South Korea Raises Data Breach Fines to 10% of Revenue
South Korea's revised Personal Information Protection Act, effective Friday, allows fines up to 10 percent of total revenue for companies that leak personal data of 10 million or more people through intent or gross negligence. The cap applies to repeat offenders within three years or those ignoring corrective orders. Companies must also notify users within 72 hours if exposure risk is high, even without confirmed breach. Investments in data protection can reduce fines by up to 40 percent.
We expect the way companies view investment in data protection to shift from seeing it as a cost to treating it as a proactive investment that builds customer trust and expands corporate profit.