A bill amending Korea's Network Act (정보통신망 이용촉진 및 정보보호 등에 관한 법률) moved from committee referral to committee review on 8 September 2026. Prompted by recent large-scale hacking and personal-data-leak incidents at major domestic firms (including SKT, KT, and card companies), the bill would require information-and-communications service providers meeting criteria to be set by presidential decree to (1) retain system logs for a mandatory minimum period, and (2) immediately preserve the affected server as evidence once a hacking or other breach incident is confirmed. It would also require a joint public-private investigation team to report the content and results of any incident investigation to the National Assembly (draft Articles 45-4 and 48-4(5) and (8), among others). The specific threshold, effective date, and penalty are left to a future presidential decree and have not yet been set.

What this means for you

  • Identify whether you are an "information and communications service provider" under the Network Act. The bill's log-retention and server-preservation duties will apply only to providers meeting a threshold to be defined later by presidential decree — that threshold is not yet published, so you cannot yet confirm applicability with certainty.
  • Review current log-retention practices now. If enacted, you will need a defined minimum retention period for logs; if your current retention policy is shorter or undocumented, start closing that gap before a specific period is set.
  • Build an incident-response step for evidence preservation. The bill would require immediate preservation of the affected server once a breach is confirmed — plan now for how you would isolate and preserve a production server without disrupting service, since this is a new obligation distinct from existing technical/managerial safeguard duties.
  • Track this bill through committee. It is at the committee-review stage only, not enacted. The threshold, effective date, and penalty are all pending and could change materially before passage — treat this as an early warning, not a final rule.

Source: (no source URL provided in input)