Korea data watchdog sets fast-track rules as breach reports near 2025 total

The Personal Information Protection Commission said Friday it will introduce fast-track procedures and concentrate investigative resources on major data breaches, after reports of leaks and intrusions climbed to 432 in the first half of 2026, close to the 447 filed in all of 2025.

Under the plan, cases meeting any of three criteria — a leak affecting at least 1 million people, incidents drawing broad public concern, or hacks of major public systems — will be handled by a dedicated investigation team assembled as soon as the incident is reported, with an on-site response team checking notification to data subjects and measures to stop the damage from spreading.

Smaller cases will move on a separate track. Ordinary cases will be grouped by type and handled in batches under standardised violation and penalty criteria, while minor cases involving small and mid-sized businesses will get a first-time exemption from fines and technical support focused on fixing the cause. The commission has set aside 2.2 billion won ($1.62 million) in next year's budget proposal for that follow-up support.

Song Kyung-hee, chair of the commission, said the volume and complexity of cases made an even approach impractical. "With data breaches and intrusions surging and large, complex cases increasing, we need to allocate investigative capacity according to the importance and characteristics of each case rather than handling every case the same way," she said.

The commission set deadlines by case weight: 12 months for major incidents, six months for ordinary ones and three months for minor ones. Reports have risen steeply, from 167 in 2022 to 318 in 2023 and 447 in 2025.

In a change aimed at cutting the backlog of penalty cases, the commission will widen the scope of its subcommittee to cover cases with expected fines of 100 million won ($73,551) or less, and will lift that threshold to 1 billion won ($735,510) in stages. That would put roughly 54 percent to 85 percent of penalty cases through the subcommittee.

The commission also said it will publish more about how it handles cases, moving beyond counts of disciplinary actions to annual reception and disposal figures by institution, average investigation times, litigation status and details of major leaks, and will disclose how fines are calculated, including the severity assessment, aggravating and mitigating rates, the base imposition rate and the newly introduced investment reduction rate.