Key points. On 13 May 2026 the Personal Information Protection Commission ("PIPC") adopted seven decisions in a single case (case No. 2024조일0040, Decision Nos. 2026-009-057 to 2026-009-063) concerning the 보람상조 group, a Korean funeral-services group. One is against the affiliate that operated the group's shared website and customer-service system. The other six are against affiliates that had outsourced customer-relationship work to that operator. The Commission found each of the six in breach of PIPA art. 26(4) (supervision of the entrustee) and art. 26(2) (disclosure of the entrustment), and made each a separate respondent. That the affiliates and the operator ran the service like one organisation did not remove the violation and was reflected only in a lower assessment of fault. Three of the six received a penalty surcharge. For the other three the calculated amount was KRW 2,000,000 or less.

This note covers what these seven decisions did. Korean outsourcing rules in general are set out in Entrustment and the processor under Korean law. The Commission's reasoning is reported here in our paraphrase of the Korean; it is not an official translation.

Who ran the system and who outsourced to it

In this group, a customer who signed up on any affiliate's own website became a member of the group's integrated site. One affiliate, 보람상조개발, operated that site. Six other affiliates had handed it the personal data processing for their customer-relationship management (CRM) work: winning and maintaining funeral-service contracts through online and telephone consultation, customer consultation, and the main telephone line.

Between March and May 2024 the integrated site was hit by an SQL injection attack. Names, mobile numbers and other data of 27,882 people (the number confirmed from material supplied by the police), including integrated website members and online-consultation members, were leaked. The police passed on signs of the leak on 27 May 2024 and the operator reported the breach the following day. The Commission's investigation started from that report and from an earlier complaint, received on 17 May 2024, that the operator had not destroyed personal data.

The Commission treated the relationship between the six affiliates and the operator as entrustment. In this note the six are called entrusting controllers (the companies that outsource processing) and the operator is called the entrustee.

What the Commission found

The operator was found in breach of the safeguards duty (art. 29), the destruction duty (art. 21(1)) and the breach notification duty (art. 34(1)). According to the decision, the operator neglected vulnerability checks such as input validation when it developed a new page in January 2022, and it ran a web application firewall installed in June 2018 in detection mode only until the leak. The decision records that the operator was both a controller for its own members and an entrustee, to which the three provisions apply through art. 26(8).

For the six entrusting controllers, the Commission found two violations in every decision.

  1. Art. 26(4). The six did not adequately supervise the operator, for example by checking how it processed the data or by giving it data protection training. The Commission considered that this led to the leak.
  2. Art. 26(2). When the six revised their privacy policies after the incident, they published the entrustment with part of it missing, from the revision of 26 February 2025 until 8 September 2025. The respondents said this was a mistake by the person in charge. The decisions do not say what was missing.

Each of the six was its own respondent and received its own corrective order and its own order to publish the fact of the sanction.

"We operated as one organisation"

This circumstance appears where the decisions calculate the surcharge, not where they decide whether there was a violation. The Commission assessed seriousness on four factors and graded all four as low in all six decisions, and classed each as a 「약한 위반행위」 (our rendering: minor violation). On intent or negligence, the Commission wrote, in our paraphrase, that the violation arose while the entrusting controllers ran the service together with the entrustee as if they were one organisation, so it was hard to see intent or gross negligence. On a second factor, it took into account that the entrustee had built and operated the leaked database and had been responsible for it for a long time, so the entrusting controllers could hardly have noticed the need to supervise. The other two factors were the type of data leaked and the degree of harm.

A group legal team can read this in two directions. First, the Commission accepted that the group worked like one organisation and still found the art. 26(4) violation. The circumstance went no further than lowering the assessment of fault. Second, the group structure was not recorded only in the respondents' favour. The six argued that their capital had been impaired (자본잠식) for years and asked for the surcharge to be waived or reduced. The Commission noted that the audit opinions did not raise uncertainty about going concern, and it cited the particular nature of the funeral-services business and of the group and affiliate structure as reasons why the six could not objectively be regarded as unable to pay.

The sanctions, and why only three surcharges

Decision No.RespondentPositionProvisionsSanction
2026-009-057보람상조개발Operator; entrustee of the sixArt. 29, 21(1), 34(1)Penalty surcharge KRW 531,000,000; administrative fine KRW 11,400,000; corrective order; order to publish
2026-009-058보람상조리더스Entrusting controllerArt. 26(2), 26(4)Penalty surcharge KRW 4,200,000; corrective order; order to publish
2026-009-059보람상조라이프Entrusting controllerArt. 26(2), 26(4)Penalty surcharge KRW 4,800,000; corrective order; order to publish
2026-009-060보람상조피플Entrusting controllerArt. 26(2), 26(4)Penalty surcharge KRW 2,500,000; corrective order; order to publish
2026-009-061보람상조애니콜Entrusting controllerArt. 26(2), 26(4)Corrective order; order to publish
2026-009-062보람상조실로암Entrusting controllerArt. 26(2), 26(4)Corrective order; order to publish
2026-009-063보람상조플러스Entrusting controllerArt. 26(2), 26(4)Corrective order; order to publish

All seven were adopted by the full Commission.

The surcharges on the entrusting controllers come from art. 26(4), through art. 64-2(1)(5). The art. 26(2) violation is a matter for an administrative fine, and the Commission imposed none in any of the six decisions. It gave as reasons that the period of omission was not long, that the omission came from carelessness by the person in charge, that the harm was slight, and that the correction was complete.

The six decisions found the same violations, applied the same seriousness grade and used the same adjustment rates (the decision on 보람상조피플 alone carries a footnote that a reduction based on an SME certificate (중소기업 확인서) was not applied): a 50% increase for a violation period of more than two years, a 30% reduction for no gain, and a 30% reduction for completed correction. The Commission counted the violation period from the date of the outsourcing contract (March 2020 for the respondent in decision 058, November 2018 for the other five) to the correction in February 2025.

The three decisions without a surcharge give the same reason. The amount reached after the step-by-step calculation was KRW 2,000,000 or less, and the Commission applied art. 11(2) of the surcharge standards then in force (PIPC Notice No. 2023-3) and did not impose it. On that basis, what separated the two groups appears to be the size of the calculated amount. The decisions redact turnover, the base rate and the calculated amounts, so the reason the amounts differed between companies cannot be confirmed.

The corrective orders on the six are identically worded and are framed at group level. They require clearer disclosure of the entrustee, a group-wide plan for supervising entrustees that includes checks on processing and training, an overhaul of decision-making on data protection and improved compliance controls, and a report of the result within 90 days after implementation in consultation with the Commission. The order to publish requires each company, within one month of being notified, to post the fact of the sanction in a pop-up on the first screen of its own website (including its mobile app) for two days or more and less than five days.

What a foreign group can check, in order

A group that uses an integrated membership, a shared CRM or an IT affiliate in Korea can take the following items, drawn from the wording of the corrective orders and from art. 26, as a checklist.

  1. Whether the work handed to the affiliate is set out in the document that art. 26(1) requires.
  2. Whether the Korean privacy policy of each affiliate lists the entrusted work and the entrustee affiliate without omission, and whether each revision is compared against the previous version on the entrustment items.
  3. Whether checks on the entrustee affiliate's processing and data protection training are in fact carried out and recorded.
  4. Whether a group-wide plan for supervising entrustees exists for those checks and that training.
  5. Which unit within the group is responsible for decisions on data protection and for compliance controls.

What this note does not say

The Korean note on which this page is based did not check the full requirements of art. 11(2) of the standards applied in this case, or how later standards treat the same rule. These decisions therefore cannot be used as a basis for saying that a similarly structured case would carry no surcharge. Whether the respondents challenged the sanctions has not been checked. The decisions do not address intra-group data flows that are something other than entrustment, and neither does this note. PIPA art. 26 and art. 64-2 are cited as in force on 11 September 2026.

This page was prepared on 13 October 2026.

Frequently asked questions

Q. Is handing customer-service work to a group affiliate entrustment under Korea's PIPA?

It was treated as entrustment in this case. PIPA art. 26 contains no wording that excludes outsourcing between affiliates. In its decisions of 13 May 2026 the Commission treated the six affiliates that had handed customer-relationship work to another group company as entrusting controllers and the company doing the work as the entrustee, and applied art. 26. The fact that the arrangement is a division of work inside a group is therefore unlikely, on its own, to take the disclosure duty and the supervision duty of art. 26 out of play.

Q. Can an affiliate that did not operate the breached system receive a penalty surcharge?

Yes, and in this case three did. Under PIPA art. 64-2(1)(5) a penalty surcharge may be imposed where the entrusting controller neglected supervision or training under art. 26(4) and the entrustee breached the Act as a result. All six entrusting affiliates were assessed for the same violations at the same seriousness grade. Three received surcharges of KRW 2,500,000 to KRW 4,800,000. For the other three the amount calculated step by step was KRW 2,000,000 or less, and under the surcharge standards then in force it was not imposed. All six received a corrective order and an order to publish the fact of the sanction.

Q. How did the Commission treat the argument that the group operated as one organisation?

It did not use that circumstance to deny the violation. It used it in calculating the surcharge, to assess intent or negligence at a low level. The Commission wrote, in our paraphrase, that the violation arose while the entrusting affiliates ran the service together with the entrustee as if they were one organisation, so it was hard to see intent or gross negligence. The group structure also appears on the other side: when the Commission considered the affiliates' argument that they were unable to pay, it cited the particular nature of the group and affiliate structure as a reason not to accept that argument. Which way the circumstance cuts may differ from case to case.

This note describes published decisions for readers outside Korea and is not legal advice. The outcome of any investigation turns on its own facts and requires individual review. Turnover, base rates and intermediate amounts are redacted in the published decisions and are not supplied here. All English renderings of Korean statutes, rules and decision text are unofficial; the Korean text governs.

Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul. Other English summaries are collected at English summaries.