South Korea’s top data-protection regulator delivered a rare public admission of systemic failure before the National Assembly on Monday, acknowledging that the country’s privacy and security infrastructure lags behind international standards — and doing so 32 days into the life of the world’s strictest data-protection penalty regime, as an AI-assisted banking breach wave hands regulators their inaugural enforcement test case.
Song Kyoung-hee, chairperson of the Personal Information Protection Commission (PIPC), appeared before the National Assembly’s National Policy Committee annual audit in Yeouido, Seoul, where lawmakers from both major parties pressed her on why South Korea — a country that defines itself by technological ambition — has proved so vulnerable to mass data theft.
Her answers were unusually candid for a senior regulator: she acknowledged the country’s defenses lag considerably, attributed the vulnerability to a mismatch between security investment and technological ambition, and committed to deploying South Korea’s new 10%-of-revenue fine ceiling aggressively, establishing a victim compensation fund, reversing the burden of proof in breach-damage claims, and rethinking the country’s privacy framework for an era in which AI agents, not just human operators, access and act on personal data. Song previously oversaw AI and software policy at the Ministry of Science and ICT before being appointed PIPC chair in October 2025.
“Basic Measures Were Not Taken”
The audit opened with a question from Cho Jung-hoon, a People Power Party lawmaker, who asked why South Korea remains so exposed to data breaches. Song’s reply was blunt. “It is true that our country’s data security and privacy management systems lag considerably,” she said, attributing the vulnerability primarily to a mismatch between investment and ambition: security spending had not kept pace with investment in information technology. Song told the parliamentary audit that as the value of personal data has risen, South Korea has become an increasingly attractive target.
Min Byoung-dug, a Democratic Party of Korea lawmaker, pressed Song on the role of artificial intelligence in the recent wave of attacks. Song acknowledged that AI-enabled hacking had accelerated the speed and scale of intrusions, but distinguished between technology and negligence. “Major incidents occurred because basic measures were not taken — access rights were not properly managed, encryption was not properly applied, and abnormal traffic was not detected,” she said. In her framing, the root cause of South Korea’s breach epidemic was not the sophistication of its attackers but the inadequacy of its defenses.
Lawmakers also challenged Song on the Government24 public-services portal breach that surfaced earlier in the year, in which data was disclosed to affected individuals only roughly a month after the incident — well beyond the 72-hour notification deadline that South Korean law requires. Cho noted that the commission’s budget had grown by 45 percent over the past five years, yet breaches had not only continued but escalated. Song told the lawmakers she felt a heavy sense of responsibility and shared their concerns.
Banking Sector Becomes PIPA’s First Live Enforcement Test
The most consequential near-term test of South Korea’s revised Personal Information Protection Act (PIPA) is unfolding in its banking sector. AI-assisted breaches at multiple major financial institutions — including Shinhan Bank, which reported about 25,000 affected customers, and KB Kookmin Bank, where roughly 119 credit card clients were exposed — triggered a response that reached the presidential level. President Lee Jae Myung ordered an urgent investigation on October 4, with South Korean police deploying 28 investigators across four cyberterrorism teams.
Analysts and cybersecurity researchers believe attackers may have used ARTEX, a Chinese open-source penetration-testing tool that can identify security vulnerabilities autonomously — though South Korean authorities have not officially confirmed the attribution. The suspected use of AI attack tooling drew a pointed observation from John Hultquist of Google’s Threat Intelligence Group: “The era of AI-driven vulnerability and exploitation is already here.”
What makes the banking breach wave significant beyond its immediate scale is timing. Every major breach South Korea experienced in 2026 up to September 11 fell under the prior version of PIPA, which capped punitive fines at 3 percent of violation-related revenue. The banking incidents are the first major events to arise entirely under PIPA 2.0’s jurisdiction — making their enforcement outcome the inaugural real-world signal of whether a 10%-of-total-revenue ceiling changes how companies invest in security. The revised law entered force on September 11, 2026.
Song said at the audit that the commission would specifically prioritize the banking and public-agency breaches for scrutiny and that dedicated investigation teams would handle major cases. She also committed to imposing enforcement charges on firms that refuse to cooperate with investigations — a mechanism not used in prior PIPC enforcement cycles.
A Year of Cascading Failures Put PIPA Under Legislative Pressure
Monday’s audit arrived at the end of a year that severely tested confidence in South Korea’s data-protection framework.
In May, the PIPC fined the Ministry of the Interior and Safety a combined 280.5 million won (approximately $211,000) for security failures tied to its Government24 and Shared Nuri public-service portals — the first time a government ministry faced a PIPC fine of this kind. Investigators found source-code errors, inadequate testing, and unresolved authentication vulnerabilities that had directly exposed 1,233 individuals’ records, with an additional approximately 575,000 records appearing on the dark web via a third-party data broker. The ministry also notified the PIPC of one incident more than 72 hours after discovering it.
That same month, the disclosure that the Korea National Diplomatic Academy’s online education system had been breached for ten months — from April 2025 through February 2026 — exposed user IDs, names, email addresses, and encrypted passwords of roughly 10,000 individuals, including current and former personnel from the Ministry of Foreign Affairs and South Korea’s overseas diplomatic missions. The government acknowledged a five-month disclosure delay, citing national-security sensitivities.
What a 10%-Revenue Ceiling Means for Business
On September 11, South Korea’s revised PIPA entered force, introducing the most consequential changes to the country’s data-privacy law since its 2023 overhaul. The amendment raises the ceiling for punitive administrative fines from 3 percent of violation-related revenue to 10 percent of a company’s total annual global revenue — a threshold that now surpasses the GDPR penalty ceiling (4 percent of global annual turnover) and the EU AI Act’s ceiling of 7 percent for its most serious violations.
The elevated fine tier applies to companies that expose the personal data of 10 million or more people through intent or gross negligence, that commit repeat violations within three years of a prior violation, or that suffer a second breach after failing to comply with PIPC corrective orders. Fine calculations consider the severity and continuity of a violation, the scale of harm, and the quality of a company’s prior investment in data-protection infrastructure — with up to a 40 percent reduction available to firms that can demonstrate meaningful preventive investment.
The revenue base matters as much as the percentage. Because the punitive ceiling is calculated on total annual global revenue — not Korea-only revenue — a multinational company with $10 billion in worldwide sales faces a theoretical maximum fine of $1 billion for a single qualifying PIPA breach, even if only a fraction of that revenue comes from South Korean operations. For large platform operators with tens of millions of Korean users embedded in a global user base, PIPA 2.0’s practical bite is significantly larger than an equivalent fine law based on domestic revenue alone.
The revised law also introduces mandatory board-level approval for the appointment or dismissal of Chief Privacy Officers at major companies, requires those firms to notify the PIPC of CPO changes, and mandates that companies alert individuals within 72 hours when there is strong reason to believe a breach has occurred — even before the breach is confirmed. That early-notification trigger directly addresses the delayed-disclosure pattern that recurred across multiple 2026 incidents.
Applied retrospectively to the Coupang case, analysts have noted that the 10%-of-total-revenue ceiling could have produced a penalty in the trillions of won — a figure that reframes the record $469.9M fine as a baseline, not a ceiling.
Victim Relief and the Burden of Proof
Song outlined two complementary mechanisms intended to ensure that enforcement fines translate into tangible relief for the people whose data was compromised — not just deterrence for future violators.
The first is a shift in the statutory burden of proof in breach-damage claims. Under the revision Song described at the audit, companies — not affected individuals — will be required to demonstrate the absence of causal negligence when a breach occurs. The practical effect is to dramatically lower the barrier for compensation claims by ordinary citizens who lack the resources to litigate against major institutions.
The second is a dedicated victim compensation fund, financed directly from fines collected by the PIPC. A bill establishing the fund was introduced in the National Assembly in June and remains under deliberation. Song confirmed at the audit that the commission is committed to establishing the fund, responding to calls from lawmakers and civil-society groups who argued that even record penalties provide little tangible relief to the tens of millions of individuals whose data has been compromised.
South Korea would be the first major data-protection jurisdiction to establish an enforcement-funded victim relief mechanism of this structure. GDPR, the EU AI Act, and US state privacy frameworks lack an equivalent pool financed directly from regulatory fines.
Privacy in the Age of AI Agents
The most forward-looking element of Song’s address concerned the planned overhaul of South Korea’s privacy framework for a world in which AI agents — not just human operators — process, retrieve, and act on personal data. “We will review and improve the current privacy framework so that it fits the AI era, including by addressing privacy issues raised by agentic AI,” she told the parliamentary committee.
The challenge is structural. South Korea’s privacy law, like most comparable frameworks globally, is built around informed consent: a data subject agrees to specific uses of their information by a specific entity. Agentic AI systems break that model. An AI agent fulfilling a user’s instruction may autonomously query multiple external services, link disparate data sources, and initiate actions — all without generating a discrete consent event that maps to the original authorization. In a public consultation launched in August, the PIPC identified this tension explicitly, noting that agentic AI “develops its own workflows in response to a user’s request, accessing and using a wide range of information to perform its tasks,” and that this architecture exposes the limits of applying consent-based legal frameworks to interactions that occur between systems rather than between humans and systems.
The PIPC launched a task force to reform its privacy-protection framework in July 2026. Song’s remarks at the audit signal that deliberations will now accelerate, with a framework revision expected among the commission’s legislative priorities heading into 2027. The PIPA 2.0 amendment that took effect in September also opened a new lawful channel for training AI systems on pseudonymized personal data — a deliberate attempt to balance privacy protection against the data demands of AI development. The agentic-AI framework revision is the next step in that effort. The GRC Report’s analysis of the consultation noted that PIPC’s reform effort is not simply about making consent clearer — it is examining whether a framework that places so much weight on discrete consent moments can provide meaningful protection when the processing itself is increasingly continuous, distributed, and difficult to anticipate.
A Signal to the Market
Song’s appearance before the National Policy Committee is, in one sense, a routine feature of South Korea’s annual parliamentary calendar — government agencies face mandatory public audits each autumn. But the specificity of her admissions and the breadth of the remedies she outlined are unusual. Regulators rarely appear before legislators to describe their own systems as lagging considerably behind comparable countries.
The backdrop explains the tone. Korea has levied the world’s highest data-protection fine as a share of total revenue — at 10 percent of total annual revenue, the revised PIPA’s ceiling now leads the field globally among general data-privacy laws. The commission’s enforcement record over the past year, culminating in the Coupang ruling, demonstrated willingness to use large fines. What Monday’s audit added was the regulator’s own acknowledgment that large fines alone are not sufficient — that the underlying conditions enabling mass breaches have not yet been addressed, and that addressing them will require rethinking not just penalties but the foundational logic of how privacy is governed in a world where AI systems act as autonomous intermediaries between people and their data.
For companies doing business in South Korea with more than 10 million users in their database, the practical question is no longer what the law promises. It is what the law costs when the next breach arrives.
Currency conversions are approximate, based on an exchange rate of 1,329.55 KRW/USD (OFX, October 12, 2026).
Frequently Asked Questions
What specifically triggers the 10%-of-revenue fine under South Korea’s revised PIPA?
Three conditions can trigger the elevated 10%-of-total-annual-revenue punitive fine: (1) exposing the personal data of 10 million or more individuals through intent or gross negligence; (2) committing a repeat violation within three years of a prior violation; or (3) suffering a new breach after failing to comply with a PIPC corrective order. The 10% ceiling is calculated against a company’s total global annual revenue, not just its South Korea-related revenue. Companies that can demonstrate meaningful prior investment in data-protection infrastructure may qualify for a fine reduction of up to 40 percent. The prior ceiling was 3 percent of violation-related revenue—a far smaller and differently calculated base. For more detail, see the Korea JoongAng Daily’s explanation and the IAPP’s PIPA CEO analysis of the CEO accountability provisions.
What is the victim compensation fund Song mentioned, and does it exist yet?
Song committed at the October 13 parliamentary audit to establishing a fund financed directly from fines collected by the PIPC, which would provide direct relief to individuals whose data has been compromised. A bill establishing the fund was introduced in the National Assembly in June 2026 and remains under legislative deliberation — it is not yet law. If enacted, South Korea would become the first major data-protection jurisdiction to operate an enforcement-funded victim compensation pool of this structure; GDPR and US state privacy laws do not have an equivalent.
What does the agentic-AI consent problem actually mean in practice?
Modern privacy law — including South Korea’s PIPA — requires a data subject to consent to specific uses of their data by a specific entity. When a user authorizes an AI agent to complete a task, that agent may autonomously query dozens of external services, combine data from multiple sources, and take actions — none of which generate a discrete consent event tied to the original authorization. The PIPC identified this tension formally in its August 2026 consultation, noting that agentic AI “develops its own workflows in response to a user’s request” in ways that cannot be cleanly mapped to existing consent frameworks. The PIPC’s task force is expected to produce reform proposals as a 2027 legislative priority. The problem is not unique to South Korea: any jurisdiction with a consent-based privacy framework — including the EU under GDPR — faces the same structural challenge.
Are companies headquartered outside South Korea subject to PIPA’s 10%-revenue fine?
Yes — to the extent a company holds personal data of South Korean residents and meets the threshold conditions (10 million or more affected individuals, gross negligence or intent, or a repeat violation), PIPA’s punitive fine ceiling applies regardless of where the company is headquartered. Critically, the fine base is total annual global revenue, not South Korean revenue. A foreign multinational with $10 billion in worldwide annual revenue and a qualifying PIPA breach could theoretically face a fine of up to $1 billion, even if only a small fraction of that revenue comes from South Korean operations. This extraterritorial revenue calculation is the provision that most significantly changes the compliance calculus for global platform operators. See the Korea JoongAng Daily’s analysis for details on how the fine base is calculated.
