Investigations and Sanctions 02PIPC Investigation
Responding to a Personal Information Protection Commission Investigation and Disposition
This is the procedure for when a personal information leak has occurred, or when you have received an investigation letter from the Personal Information Protection Commission telling you to 'submit materials'. It explains what the company must do at each step, from the leak report through the investigation, advance notice of disposition and submission of opinions, to the resolution and challenging it. A leak report has a short deadline of 72 hours from when you become aware of it, so recording the time you learned of the incident is the starting point.
Which step are you at?
Select your current step and the content for that step will appear below.
- 1Leak report / trigger for investigation
- 2Preliminary review / start of investigation
- 3Request for submission of materials
- 4On-site investigation / statements in person
- 5Report of investigation results
- 6Advance notice of disposition / submission of opinions / inspection of evidence
- 7Deliberation and resolution by plenary meeting / subcommittee
- 8Service of the written resolution / disposition takes effect
- 9Objection / administrative appeal / administrative lawsuit
Process flowchart
Click a box to see its explanation below.
- Basic step
- Additional action / option
- Rejection / objection
- End of procedure
Leak report / trigger for investigation
Statutory period 72 hours
Basis: Personal Information Protection Act §34(1)(4), Enforcement Decree §40, Investigation and Disposition Rules §5(1)
Where personal information on 1,000 or more data subjects, or sensitive or unique identifying information, has been leaked, etc., or where a leak, etc. occurred through unlawful outside access, you must report to the Commission or a specialized agency (Korea Internet & Security Agency) within 72 hours from when you became aware of the leak, etc. (Act §34(4), Enforcement Decree §40(1), (3)). If there are unavoidable reasons such as a natural disaster, you may report immediately after they are resolved.Where the possibility of infringement of rights has become significantly low through recovery, deletion, etc., you may not need to report (proviso to Enforcement Decree §40(1)). If you could not confirm the specifics, first report what has been confirmed by then and report additional details as soon as they are confirmed ((2)).Notify the data subjects without delay (Act §34(1)). An investigation begins with a leak report, a report or complaint by a 3rd party, a voluntary report, awareness of a suspected violation, etc. (Investigation and Disposition Rules §4, §4-2, §5(1)).
Next: Preliminary review / start of investigationExplanation
An investigation begins with the company's leak report, a report or complaint by someone else, or the Commission's own initiative. Some leaks must be reported.This is when information on 1,000 or more people, or sensitive or unique identifying information (resident registration numbers, etc.), has been leaked. A leak caused by unlawful outside access also qualifies.In these cases you must report to the Commission or a specialized agency within 72 hours from when you became aware of it. You must also notify the data subjects (the people the information is about) without delay. A late report is itself a violation, so record everything starting from the time you learned of the incident.
- Time required
- Within 6 months (12 months for complex cases) from the start of the investigation to the report of results; the subsequent opinion submission, deliberation, and resolution vary by case
- Cost
- Lawyer's fees and the stamp fee for an administrative lawsuit are separate; check with the investigator in charge about any costs of the Commission's procedure
Procedure guide
Read from start to finish in order. Red text marks deadlines set by law.
- 1
A leak of information on 1,000 or more people, a leak of sensitive or unique identifying information, or a leak caused by unlawful outside access must be reported to the Commission or a specialized agency (Korea Internet & Security Agency) within 72 hours from the time you became aware of it (Personal Information Protection Act §34(4), Enforcement Decree §40(1)). If you have not been able to confirm all the specifics, report first with what has been confirmed and report additional details as soon as they are confirmed (Enforcement Decree §40(2)). Notify the data subjects without delay (Act §34(1)). The time you learned of the incident is the basis for the deadline, so record it starting from the time of the internal report.
- 2
When the Commission starts an investigation after a preliminary review (Investigation and Disposition Rules §5, §6; for reported cases, whether to begin is reported within 14 days from the date the case is assigned), preserve the related logs and documents. If you undergo a preliminary inspection instead of an investigation, you must notify whether you accept a corrective recommendation within 10 days from the day you are notified of it (Act §63-2(3)). If you do not accept or do not carry it out, the matter may proceed to an inspection.
- 3
Check the submission deadline stated in the investigation letter (Rules §9(2)), and if an extension is needed, request it before the deadline passes (§12-2). An on-site investigation letter states that you may refuse investigation beyond its scope (§10(2) item 6), so check the scope first. On request, defense counsel takes part in the investigation (§13).
- 4
The investigation results are reported within 6 months (12 months for complex cases) from the start of the investigation (Rules §7(2)). If it ends with closure of the investigation or a warning or call for attention decided by delegated authority, you are notified within 14 days (§15-2 to §15-4). If it moves to a disposition, an advance notice will come, so start preparing your written opinion in advance.
- 5
The advance notice comes within 14 days from the day the report of investigation results is completed, and a period of 14 days or more for submitting opinions is given (Rules §16(1)). In a penalty surcharge case, you must submit materials proving sales by that date (§16-2(3)). Apply to inspect and copy the supporting materials to check them (§17). You need to see the basis to rebut it accurately.
- 6
The written resolution is prepared within 30 days from the date of the resolution, and corrective measures and penalty surcharges take effect from the day the written resolution is served (Rules §25, §25-2). A penalty surcharge is within 3% of total sales (excluding unrelated sales), or within 10% if there are aggravating grounds such as an intentional or grossly negligent repeat violation (Act §64-2), and is paid within 30 days from the day you receive the notice (Enforcement Decree §60-3(2)). If there is a suspected crime, the company may be accused (§65).
Current step - 7
File an objection within 30 days from the day you receive the disposition (Framework Act on Administration §36), or file an administrative appeal or administrative lawsuit within 90 days from the day you learn of the disposition (Administrative Appeals Act §27, Administrative Litigation Act §20). For an administrative fine, if you file a written objection within 60 days from the day you receive the notice of imposition, it moves to a court trial on the administrative fine (Act on the Regulation of Violations of Public Order §20).
Deadlines to keep from now
- 72 hoursStep 1 Leak report
- 6 months (12 months for complex cases)Step 5 Report of investigation results
- 14 days or more (period set in the advance notice)Step 6 Submission of opinions
- 30 days (objection) / 90 days (administrative appeal or lawsuit)Step 9 Objection / administrative appeal / administrative lawsuit
- 60 daysStep 9 Objection to an administrative fine
Preparation and checks
- Record the time you became aware of the leak and submit the report within 72 hours. The reporting deadline is calculated from when you became aware of it.
- Notify the data subjects (the people the information is about) of the leak without delay, and keep a record of the method and time of notice. Failure to notify is subject to an administrative fine.
- Check the submission deadline and the scope of materials in the investigation letter, and if an extension is needed, request it before the deadline. Under the rules, an extension request must be made before the deadline passes.
- Check the scope of the on-site investigation letter and request the participation of defense counsel. You may refuse investigation outside the scope.
- Write down the day you received the advance notice, and submit your written opinion and materials proving sales by the deadline. These become the basis for calculating the penalty surcharge.
- Manage the deadlines of 30 days (objection), 90 days (administrative appeal or lawsuit), and 60 days (administrative fine) from the day you received the written resolution. Once they pass, you cannot dispute it.
When you need a lawyer
In these cases you need a lawyer's help: when a large-scale leak requires you to decide the content of the report within 72 hours, or when an on-site investigation or statements in person are scheduled.
The same applies when you have received an advance notice of disposition and the opinion submission period is running, or when a penalty surcharge or accusation is expected.
A penalty surcharge is based on total sales and the amount can be large. Also, materials proving sales and the written opinion must be submitted by the date set in the advance notice.
Current position (8/9)
Step 8 · Service of the written resolution / disposition takes effect
What to do now
The Commission prepares and sends the written resolution within 30 days from the date of the resolution. Corrective measures and penalty surcharges take effect from the day you receive the written resolution, so record the date of receipt.
A penalty surcharge is in principle set within 3% of total sales.
Sales unrelated to the violation are excluded from the calculation. It can rise to 10% in the following cases:
a repeat of the same violation within 3 years due to intent or gross negligence, or an intentional or grossly negligent violation affecting 10 million people or more.
Cases where a leak occurred because a corrective order was not followed also qualify.
The penalty surcharge must be paid within 30 days from the day you receive the notice. After the disposition, you must report the implementation results within the period set by the Commission.
What comes next
Step 9 · Objection / administrative appeal / administrative lawsuit
If you cannot accept the disposition, you can file an objection with the Commission within 30 days from the day you received it. The Commission in principle notifies the result within 14 days, and you can file an administrative appeal or lawsuit within 90 days from the day you receive the result.
You may also file an administrative appeal or lawsuit directly, without an objection, within 90 days from the day you learned of the disposition.
Once these deadlines pass, you cannot dispute it again, so calculate and manage them from the day you received the written resolution.
Deadlines to keep from now
- 30 days (objection) / 90 days (administrative appeal or lawsuit)Step 9 Objection / administrative appeal / administrative lawsuit
Basis: Framework Act on Administration §36, Administrative Appeals Act §27, Administrative Litigation Act §20
- 60 daysStep 9 Objection to an administrative fine
Basis: Framework Act on Administration §36, Administrative Appeals Act §27, Administrative Litigation Act §20
When to involve a lawyer
In these cases you need a lawyer's help: when a large-scale leak requires you to decide the content of the report within 72 hours, or when an on-site investigation or statements in person are scheduled.
The same applies when you have received an advance notice of disposition and the opinion submission period is running, or when a penalty surcharge or accusation is expected.
A penalty surcharge is based on total sales and the amount can be large. Also, materials proving sales and the written opinion must be submitted by the date set in the advance notice.
Frequently asked questions
Practical questions that come up right away in this procedure.
- QThe scale of the leak has not been confirmed yet. Do we still have to report within 72 hours?
- Yes. If the leak may be reportable, it is safer to report first within the scope confirmed so far. The Enforcement Decree also provides this. If you have not been able to confirm the specific leaked items or circumstances, first report with what has been confirmed by then.Report additional details as soon as they are confirmed. The deadline runs from when you became aware of the leak, so if you report only after confirming the full scale, you may miss the deadline.State that you will report the unconfirmed parts later, and supplement the report with what the later investigation reveals. What you write in the report becomes the basis for the later investigation, so write only facts.
- QWhat if we cannot submit everything within the deadline for submitting materials?
- Request an extension before the submission deadline passes. Under the rules, an extension request must be made before the deadline passes or before the investigation begins. If you submit the materials that are ready first and state a schedule for the rest, you can reduce the misunderstanding that you are not cooperating.
- QDuring an on-site investigation, do we have to show everything the investigator asks for?
- You must cooperate with materials within the scope stated in the investigation letter, but the letter states that you may refuse investigation beyond the scope of the letter.So first check the purpose and scope of the letter, and for demands you consider outside the scope, state your reasons and keep a record. On request, defense counsel can take part in the investigation, so if it is hard to judge on site, consult counsel.
- QWe received an advance notice. How long is the period for submitting opinions?
- Follow the period stated in the advance notice; under the rules it is set at 14 days or more. During this period, submit a written opinion rebutting the facts, the law, and the level of the disposition.In a penalty surcharge (a monetary sanction imposed for a violation) case, you must also submit materials proving your sales by the same date. It is more accurate to rebut after applying to inspect and copy the supporting materials.
- QHow large can the penalty surcharge be?
- In principle it is set within 3% of total sales. Sales unrelated to the violation are excluded from the calculation basis.Under the amendment of 2026. 3. 10., there are cases where up to 10% can be imposed: a repeat violation within 3 years due to intent or gross negligence, or an intentional or grossly negligent violation affecting 10 million people or more.Cases where a leak occurred because a corrective order was not followed also qualify. So submitting materials at the opinion stage to exclude unrelated sales directly affects the amount.A penalty surcharge must be paid to the financial institution designated by the Commission within 30 days from the day you receive the notice of imposition. If the deadline is missed, an additional charge of 6% per year is added.
- QTo challenge the disposition, do we have to file an objection first?
- No. You may file an objection with the Commission within 30 days from the day you receive the disposition. You may also file an administrative appeal or administrative lawsuit directly, without an objection, within 90 days from the day you learn of the disposition.If you filed an objection, file an administrative appeal or lawsuit within 90 days from the day you are notified of the result. An administrative fine is challenged separately by filing a written objection within 60 days.
When you need a lawyer
- The 72 hours for a leak report are calculated from when you became aware of the leak. You need to record the time it was first reported internally to be able to explain whether the timing of the report was appropriate.
- The opinion submission period (14 days or more) is your chance to dispute the facts and the scope of sales before the disposition. In a penalty surcharge case, materials proving sales must also be submitted by this date (Investigation and Disposition Rules §16-2(3)), so prepare them within the deadline.
- Corrective measures and penalty surcharges take effect from the day the written resolution is served, and challenging them does not automatically stop the effect of the disposition (Administrative Litigation Act §23(1)). So manage the period for reporting implementation results together with the deadlines for challenges.
Related laws
- Personal Information Protection Act Article 7-12 (subcommittees), Article 34 (notification and reporting of leaks), Article 63 (requests for materials and inspection), Article 63-2 (preliminary inspection), Article 64 (corrective measures), Article 64-2 (penalty surcharges), Article 65 (accusation and recommendation of disciplinary action), Article 66 (publication), Article 75 (administrative fines)
- Enforcement Decree of the Personal Information Protection Act Article 40 (leak reporting), Article 60-3 (imposition and payment of penalty surcharges)
- Regulations on Investigation and Disposition by the Personal Information Protection Commission
- Framework Act on Administration Article 36 (objection), Administrative Appeals Act Article 27, Administrative Litigation Act Articles 20 and 23, Act on the Regulation of Violations of Public Order Articles 16, 20, 21
Responding to a Personal Information Protection Commission Investigation and Disposition,
Curious how your own case will proceed?
