A pending amendment to the Personal Information Protection Act would raise the criminal penalty for refusing or falsifying data in response to a Personal Information Protection Commission (PIPC) data-submission request, or for concealing/destroying records after an on-site inspection has begun, from up to 2 years' imprisonment or a KRW 20 million fine to up to 3 years' imprisonment or a KRW 30 million fine (draft Article 72(4) and (5)). The bill was referred to the competent committee and moved to committee review on 26 August 2026; it is not yet law and no effective date has been set. It would apply to any data controller (개인정보처리자) — including a foreign company subject to PIPA — that is the subject of a PIPC data-submission request or on-site inspection.
What this means for you
- This is a penalty increase for obstruction, not a new duty — if you already cooperate fully with PIPC data-submission requests and inspections, the amendment does not change what you must do, only what non-cooperation costs.
- If you operate a data-processing entity or domestic representative in Korea, confirm your internal protocol for responding to a PIPC request is set up to produce complete, accurate records rather than withhold or alter them — the bill specifically targets refusal, false submission, and post-inspection concealment or destruction of data.
- No effective date is set. Track committee movement rather than acting now; we will flag this again if the bill advances or an effective date is fixed.
Source: