Two clocks, not one
A company that becomes aware of a personal data breach in Korea is on two separate 72-hour clocks. One runs to the data subjects. The other runs to the regulator, and only starts if one of three triggers is met. Meeting one duty does not discharge the other, and the two have different content requirements.
Since 11 September 2026 there is a third clock, and it is the one that catches foreign groups by surprise: it starts on suspicion, before any leakage has been confirmed.
What follows is the shape of the duty, taken from the Act and the Enforcement Decree, with the basis for each line. The figures are read from the same rule file the Korean page uses, so the two cannot drift apart.
1 · Notifying data subjects
| Clock starts | becoming aware that personal data has been leaked, lost or stolen (together, “leakage”) |
| Deadline | within 72 hours |
| Who must be told | the data subjects whose personal data was leaked |
| How | in writing or by equivalent means — post, email, telephone, text message and the like |
| Basis | Act art. 34(1); Decree art. 39(1) |
The notice must carry all 6 items below. A notice sent inside the deadline but missing an item has itself been treated as a breach of the duty. These are items 1 to 6 of article 34(1) of the Act. Item 7 of the same paragraph leaves any further matters to the Presidential Decree.
| # | What must be in the notice | Basis |
|---|---|---|
| 1 | the categories of personal data leaked | Act art. 34(1)1 |
| 2 | when the leakage occurred and how it happened | Act art. 34(1)2 |
| 3 | what the data subject can do to limit the harm, in concrete terms | Act art. 34(1)3 |
| 4 | the steps the controller has taken and how the data subject can seek redress | Act art. 34(1)4 |
| 5 | the team and contact details for reporting harm | Act art. 34(1)5 |
| 6 | the data subject’s legal rights — damages, statutory damages and dispute mediation — and how to exercise them | Act art. 34(1)6 (new, in force 11 September 2026) |
When the 72 hours can move
| Ground | Effect | Basis |
|---|---|---|
| urgent measures are needed to stop the spread or further leakage — closing the access path, checking for vulnerabilities, recovering or deleting the data | notify immediately once that ground has been resolved | Decree art. 39(1)1 |
| a natural disaster or other unavoidable cause makes notification within the deadline impracticable | notify immediately once that ground has been resolved | Decree art. 39(1)2 |
| the categories (item 1) or the timing and circumstances (item 2) have not yet been established in detail | notify first of the fact of leakage, what is known so far and items 3 to 6; notify the rest as soon as it is established | Decree art. 39(2) |
| there is good reason, such as not knowing how to reach the data subject | post the matters in Act art. 34(1) on the website for at least 30 days (if there is no website, in a conspicuous place at the place of business for at least 30 days) | Act art. 34(1) proviso; Decree art. 39(3) |
2 · Reporting to the authority
| To | the Personal Information Protection Commission (PIPC) or the Korea Internet & Security Agency (KISA) |
| Deadline | within 72 hours |
| How | in writing or by equivalent means |
| Basis | Act art. 34(4); Decree art. 40(1); Decree art. 40(3) |
Any one of the 3 triggers below is enough. They are not cumulative — a single sensitive-information record can bring the duty even where the headcount is small.
| Trigger | Basis |
|---|---|
| personal data of 1,000 or more data subjects was leaked | Decree art. 40(1)1 |
| sensitive information or unique identifying information was leaked | Decree art. 40(1)2 |
| the leakage resulted from unlawful external access to the personal data processing system or to a handler’s device | Decree art. 40(1)3 |
| Ground | Effect | Basis |
|---|---|---|
| a natural disaster or other unavoidable cause makes reporting within the deadline impracticable | report immediately once that ground has been resolved | Decree art. 40(1) proviso |
| the route of the leakage has been established and the risk to the data subjects has become markedly low because the data was recovered or deleted | the controller may choose not to report | Decree art. 40(1) proviso |
| the categories (item 1) or the timing and circumstances (item 2) have not been established | report first the fact of leakage, what is known so far and items 3 to 5; report the rest as soon as it is established | Decree art. 40(2) |
3 · Notifying a possible leakage — new, in force 11 September 2026
Until 11 September 2026 the duty to notify arose only once a leakage was established. Two situations now start the clock on suspicion, and the notice goes to every data subject whose personal data may have been leaked within 72 hours (Act art. 34(2); Decree art. 39-2; Decree art. 39-3).
| Situation | Clock starts | Basis |
|---|---|---|
| there has been unlawful access to the personal data processing system or to a handler’s device, there are signs of leakage, but it is difficult to identify whose data is affected | when the controller became aware of that unlawful access | Decree art. 39-2(1)1 |
| it is confirmed that some of the personal data has been leaked — for example, it is being traded by a third party in breach of law — and other data subjects’ data may also have been leaked | when the controller became aware of that fact | Decree art. 39-2(1)2 |
| # | What the possible-leakage notice must carry | Basis |
|---|---|---|
| 1 | the categories of personal data that may have been leaked | Decree art. 39-2(2)1 |
| 2 | when the leakage is suspected or accepted to have occurred, and how | Decree art. 39-2(2)2 |
| 3 | the matters in Act art. 34(1)3 to 5 — how to limit the harm, the controller’s response and redress, and the contact point | Decree art. 39-2(2)3 |
| 4 | that a further notice will follow once it is established whether a leakage occurred | Decree art. 39-2(2)4 |
| What happens next | Effect | Basis |
|---|---|---|
| an actual leakage is confirmed within the deadline | give the notice under Act art. 34(1) instead of the possible-leakage notice | Decree art. 39-3(2) |
| it is later confirmed that no leakage in fact occurred | tell the data subjects that immediately | Decree art. 39-3(3) |
| there is good reason, such as not knowing how to reach the data subject | post on the website for at least 30 days (if there is no website, at the place of business for at least 30 days) | Decree art. 39-3(4) |
4 · The duty that has no deadline
take measures to keep the harm to a minimum, including recovering or deleting the leaked data to stop the harm spreading (Act art. 34(3)). This is a separate duty from notification and reporting, and it carries no deadline of its own. It is one of the items the Commission actually weighs as a mitigating factor in its decisions.
5 · Financial institutions — notification and reporting under the Credit Information Act
Everything above is the Personal Information Protection Act. Where what leaked is personal credit information held by a financial institution or another entity covered by the Credit Information Act, that Act sets its own notification and reporting rules (Credit Information Act art. 39-4 · Credit Information Act Decree art. 34-4). The notice goes to the credit information subjects whose personal credit information was leaked.
| Situation | Effect | Basis |
|---|---|---|
| a credit information company or other entity covered by the Act becomes aware that personal credit information has been leaked for a purpose other than its business | it must notify each affected credit information subject individually and without delay. The content of the notice follows, with the necessary modifications, the items listed in article 34(1) of the Personal Information Protection Act. | Credit Information Act art. 39-4(1) · Credit Information Act Decree art. 34-4(1) |
| personal credit information of 10,000 or more credit information subjects was leaked | it must report the notification and the outcome of its harm-limiting measures, without delay, to the Financial Services Commission (FSC) or the Financial Supervisory Service (FSS). | Credit Information Act art. 39-4(3) · Credit Information Act Decree art. 34-4(4), (5) |
| public announcement where personal credit information of 10,000 or more credit information subjects was leaked | in addition to individual notices, it must make the fact of the leakage widely known by one of three means — posting on its website, making it available for inspection at its offices or branches, or publishing it in a newspaper. The period is 15 days for website posting and for inspection at offices or branches, and 7 days for newspaper publication (FSC Supervisory Regulation on the Credit Information Business, art. 43-5). | Credit Information Act Decree art. 34-4(2) · FSC Supervisory Regulation on the Credit Information Business art. 43-5 |
| the FSC or the FSS receives that report | the FSC or the FSS must inform the Personal Information Protection Commission (PIPC). | Credit Information Act art. 39-4(5) |
| the entity is a provider or user of credit information that is not supervised by the FSC (a “commercial enterprise or corporation”) | it must report to the PIPC, or to the body designated under article 34(4) of the Personal Information Protection Act, instead of the FSC or the FSS. | Credit Information Act art. 39-4(4) · Credit Information Act Decree art. 34-4(8) · Credit Information Act art. 45-3(1) |
| Exception — notification where it is clear that the leakage has caused no harm and measures to stop the spread or further leakage are urgently needed | it may notify the credit information subjects without delay after taking those measures. | Credit Information Act Decree art. 34-4(3) |
| Exception — reporting in the same situation | it may first tell the FSC or the FSS that the leakage occurred, and file the report form without delay after taking the measures. | Credit Information Act Decree art. 34-4(7) |
The hour-based deadlines and the PIPC/KISA reporting triggers on this page are those of the Personal Information Protection Act. The Credit Information Act itself says only “without delay”, and neither its Enforcement Decree nor the FSC supervisory regulation sets a deadline counted in hours. How the two sets of rules overlap for a financial institution has to be reviewed case by case. (Credit Information Act art. 3-2(2) · Credit Information Act art. 39-4 · Credit Information Act Decree art. 34-4 · FSC Supervisory Regulation on the Credit Information Business Table 4)
This section is limited to leakage of personal credit information held by entities covered by the Credit Information Act. (Credit Information Act art. 39-4(1))
Rules as at 2026-09-11 · Personal Information Protection Act (Act No. 21445, in force 11 September 2026) · Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 36671, in force 11 September 2026) · Credit Information Use and Protection Act (version in force 11 September 2026) · Enforcement Decree of the Credit Information Use and Protection Act (version in force 11 September 2026)
A 24-hour clock under the Network Act
The Network Act figures in this section are taken from the statute text, not from the rule file used above.
The 72-hour clocks above come from the Personal Information Protection Act. A company that is also an information and communications service provider under the Act on Promotion of Information and Communications Network Utilization and Information Protection ("the Network Act") has a shorter clock when a hacking incident is involved. Under the first sentence of art. 48-3(1) of the Network Act, the provider must report an "infringement incident" (침해사고) to the Minister of Science and ICT or to KISA within 24 hours of becoming aware that it occurred. Under art. 58-8(1) of the Network Act Enforcement Decree, the report covers the date and time, the cause and the damage, the response so far, and the department and contact handling the response. Under art. 58-8(2), facts confirmed after the report must be reported within a further 24 hours of their confirmation.
Since 1 October 2026 the 24-hour deadline has been in the Act itself; before that date it was set by the Enforcement Decree. From the same date a provider that does not report, or reports late, is liable to an administrative fine of up to KRW 50 million under art. 76(1)(2). The former provision, art. 76(1)(6-6), which set a cap of KRW 30 million, was deleted. A Korean incident procedure that still cites the former provision needs both the provision and the amount corrected.
The two reports substitute for each other in one direction only. The second sentence of art. 48-3(1) treats a provider that has already notified or reported the incident under another statute as having made the Network Act report, so a report to the Personal Information Protection Commission under art. 34(4) of the Personal Information Protection Act also counts as the Network Act report. Neither statute contains a rule that works the other way, so a report to the Minister or to KISA under the Network Act is not stated to discharge the art. 34(4) report. Art. 48-3(3) requires an authority that receives such a report to share the information with the Minister or KISA without delay. That provision governs information passing between agencies; it does not release the company from either duty.
The practical risk is timing. A team that relies on the substitution and prepares a single report against the 72-hour deadline may file after the 24 hours have already run. We have not found, in published material, an interpretation by the Commission or the Ministry on whether a report filed after 24 hours meets the Network Act deadline. On the structure of the provisions, we think the safer course is to build the first-day process around the 24-hour clock.
Both clocks start at awareness: awareness that the incident occurred under art. 48-3(1), and awareness of the leakage under art. 40(1) of the Enforcement Decree of the Personal Information Protection Act. Neither provision distinguishes between a company that detects the incident itself and one that learns of it from a regulator or a third party. Where KISA or another party makes contact first, the company should record the time and channel of that contact as soon as it is received. In our reading, the time of that contact, and not the time the company finished its own checks, fits the wording of both provisions as the starting point.
Since 1 October 2026 the provider also has a duty to users. Art. 48-3(4) requires it to notify users without delay of the incidents listed in art. 58-9(1) of the Network Act Enforcement Decree, which include an incident in which user information is lost, stolen, leaked, altered, damaged or misused, or may have been. That duty can therefore arise before any leakage is confirmed. A notice already given under another statute counts as this notice, and failure to notify is subject to a fine of up to KRW 10 million under art. 76(4)(11-4). This notice goes to users under a different provision, with different conditions, from the art. 34 notice to data subjects. An incident procedure that keeps the two in one line risks completing only one of them.
What the Commission has actually done about late notification
Deadlines read the same in every jurisdiction. What differs is what the regulator does when they are missed, and that is visible in the published decisions.
Of the decisions the Personal Information Protection Commission has published, 121 turned on breach of the notification or reporting duty. Where the decision records both the date of awareness and the date of notification, the median delay in notifying data subjects was 14 days, and the median delay in reporting to the authority was 6 days. The slowest notification in that set took 940 days.
Two things follow for a group with a Korean subsidiary.
The delays that get punished are measured in days, not months. A median of 14 days means the Commission is not reserving enforcement for companies that sat on an incident for a quarter. An internal escalation path that routes a Korean incident through a regional office and then headquarters will consume that budget on its own.
Completeness is a separate exposure from timing. There are decisions where the notice went out inside the deadline and the company was still found in breach, because one of the statutory items was missing. A template written for another regime will not carry all six items in art. 34(1)(1) to (6). The sixth item, on the data subject's right to damages, statutory damages and dispute mediation, was added on 11 September 2026 and has no direct counterpart elsewhere. Item 7 of the same paragraph leaves any further matters to the Presidential Decree.
Where this differs from what your playbook probably says
- The clock starts at awareness, not at confirmation. For the possible-leakage notice it starts at awareness of unlawful access, even where you cannot yet say whose data is involved.
- The reporting triggers are alternatives. One record of sensitive information or unique identifying information brings the duty regardless of headcount.
- "Notify the regulator" is not one address. The report goes to the Commission or to KISA.
- Deferral is narrow and must be justified. The grounds are listed above; commercial inconvenience is not among them.
- Recovering or deleting the data is a third duty, separate from the two notices and with no deadline of its own. It is also one of the things the Commission weighs when it comes to the amount.
Related
- PIPC enforcement decisions — the published decisions, by article, disposition and year
- Penalty surcharge calculator — how the amount is built under the Act and the Notice
- Domestic representative — who must appoint one, and what the appointment actually carries
- English notes — the rest of the English material
Frequently asked questions
Q. How long do you have to report a data breach in South Korea?
72 hours, on two separate clocks. Data subjects must be notified within 72 hours of the controller becoming aware of the leakage (Personal Information Protection Act art. 34(1) and Enforcement Decree art. 39(1)), and the Personal Information Protection Commission or KISA must be notified within 72 hours where any one of three triggers is met (art. 34(4) and Enforcement Decree art. 40(1)). The two duties are separate: meeting one does not discharge the other.
Q. If a hacking incident leaks personal data in Korea, do we report under both the Network Act and the Personal Information Protection Act?
An information and communications service provider can face both. Art. 48-3(1) of the Network Act requires an infringement incident to be reported to the Minister of Science and ICT or to KISA within 24 hours of becoming aware of it, while the leakage report to the Personal Information Protection Commission or KISA runs on 72 hours (art. 34(4) and Enforcement Decree art. 40(1)). Substitution runs one way only: a report already made under another statute, including the leakage report to the Commission, counts as the Network Act report, but no provision treats a Network Act report as discharging the leakage report. Because the 24-hour deadline comes first, we think the safer course is to plan the first day around it. The notice to users under art. 48-3(4), in force since 1 October 2026, is a separate duty.
Q. What is the penalty for late breach notification in Korea?
Late notification is itself a breach of the duty. Failing to notify data subjects, or to report to the Commission or KISA, is subject to an administrative fine of up to KRW 30 million (art. 75(2)17 and 18); the Enforcement Decree sets the standard amounts at KRW 9 million, 18 million and 30 million for a first, second and third breach (art. 63 and Annex 2), and the Commission imposes it in its enforcement decisions. The published decisions show both the frequency and the scale: the counts on this page are read from the decisions themselves rather than estimated. A notice sent inside the deadline but missing one of the statutory items has also been treated as a breach.
Q. Does Korea require notification when a breach is only suspected?
Since 11 September 2026, yes, in two situations: unlawful access to the processing system or a handler's device where the affected data subjects cannot be identified, and confirmation that some data has been leaked — for example that it is being traded — where other data subjects may also be affected. The notice goes out within 72 hours to everyone who may be affected, and a further notice follows once the position is established.
To cite this page: Hyunsub Lee, “Korea breach notification: the 72-hour clock, who to tell, and what late costs”, datalaw.kr, last updated 27 October 2026, https://datalaw.kr/en/breach-notification/.
This page is general information on Korean law and is not legal advice; what a particular incident requires depends on its facts. Korean is the governing language of the statutes cited — the English renderings here are unofficial. Before relying on a figure, check the decision or provision it comes from.