Two kinds of money come out of a Korean personal data case, and they are calculated in completely different ways. A surcharge (과징금) is turnover-based and available only for the conduct listed in art. 64-2(1) of the Personal Information Protection Act. An administrative fine (과태료) is a fixed amount per item, set out in Table 2 of the Enforcement Decree, and has nothing to do with turnover. A single decision often imposes both.
This page works through the surcharge formula and gives the fine amounts. It is written for the reader who has to explain the exposure to a board or a parent company and needs to know which figures are fixed by rule and which are the Commission’s to decide.
This tool applies the statutory formula. It does not predict or guarantee the outcome of any individual case. The Personal Information Protection Commission decides the seriousness grade, how much turnover is unrelated to the violation, and which increases and reductions it will allow. Those decisions, not the arithmetic, drive the amount. Everything is calculated in your browser; nothing you type is sent anywhere. This is not legal advice. Rules as at 2026-09-12.
1 · When did the violation end?
Not the date of the decision — the date the conduct stopped. Each version of the PIPC Notice applies to violations that ended while it was in force, so this date selects the rules.
2 · What happened?
A surcharge is available only for the conduct listed in art. 64-2(1) of the Act. Anything outside that list is a matter for administrative fines instead, which are set per item in Table 2 of the Enforcement Decree.
3 · Turnover
4 · How seriously would the Commission view it?
The grade is set by weighing intent and negligence, how the violation was carried out, the type of personal data and the scale of harm to data subjects — together, with no scoring formula (Notice, Table 1). The calculator therefore does not assign a grade. One element is mechanical: where sensitive data or unique identifiers are involved, the data-type element is "high".
The values you entered are carried in the # fragment of the URL. A fragment is never sent to the server, so the figures stay in your browser.
Two things this calculator leaves out, because both turn on documents rather than arithmetic: the investment reduction of up to 40% of the base amount, and the increases and reductions at the first and second adjustments. They are set out in the tables below, and you can see what the Commission actually allowed in published decisions through the Korean page.
Which version of the rules applies
The date that matters is the date the violation ended, not the date of the decision. Every amendment of the PIPC Notice provides in its addendum that a surcharge for conduct that ended before the amendment took effect is governed by the previous rules. The Notice was amended twice in 2026, on 19 May and on 11 September, so cases that look similar can be calculated under different rules. Where the conduct continued until the hearing closed, the closing date is treated as the end date (Notice art. 3(1), proviso).
| Date the violation ended | Rules that apply | Calculator |
|---|---|---|
| 2026-09-11 – (including ongoing) | Rules in force from 11 September 2026 — Standards for Imposing Surcharges for Violations of the Personal Information Protection Act (PIPC Notice No. 2026-12) | calculates |
| 2026-05-19 – 2026-09-10 | Rules for violations that ended between 19 May and 10 September 2026 — Standards for Imposing Surcharges for Violations of the Personal Information Protection Act (PIPC Notice No. 2026-5) | calculates |
| 2023-09-15 – 2026-05-18 | Rules for violations that ended between 15 September 2023 and 18 May 2026 — Standards for Imposing Surcharges for Violations of the Personal Information Protection Act (PIPC Notice No. 2023-3) | calculates |
| until 2023-09-14 | Earlier surcharge rules — the telecommunications-services special provisions, the resident registration number leak standard and others | out of scope |
Step 1 — relevant turnover, and the argument that actually moves the number
The formula starts from relevant turnover: total turnover, less the turnover unrelated to the violation.
Total turnover is defined by art. 60-2(1) of the Enforcement Decree. Where the business has been running for three years or more, it is the higher of the last financial year’s turnover and the average of the last three financial years. For violations that ended before 19 May 2026 it is the three-year average only. Where the business started more recently, the figure is annualised.
What counts as unrelated is decided by the Commission, which looks at whether the goods or service is independent of the one affected, what the privacy policy covers, and whether the systems are separated (Notice art. 7(3)). For a foreign operator this is usually the largest single argument available, and in published decisions it is the point contested most often — including how much of a global group’s revenue is Korean turnover at all. Our English table of every published PIPC decision against a foreign company sets out how respondents have put that argument and where it succeeded.
A practical consequence: the deduction has to be capable of being evidenced. The Commission may set a period of up to 20 days for financial statements and supporting material. Where the group has never split revenue by service line for Korea, that split cannot be constructed after the investigation opens.
Step 2 — the seriousness grade sets the rate
The grade is not scored. The Commission weighs intent and negligence, how the violation was carried out, the type of personal data and the scale of harm to data subjects, and reaches a grade in the round (Notice, Table 1). One element is mechanical: where sensitive data or unique identifiers are involved, the data-type element is treated as "high".
| Seriousness grade | Base rate (applied to relevant turnover) | Base amount (no turnover, or turnover cannot be calculated) |
|---|---|---|
| Very serious violation | 2.1% to 2.7% | KRW 700 million to KRW 1.8 billion |
| Serious violation | 1.5% to 2.1% (exclusive) | KRW 200 million to KRW 700 million (exclusive) |
| Moderate violation | 0.9% to 1.5% (exclusive) | KRW 50 million to KRW 200 million (exclusive) |
| Minor violation | 0.03% to 0.9% (exclusive) | KRW 5 million to KRW 50 million (exclusive) |
Because a grade one step up multiplies the base amount by roughly 1.4 to 2, the grade — not the turnover — is usually what separates two otherwise similar cases.
Step 3 — adjustments, ceiling, rounding
| Step | Ground | Rate | Source |
|---|---|---|---|
| Investment reduction | Investment in data protection, a sound protection framework and enhanced safety measures — not available where the violation was intentional or grossly negligent | up to 40% of the base amount | Notice art. 8-3 |
| First adjustment — increase | Duration of the violation | · Over 1 year, up to 2 years +25% · Over 2 years +50% | Notice art. 9(1)1 |
| First adjustment — increase | Surcharge orders for a violation of the same subparagraph in the last 3 years | · Once +20% · Twice +40% · Three times or more +80% | Notice art. 9(1)2 |
| First adjustment — reduction | No economic or non-economic gain was obtained from the violation, or the likelihood of gain is very low | up to 30% | Notice art. 9(2)1 |
| First adjustment — reduction | A public institution, non-profit or small or medium enterprise for which the amount is excessive relative to the nature and size of its operations | up to 50% | Notice art. 9(2)2 |
| Second adjustment — increase | Obstructing the investigation — refusing to produce materials or to be inspected, destroying or concealing evidence, or giving false information | up to 30% | Notice art. 10(1)1 |
| Second adjustment — increase | Knowing of a breach but failing to report and notify within the deadline, and taking no steps to limit its spread | up to 30% | Notice art. 10(1)2 |
| Second adjustment — increase | Leading or instigating the violation among several violators | up to 20% | Notice art. 10(1)3 |
| Second adjustment — reduction | Stopping the violation and completing corrective action before the prior-notice and comment period ends | up to 30% | Notice art. 10(2)1(a) |
| Second adjustment — reduction | Consistently admitting the facts during the investigation and cooperating actively (producing materials, giving statements) | up to 30% | Notice art. 10(2)1(b) |
| Second adjustment — reduction | Restoring the harm or paying damages through dispute mediation, civil mediation or similar | up to 30% | Notice art. 10(2)2 |
| Second adjustment — reduction | Holding a personal data protection certification recognised by the PIPC | up to 30% | Notice art. 10(2)3(a) |
| Second adjustment — reduction | Diligently carrying out protection activities such as a self-regulatory code | up to 20% | Notice art. 10(2)3(b) |
| Second adjustment — reduction | A high grade in the privacy-policy or protection-level assessment, or carrying out an impact assessment that was not mandatory | up to 15% | Notice art. 10(2)3(c) |
| Second adjustment — reduction | Voluntarily reporting the violation (a breach report under art. 34(4) does not count) | up to 30% | Notice art. 10(2)4 |
| Second adjustment — reduction | Having an incident-response system and using it to detect the incident early, report and notify quickly, limit its spread and restore the position | up to 40% | Notice art. 10(2)5 |
Within each step the increases are added together and the reductions are added together, and each total is capped — 90% at the first adjustment and 50% at the second (Notice art. 9(3), Notice art. 10(3)). Every rate above is a ceiling: the PIPC decides how much of it to allow in the individual case. For a very serious violation the Commission may withhold or cut back the reductions (Notice art. 10-2).
Every percentage above is a ceiling. Whether a ground applies at all, and how much of the ceiling to use, is decided case by case, which is why the calculator on this page leaves these boxes out and shows the unadjusted figure instead. In published decisions the combined effect of the two adjustments most often lands between a multiplier of about 0.5 and about 0.85.
After the adjustments the amount is capped at the statutory ceiling — 3% of total turnover, or KRW 2 billion where there is no turnover or it cannot be calculated (art. 64-2(1)) — and then rounded down: amounts of KRW 100 million or more lose the part below KRW 1 million, and smaller amounts lose the part below KRW 100,000 (Notice art. 11(5)).
When the ceiling becomes 10% of total turnover
Since 11 September 2026 art. 64-2(2) of the Act raises the ceiling to 10% of total turnover, or KRW 5 billion where there is no turnover, in three cases: a repeat violation of the same subparagraph within three years of a surcharge order, committed intentionally or with gross negligence; an intentional or grossly negligent violation affecting 10 million or more data subjects; and a leak that follows a failure to comply with a corrective order.
In those cases the base amount is the base rate multiplied by an aggravating ratio. The Decree caps the product at 8.91%, and caps a fixed base amount plus the aggravating amount at KRW 4.5 billion. The table that converts the Commission’s assessment into the aggravating ratio has not been published, so no tool — including this one — can compute that step; only the ceiling is known.
Whether a surcharge is imposed at all
| Stage | Ground | Source |
|---|---|---|
| Whether to impose at all | Justifiable grounds for believing the conduct was not unlawful — no surcharge is imposed | Notice art. 4(1) |
| Whether to impose at all | The content or degree of the violation is minor, or it was a slight lapse or clerical error — a surcharge may be waived | Notice art. 4(2)1 |
| Whether to impose at all | No harm or only minor harm, the violation was corrected (including correction with technical support for SMEs and small businesses), and the breach notification and reporting duties were not breached — a surcharge may be waived | Notice art. 4(2)2 |
| Final determination — reduction | Manifestly insufficient ability to pay, shown by objective evidence — up to 90% of the amount after the second adjustment | Notice art. 11(1)1 |
| Final determination — reduction | Market or industry conditions have changed or deteriorated markedly, for example in an economic crisis — up to 90% of the amount after the second adjustment | Notice art. 11(1)2 |
| Final determination — reduction | The PIPC finds the amount markedly excessive relative to the violation — up to 50% of the amount after the second adjustment | Notice art. 11(1)3 |
| Waiver | Unable to pay — insolvency, suspension of payments or erosion of capital | Notice art. 11(2)1 |
| Waiver | The amount calculated through the second adjustment is KRW 2 million or less | Notice art. 11(2)2(a) |
| Waiver | The calculated surcharge is lower than the administrative fine calculated for the same conduct (only where the conduct is subject to a fine) | Notice art. 11(2)2(b) |
Administrative fines: a fixed amount per item
Fines do not scale with turnover. Table 2 of the Enforcement Decree sets an amount for each failure, and the amount increases where the same party has been fined for the same failure within the last three years. The amendment that took effect on 11 September 2026 raised the amounts across the board and added items for the chief privacy officer. Grounds for increase and reduction are set out in a separate Notice (No. 2026-14): increases are capped at 50% and reductions at 90% of the base amount, and paying within the period given in the advance notice reduces the amount by a further 20%.
| Failure | Provision | Ended on or after 11 Sep 2026 (1st · 2nd · 3rd or later) | Ended on or before 10 Sep 2026 |
|---|---|---|---|
| Failing to destroy personal data that is no longer needed | art. 21(1) | KRW 9 million · KRW 18 million · KRW 30 million | KRW 6 million · KRW 12 million · KRW 24 million |
| Failing to take the safety measures required to secure personal data | art. 23(2), art. 24(3), art. 25(6), art. 28-4(1), art. 29 | KRW 9 million · KRW 18 million · KRW 30 million | KRW 6 million · KRW 12 million · KRW 24 million |
| Failing to record the outsourcing of processing in a written document | art. 26(1) | KRW 3 million · KRW 6 million · KRW 10 million | KRW 2 million · KRW 4 million · KRW 8 million |
| Failing to disclose the outsourced work and the trustee | art. 26(2) | KRW 3 million · KRW 6 million · KRW 10 million | KRW 2 million · KRW 4 million · KRW 8 million |
| Failing to take the protective measures required for an overseas transfer | art. 28-8(4) | KRW 9 million · KRW 18 million · KRW 30 million | KRW 6 million · KRW 12 million · KRW 24 million |
| Failing to establish or publish a privacy policy | art. 30(1), (2) | KRW 3 million · KRW 6 million · KRW 10 million | KRW 2 million · KRW 4 million · KRW 8 million |
| Failing to designate a chief privacy officer (from 11 Sep 2026, including designating a person who does not meet the requirements) | art. 31(1), (10) | KRW 9 million · KRW 18 million · KRW 30 million | KRW 2 million · KRW 4 million · KRW 8 million |
| Failing to file the designation, change or removal of a chief privacy officer | art. 31(3)2 | KRW 9 million · KRW 18 million · KRW 30 million | not in the earlier table (new) |
| Failing to designate a domestic representative | art. 31-2(1) | KRW 20 million | KRW 20 million |
| Failing to state the domestic representative's details in the privacy policy | art. 31-2(4) | KRW 3 million · KRW 6 million · KRW 10 million | KRW 2 million · KRW 4 million · KRW 8 million |
| Failing to notify data subjects of a breach (from 11 Sep 2026, including notice that a breach is likely) | art. 34(1), (2) | KRW 9 million · KRW 18 million · KRW 30 million | KRW 6 million · KRW 12 million · KRW 24 million |
| Failing to report a breach to the authorities | art. 34(4), previously (3) | KRW 9 million · KRW 18 million · KRW 30 million | KRW 6 million · KRW 12 million · KRW 24 million |
| Failing to produce materials the PIPC requested, or producing false materials | art. 63(1) | KRW 9 million · KRW 18 million · KRW 30 million | |
| Failing to comply with a corrective order | art. 64(1) | KRW 9 million · KRW 18 million · KRW 30 million | KRW 6 million · KRW 12 million · KRW 24 million |
These are 14 of the 48 items in Table 2 of the Enforcement Decree — the ones that come up most often for a foreign operator. The Korean page lists every item: full table of administrative fines.
What this page does not do
- It does not predict an outcome. Whether a surcharge is imposed, which grade applies and which grounds are allowed are decided by the Commission on the facts it finds.
- It does not assign a grade. You can select one to see the result within that grade, but selecting it does not make it the grade that applies.
- It does not send anything. The calculation runs in your browser; there is no server call on this page.
- It is not legal advice. How a real case turns out depends on the facts and the evidence.
Frequently asked questions
How is a surcharge under Korea’s PIPA calculated?
Relevant turnover is multiplied by the base rate for the seriousness grade to give the base amount. The base amount is then reduced for investment in data protection, adjusted up or down at a first adjustment (duration, repetition, gain, size) and a second adjustment (cooperation, correction, remedy, certification, self-reporting, incident response), capped at the statutory ceiling and rounded down. Relevant turnover is total turnover less the turnover unrelated to the violation. Where there is no turnover, or it cannot be calculated, a fixed base amount applies for each grade.
What is the maximum surcharge under Korean privacy law?
3% of total turnover, or KRW 2 billion where there is no turnover or it cannot be calculated. Since 11 September 2026 the ceiling is 10% of total turnover, or KRW 5 billion, in three cases: a repeat violation of the same subparagraph within three years of a surcharge order, committed intentionally or with gross negligence; an intentional or grossly negligent violation affecting 10 million or more data subjects; and a leak that follows a failure to comply with a corrective order.
What is the difference between a surcharge and an administrative fine in Korea?
A surcharge is turnover-based and is available only for the conduct listed in art. 64-2(1) of the Act. An administrative fine is a fixed amount set per item in Table 2 of the Enforcement Decree, does not depend on turnover, and covers a much wider range of duties. Both are frequently imposed in the same decision — typically a surcharge for the failure to secure the data and a fine for late or missing breach notification.
Which version of the rules applies to our case?
The one in force when the violation ended, not when the decision is issued. Each amendment of the PIPC Notice says in its addendum that surcharges for conduct that ended before it took effect are governed by the previous rules. The Notice was amended twice in 2026, on 19 May and 11 September, so the end date matters. If the conduct continued until the hearing closed, the closing date is treated as the end date.
Can this calculator tell us what our company will be fined?
No. It applies the formula in the Act, the Enforcement Decree and the PIPC Notice to the figures you enter. The seriousness grade, the scope of turnover treated as unrelated to the violation, and whether each ground for increase or reduction is allowed are all decided by the Commission after it investigates. That is why the calculator shows four grades side by side rather than a single number: the spread is the part that is not arithmetic.
Related pages
- How Korea’s PIPC sanctions foreign companies — every published decision against a named foreign operator, with the arguments each respondent ran.
- Appointing a domestic representative under PIPA — who must appoint one, and the fines attached.
- English notes and summaries — the rest of the English material on this site.
- 과징금·과태료 산정 계산기 — the Korean version, which adds the administrative fine calculator for all 48 items and a search of published decisions for comparable cases.
Sources
- Personal Information Protection Act (Act No. 21445), arts. 64-2 and 75 — Korean Law Information Center
- Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 36671), art. 60-2 and Tables 1-5 and 2
- Standards for Imposing Surcharges for Violations of the Personal Information Protection Act (PIPC Notice No. 2026-12)
- PIPC decisions board
English translations of Korean legislation are unofficial and carry no legal effect; the Korean text governs.