South Korea raises PIPA breach fines to 10%

South Korea’s amended Personal Information Protection Act raises punitive breach penalties to as much as 10% of annual turnover when it takes effect September 11. The Personal Information Protection Commission’s official outline says the new ceiling targets repeated or severe breaches, makes CEOs responsible for privacy management, and delays mandatory ISMS-P certification for covered processors until July 1, 2027. AI builders serving Korean users should treat training-data lineage, access logs, and incident escalation as board-level controls—not vendor paperwork—alongside the training-rights tradeoff Meta exposed for model customers.