A bill introduced on 7 September 2026 by Rep. Park Hyung-soo and nine co-sponsors would move a duty currently set only in administrative rule up into the Personal Information Protection Act itself: personal information controllers (개인정보처리자) would be required to revoke or change the access rights of personnel who handle personal data (개인정보취급자) when their duties change, and to keep records of each grant, change, and revocation for three years. A violation would draw an administrative fine (과태료), where none attaches under the current administrative-rule-only version. The bill has been referred to its competent committee and is not yet law.

The stated reason is that leaks caused by departed or transferred staff keep recurring because the existing access-management duty lacks the force of statute and cannot be directly sanctioned. The proposed amendment would insert new paragraphs 2 and 3 into Article 28 to fix the duty, the record-keeping period, and the penalty in law.

What this means for you

  • This is a bill, not current law. No effective date has been set and the duty is not yet enforceable. Track its progress through committee rather than acting on it as binding today.
  • If enacted, the addressee is broad: any personal information controller that manages access rights for staff handling personal data — this is not limited to large operators, so foreign companies with Korean personnel or Korean-facing operations under PIPA should assume it could reach them.
  • Get ahead of the record-keeping requirement now. Review whether your access-provisioning process already logs grants, changes, and revocations, and whether those logs could be retained for three years without a process change.
  • Build the revocation trigger into offboarding and role-change workflows, since the bill ties the duty specifically to changes in an employee's duties or departure, not only to termination.
  • Watch for the penalty amount and threshold once the bill is further amended — the current text specifies an administrative fine but does not yet fix the amount.

Source: