On September 11, 2026, amendments to the Personal Information Protection Act (PIPA) came into effect in South Korea. The cap on the turnover fine increased from 3% to 10% of the company's total revenue, liability for data breaches was placed directly on the top executive, and users must now be notified within 72 hours—even if the breach has not yet been confirmed and only appears likely.
This news primarily concerns the Korean telecoms and marketplaces. However, if you are collecting data from Korean platforms—monitoring prices on Coupang, Gmarket, and 11st, scraping Naver search results, tracking K-beauty assortments, or gaming service releases—these amendments directly affect you, even if you have no office or legal entity in Korea. Below is what exactly has changed, why foreign parsers fall under this law, and a practical checklist on how to collect data from the Korean segment without incurring regulatory risks.
What Changed on September 11
The amendments passed the National Assembly on February 12, 2026, were announced on March 10, and took effect six months later. Key points include:
- The fine cap is now 10% of total revenue instead of the previous 3%. The base is important: it is not "revenue from the violation," but the company's turnover.
- Three triggers for the maximum fine. The Personal Information Protection Commission (PIPC) can impose a 10% fine if the violation was committed intentionally or with gross negligence and is repeated within three years; if it affects 10 million people or more; or if the company fails to comply with a PIPC order and a breach occurs thereafter.
- 72 hours to notify. Previously, the countdown began from the confirmed breach. Now, notification is required when there is a high likelihood of compromise—such as after unauthorized access to processing systems or after discovering that part of the data is already being traded.
- The definition of an incident has expanded. In addition to "loss, theft, or leak," forgery, alteration, and damage to data have been added. In simple terms, a ransomware attack that does not extract data but damages it is now also a reportable incident.
- Personal responsibility of the executive. The "ultimate responsible" person for data protection is designated as the business owner or their representative, and large companies are required to appoint and change the Chief Privacy Officer (CPO) with board approval.
- Mitigating circumstances. Fines can be reduced—by up to 40% for proven prior investments in data protection and another 40% for early detection and rapid notification. Details have been delegated to the level of presidential decree.
What is the Financial Impact
The tightening of regulations was prompted by a series of breaches in retail, telecom, and finance. The most costly incident involved Coupang, the largest Korean marketplace: 37.55 million people were affected, and the fine in June 2026 amounted to 624.6 billion won (approximately $410 million). In July 2026, the PIPC fined KT 53.979 billion won (about $39 million)—including for concealing the incident. A year earlier, the telecom operator was fined around 134.7 billion won for exposing the data of 23 million users—at that time, it was a record.
The logic of the regulator was articulated clearly by its head, Son Kyung-hee: the agency expects companies to start viewing data protection as a preventive investment rather than an expense incurred after an incident. The turnover fine of 10% is a way to make the arithmetic compelling.
Why This Affects Foreign Parsers
The main misconception is: "the server is not in Korea, there is no legal entity there—so it is not my jurisdiction." In practice, this does not hold true for three reasons.
Extraterritoriality through application. The text of PIPA does not contain an explicit article on extraterritorial application, but the PIPC, in a methodological explanation from April 2024, discusses applicability based on three factors: whether goods or services are offered to Korean data subjects; whether the processing significantly affects Korean users; and whether the operator has a place of business in Korea. Just one of these is sufficient. Additionally, the Framework Act on AI, effective from January 22, 2026, already contains a direct provision on extraterritorial application for those who influence the Korean market or users.
Obligation to appoint a representative. For foreign operators subject to PIPA, the requirement for an internal privacy representative was strengthened as of October 2, 2025. This means the regulator has established a point of contact within the country in advance.
Refusal to respond is not a defense. In November 2025, a foreign operator of a wiki project refused to provide the PIPC with investigation materials, citing that its headquarters is abroad. The commission referred the case to law enforcement. This illustrates how the PIPC regards the argument of foreign registration.
"Data was publicly available" is not a valid basis
PIPA is built around the consent of the data subject. The list of cases where consent is not required is closed: processing is mandated by law, necessary for the performance of a contract with the subject, required in the event of an imminent threat to life or property, dictated by urgent public safety and health tasks, or based on the legitimate interest of the operator—but only if it "clearly outweighs" the rights of the subject and the processing is within reasonable limits. The item "information was published publicly" is not included in this list.
The second point is what constitutes personal data. PIPA covers not only direct identifiers (name, resident registration number, image) but also data that "can be easily combined with other information" to identify a specific person, taking into account the time, cost, and technologies required for such combination. For parsing, this means: a seller's nickname plus region plus history of listings—this is already potentially personal data, even if there is not a single field with a real name in the export.
Checklist: How to Collect Korean Data Without Getting Caught
- Separate the dataset into product and personal data. Price, availability, SKU, category, delivery time, product rating—these are not personal data. Seller profile, review with a nickname and history, pickup point address, order number—these fall under PIPA. If you need the first layer, the second should not be stored at all.
- Filter fields on input, not on export. A classic mistake: the parser collects everything indiscriminately, while the filter is on the display. Legally significant is the fact of storage, not what you show in analytics. The filter should be placed in the pipeline between the website's response and the database entry.
- Do not store raw responses. Saved HTML of the review page or a screenshot of the product card is a complete copy of personal data, just in an inconvenient format. If the raw data is needed for debugging, keep it in a circular buffer for hours, not in an archive for years.
- Maintain provenance. For each source: where it was collected from, when, what fields were included, on what basis, how long it is stored, when it is deleted. This is the only document that transforms a conversation with the regulator from a presumption of guilt into a discussion of facts. It also counts as "prior investments in protection," for which discounts of up to 40% are given.
- Check the origin of purchased data. Ready-made datasets, enrichment lists, and "warming databases" are the quickest way to get someone else's leak into your storage. You do not cease to be an operator just because you did not collect the data yourself.
- Know your volume. The threshold of 10 million subjects is not an abstraction for giants. An aggregator that accumulates profiles of sellers and reviewers across several platforms for three years reaches this threshold faster than it seems.
- Draft a 72-hour protocol in advance. The scenario "there are signs, but no confirmation" now requires action, not waiting. Who makes the decision, who writes the notification text, where the report is sent—this must be resolved before an incident, not the night after.
- Observe the platform's technical signals. robots.txt, crawl-delay, stated limits, refusal of authorization where data is available without logging in. This is not always legally required, but it is the first thing both the regulator and the court look at when assessing good faith.
Where Proxies Fit In and Where They Don't
Let’s be clear: proxies do not make data collection legal and do not shield you from the regulator. Internal representatives, referral of cases to law enforcement, and turnover fines based on revenue all apply regardless of the IP from which your crawler operates. Considering proxies as a legal shield is a costly mistake.
The tasks that proxies truly solve in the Korean segment are different and quite practical:
- Correct display. Korean marketplaces and aggregators show prices, delivery times, and availability based on the region. Without a KR address, you will collect incorrect figures—and you won’t notice this because the page will return with a 200 code. The same trap was discussed in the context of logistics zones in the article about monitoring competitor prices in e-commerce.
- Load distribution. Spreading requests across addresses to avoid hitting platform limits and causing problems is exactly the behavior expected from a good-faith collector. Residential proxies are suitable for catalogs and search results where the reputation of the address is important; mobile proxies are for platforms focused on mobile applications and closely monitor the type of connection.
- Check your own output. If you are selling to Korea, viewing your product card and ads from the perspective of a local user can only be done from a local address.
It is worth comparing approaches: Europe in 2026 opted for detailed methodological clarifications for scraping—dedicated to an analysis of EDPB recommendations. Korea chose a different lever: rather than clarifying the boundaries of what is allowed, it made the cost of mistakes so high that they are considered in advance. For teams operating in both markets, the practical takeaway is to build the pipeline according to the stricter of the two frameworks and not to hold personal fields that are unnecessary for the task.
Conclusion
As of September 11, 2026, the Korean regulator has the authority to impose a fine of 10% of turnover, personal responsibility on executives, and the right to demand notification based solely on suspicion of a breach. For those collecting data from Korean platforms, this is not a reason to exit the market: product data remains accessible as it always has. It is a reason to conduct an audit—what exactly is being stored in your database, why, on what basis, and for how long.
The cheapest way to stay below this threshold has long been known and remains unchanged: do not collect personal fields that are unnecessary for the task. Everything else—geo, limits, stability of collection—can be resolved through infrastructure. If a Korean address is needed for a correct display or load distribution, check out the practical guide on proxies for scraping and select the type suitable for the specific platform.