Breach Penalties Are an Engineering Requirement

Korea's Personal Information Protection Act was amended to add a higher penalty tier of up to 10 percent of total annual revenue for the most serious violations, alongside the existing ceiling of 3 percent of related revenue that continues to apply elsewhere, as reported by Korea JoongAng Daily in September 2026 and by the law firm Hunton Andrews Kurth.

The conditions described for the higher ceiling involve intentional or grossly negligent conduct affecting a very large number of individuals, repeat violations within a defined period, or a breach following failure to comply with a corrective order from the Personal Information Protection Commission. Reporting describes a reduction of up to around 40 percent where a controller can show prior investment in data protection budget, staff, and systems, and a 72-hour user notification requirement. Hunton reported that the amendments designate the business owner or representative as the ultimately responsible person for data protection.

The dates are worth stating precisely, because secondary coverage reports them inconsistently. The National Assembly passed the amendment on 12 February 2026, it was promulgated on 10 March 2026, and it took effect on 11 September 2026, six months after promulgation. Anyone relying on the operative date should confirm it with the regulator rather than with secondary coverage, including this page.

The pattern is not confined to one jurisdiction. Reporting by the Associated Press on 21 September 2026 described Ireland's Data Protection Commission fining Google 403 million euros, equivalent to about 463 million dollars, over the lawfulness, fairness, and transparency of location data processing under the GDPR, concerning historical practices. That case was about lawful basis and transparency rather than a breach, which is worth noting because engineering attention tends to concentrate on breach prevention alone.

Why the clock is the hard part

Read-level audit logging on personal data. Notification obligations ask which individuals and which data. Most systems log writes thoroughly and reads barely, so the honest answer after an intrusion is often that any of it could have been viewed. That answer maximises both the notification population and the appearance of negligence, and the fix is unglamorous: log access to sensitive records, retain those logs longer than you think necessary, and store them where an attacker with application access cannot edit them.

Retention that actually deletes. Data retained past its usefulness is pure liability once fines scale with revenue, because it adds to the exposed population without adding value. Retention policies commonly exist on paper and are not enforced in the database, in backups, in exports, in analytics copies, or in support tickets. Every copy counts in a breach.

Field-level inventory. You cannot assess exposure quickly without knowing which systems hold which categories of data for which populations. Assembling that during an incident is what consumes the first several days of the clock.

Detection that covers data access patterns. Most detection watches for intrusion. Notification questions are about data movement: unusual volumes read, exports at odd hours, queries touching more records than a role requires. Those are different signals and need building deliberately.

Evidence of your own controls. Where mitigation credit exists for prior investment, it has to be demonstrable. Dated records of assessments, controls implemented, and decisions taken are the artefact, and reconstructing them after an incident is not the same thing.

A notification decision path that runs at speed. Who decides, on what information, out of hours. A 72-hour clock spent locating the right approver is the most avoidable way to miss a deadline.

Data minimisation has a number attached now. When exposure is scaled to revenue, every field collected without a clear purpose and every unnecessary copy is a quantifiable liability. That reframes an argument engineers have been making on principle for years into one the business already knows how to evaluate.

Lawful basis is a design question, not a policy document. The location data case concerned how choices were presented and what processing followed from them, which is implemented in interfaces and defaults rather than in a privacy notice. Retrofitting it is expensive, which is the argument for settling it before shipping.

Accountability shifting upward tends to help. Where regulation names a senior individual as responsible, attention and budget usually follow. That is the moment to bring forward the logging and retention work that has been deferred, because the conversation is briefly easy.

Do not build to a single jurisdiction's number. Thresholds and ceilings differ and change. What transfers across all of them is the same short list: know what data you hold and where, detect access quickly, be able to say what was read, delete what you do not need, and be able to notify fast.

Keep the legal and engineering views in one place. The recurring failure is that legal knows the obligations and engineering knows the systems, and no single artefact connects them. A data map that records both the obligation and the system implementing it is what makes the first day of an incident tractable.

This page describes publicly reported regulatory developments and is not legal advice.