A pending amendment to the Personal Information Protection Act would add a new ground for an administrative fine: concealing, understating, or falsely reporting the details a personal information controller must give to affected individuals after a data breach. The bill responds to cases where controllers reportedly used softer language — "exposure" rather than "leak" — to downplay incidents. It applies to all personal information controllers already subject to the existing breach-notification duty, and it is currently at the committee-review stage (moved from committee referral to committee review on 2026-08-26); it is not yet law, and no fine amount has been specified.

The bill would insert a new item, Article 75(2)(17), into PIPA's administrative-fine provisions. Under current law, a controller that becomes aware of a loss, theft, or leak of personal data must, without delay, notify the affected data subject of items including what data was involved and when the incident occurred. The amendment would not change that underlying notification duty — it would add a separate fine exposure for notifications that are incomplete, minimized, or inaccurate.

What this means for you

  • No new obligation yet. This is a bill under committee review, not a change in force. Track its progress rather than acting on it as current law.
  • Review breach-notification language now. If your incident-response templates or public communications use softer terms (e.g., "exposure," "incident") in place of "leak"/"breach" when the facts support the latter, treat that as a risk area regardless of whether this bill passes — the legislative record shows regulators are already scrutinizing this practice.
  • Check your existing breach-notification duty separately. The underlying obligation to notify affected individuals with accurate item- and timing-level detail already applies under current PIPA; this bill only adds an enforcement mechanism for inaccurate or downplayed notifications, not a new baseline duty.
  • Watch for committee action. No effective date or fine amount is set. If the bill advances further, expect a fine schedule and possibly an effective date to be attached at that stage.

Source: