In the event of a personal information leakage, the personal data controller must notify the affected data subjects within 72 hours of becoming aware of the leakage. The personal data controller must also report to the regulator within 72 hours if: 

• personal information of 1,000 or more data subjects has been leaked;
• sensitive information or unique identification information has been leaked; or
• personal information has been leaked through unauthorized access from the outside. 

However, no regulatory reporting is needed if the personal data controller is able to take measures to significantly reduce the possibility of infringement of the rights and interests of the affected data subjects, such as retrieving or deleting the compromised personal information.

The 2026 PIPA amendment significantly broadens the scope and timing of these obligations:

• Expanded definition of “breach, etc.”: The statutory definition of a reportable incident has been expanded beyond “loss, theft, or leakage” to now explicitly include “forgery, alteration, or damage” of personal information.
• Lowered notification trigger: Crucially, while the previous law required notification only after a breach “has occurred,” the amended PIPA mandates notification upon becoming aware of a “possibility of a breach, etc.” The specific criteria for this “possibility” will be further defined in the Presidential Decree, taking into account the type of information, the level of risk, and the potential impact on data subjects.
• Mandatory disclosure of remedies: When notifying data subjects and reporting to the regulator, personal data controllers must now include information on available remedial measures. This includes providing clear guidance on procedures for claiming damages or applying for dispute mediation, ensuring that both individuals and the regulator are informed of the necessary steps for post-incident relief.