A bill to amend the Personal Information Protection Act has moved from committee referral to committee review (as of 26 August 2026). It targets personal information controllers (개인정보처리자) generally, and would take the current rule on personal-information handlers' access rights — presently set out only in a Personal Information Protection Commission notice — and write it directly into the statute, backed by an administrative fine (과태료) for non-compliance. The trigger cited by the drafters is a real-world pattern: incidents where former employees used access rights they had not had revoked to leak personal information after leaving.

As drafted, the new provision (proposed Article 28(3) and (4)) would require a personal information controller to keep the group of personal-information handlers who can access its processing systems limited to the minimum necessary, and to properly manage and record the granting, changing, and cancelling of that access. No specific threshold, effective date, or fine amount is fixed yet in the material reviewed — the bill is still at the committee-review stage, not enacted law.

What this means for you

  • This is not yet in force. The bill is under committee review; there is no effective date to plan against yet. Treat this as a signal to prepare, not a present obligation.
  • If you handle Korean personal data, check your access-control practice now. Review who currently has access to your personal-information processing systems and whether that access is limited to the minimum necessary for their role — this is the substance the bill would convert from soft guidance into a statutory duty with a fine attached.
  • Check your access lifecycle logging. The bill's focus is specifically on how access rights are granted, changed, and revoked (including on departure/role change). Confirm you have a process — and a record — for each of those three events, since "properly manage and record" is the standard being proposed.
  • Track the bill's progress. Because no threshold or effective date is set, the practical exposure (who is caught, what the fine ceiling is, when it starts) will only become clear as the bill advances. Re-check before assuming this does or doesn't apply to you.

Source: (no source URL was provided with this alert.)