Hashed & Salted | A Privacy and Data Security Update
Since 2020, South Korea and Japan have reshaped privacy
enforcement in ways that directly affect global businesses. South
Korea's Personal Information Protection Commission (PIPC)
drives an enforcement-first regime with corrective orders, public
decisions and administrative surcharges tied to global revenue,
while Japan's Personal Information Protection Commission (PPC)
applies the expanded, extraterritorial Act on the Protection of
Personal Information (APPI) with mandatory breach notifications and
a guidance-first model that escalates to binding orders and
criminal penalties.
South Korea's PIPA: Amendments and
Scope
In 2023, South Korea elevated the PIPC to an independent,
top-tier authority and consolidated core enforcement powers. The
overhaul shifted emphasis from criminal liability toward more
substantial administrative penalties and raised the ceilings of
fines that regulators can impose. Regulators
