengthen personal data protection responsibility and management systems, the revised act will specify ultimate responsibility for business owners and representatives, referred to as CEOs. It will also strengthen the duties and authority of chief privacy officers, referred to as CPOs. Board resolutions and notifications will be mandatory when personal information processors appoint, change or release a CPO.

The revisions will also introduce a new system requiring notification of the possibility of personal data leaks. Items required in leak notifications will be expanded, including notices on applying for dispute mediation and methods for claiming damages. Forgery, alteration or damage of personal data, including ransomware, will be included in the scope of leak reporting and notification.

The amendments also include making personal data protection (ISMS-P) certification mandatory for key personal information processors in the public and private sectors, but this provision is set to take effect from July 1, 2027, considering the time needed for companies and institutions to secure budgets to obtain ISMS-P certification.

Song Kyung-hee (송경희), chair of the Personal Information Protection Commission, said the enforcement of the amended laws and regulations is expected to establish personal data protection focused on prevention and a strengthened security management system. It is also expected to shift perceptions of investment in personal data protection from a "cost" to a "proactive investment" to secure customer trust and increase corporate profits, she said.