Cybersecurity law & regulation in South Korea (2026)
Cybersecurity in South Korea: sectoral rules.
South Korea regulates cybersecurity through multiple sector-specific laws rather than one omnibus statute: the Network Act governs information and communications service providers, PICIA protects designated critical information infrastructure, PIPA imposes data-security and breach-notification duties, and financial-sector rules apply to banks and fintech. National strategy is set by the National Cybersecurity Strategy and Basic Plan (revised 2024) and coordinated across MSIT/KISA and the National Intelligence Service. A major PIPA amendment passed in 2026 (effective Sept 11, 2026) tightens breach-notification timing, raises penalties, and phases in mandatory ISMS-P certification.
Legal framework
A patchwork of sector-specific statutes, the Act on Promotion of Information and Communications Network Utilization and Information Protection ('Network Act'), the Act on the Protection of Information and Communications Infrastructure ('PICIA', critical infrastructure), the Personal Information Protection Act ('PIPA'), and the Electronic Financial Transactions Act (finance), overseen by MSIT/KISA, the NIS, the PIPC and the FSC, rather than a single comprehensive cybersecurity law.
Key points: cybersecurity in South Korea
No single omnibus law, sectoral patchwork
Rather than a NIS2-style comprehensive cybersecurity act, Korea relies on a complex set of sector-specific statutes. The Network Act is the foundational law for information and communications service providers; PIPA, PICIA and financial-sector rules layer on top.
Critical infrastructure (PICIA)
The Act on the Protection of Information and Communications Infrastructure lets central agencies designate 'critical information and communications infrastructure', which is subject to periodic vulnerability analysis; any 'electronic intrusion' (hacking, malware, DoS, etc.) must be reported to the relevant authority and KISA.
Breach notification under PIPA
Data controllers must notify affected data subjects and the Personal Information Protection Commission of personal-data breaches. The 2026 PIPA amendment moves the trigger to a 'reasonable likelihood' of a breach (before full verification) and expands notifiable events to include forgery, alteration and destruction of data (covering ransomware/data-corruption scenarios).
2026 PIPA amendment, stronger enforcement
Passed by the National Assembly in February 2026 and promulgated March 10, 2026 (most provisions effective Sept 11, 2026): maximum administrative penalty raised from 3% to up to 10% of total revenue in defined cases, the business representative designated 'ultimate person responsible', and ISMS-P certification made mandatory for large-scale data controllers from July 1, 2027.
Financial-sector cyber rules
Banks, fintech and electronic-finance businesses are governed by the Electronic Financial Transactions Act and FSC/FSS rules; the Regulations on the Supervision of Electronic Financial Transactions were comprehensively revised effective February 5, 2025, shifting from a prescriptive 'rule-based' to a 'principle-based' security regime.
National strategy and governance
The National Cybersecurity Strategy and accompanying National Cybersecurity Basic Plan (revised 2024) set five objectives and ~100 initiatives; the government issued '1st Comprehensive Interagency Information Security Countermeasures' (Oct 2025) and a refined '2nd' set (Jan 2026). MSIT/KISA handle the private sector and the National Intelligence Service coordinates public-sector/national security cyber matters.
Timeline of decisions
- IncidentNational Information Resources Service Data-Centre Fire Destroys Critical Government Infrastructure
A lithium-ion battery fire at South Korea's National Information Resources Service (NIRS) burned for 22 hours, damaging facilities that host more than one-third of the government's datacentres; water suppression could not be used, requiring gas systems. The incident exposed the fragility of centralised government ICT infrastructure and prompted emergency reviews of backup and business-continuity obligations across public agencies.
TechCrunch
- IncidentSK Telecom USIM Data Breach: 23 Million Subscribers' Authentication Keys Exfiltrated
SK Telecom, South Korea's largest mobile carrier, disclosed that attackers had maintained undetected access for nearly three years, stealing IMSI numbers, USIM authentication keys, and other sensitive identifiers for approximately 23 million subscribers. The breach is among the most consequential in the country's history given its national-security implications (SIM authentication key theft enables cloning and interception) and triggered parliamentary hearings, emergency SIM replacements, and the record PIPC enforcement action.
Alston Privacy & Cybersecurity Blog
- LawAmended Network Act Mandates 24-Hour Cyber-Incident Reporting and Expands CISO Duties
Amendments to the Act on Promotion of Information and Communications Network Utilisation and Information Protection (Network Act) entered force on 14 August 2024, requiring information and communications service providers to report cybersecurity incidents to the Korea Internet & Security Agency (KISA) within 24 hours of detection and file supplementary reports within 24 hours of confirming additional details. The CISO role was expanded to cover staffing and budget oversight for security and to include regular board-level reporting; repeat offenders face administrative fines of up to 3% of annual revenue.
Kim & Chang (analysis of official Network Act amendment)
- GuidanceSouth Korea Releases 2024 National Cybersecurity Strategy, Embracing Offensive Cyber Defence
The National Security Office published a new National Cybersecurity Strategy in February 2024, shifting South Korea's posture from purely defensive to proactive 'offensive cyber defence', authorising preemptive operations against threat actors targeting national security, with an emphasis on public attribution, threat-intelligence sharing, and joint advisories with allies (notably the United States). A follow-up National Cybersecurity Basic Plan detailed implementation tasks across government, critical infrastructure, and the private sector.
NK News
- DecisionISMS and PIMS Merged into Unified ISMS-P Certification Scheme
The Korea Internet & Security Agency (KISA) merged the Information Security Management System (ISMS) and the Personal Information Management System (PIMS) into a single ISMS-P certification, creating a comprehensive standard that covers both cybersecurity controls and personal-data-protection processes. Mandatory certification under ISMS-P applies to large internet service providers, hospitals, and educational institutions exceeding specified user or revenue thresholds.
Baker McKenzie Global Data and Cyber Handbook
- IncidentKorea Credit Bureau Insider Breach: 20 Million Records Stolen, Triggering Nationwide Regulatory Response
A KCB contractor copied financial records, including names, social security numbers, and credit-card details, of approximately 20 million people (roughly 40% of the population) from three major credit-card companies onto a USB drive and sold the data to marketing firms. The incident exposed the absence of mandatory encryption and adequate access controls; it prompted emergency legislative amendments, senior executive resignations, and accelerated the push for the ISMS-P merger and stricter security-obligation rules.
SecurityWeek
- Guidance · officialPresidential Directive No. 316 Establishes National Cybersecurity Governance Framework
Presidential Directive No. 316 formalised South Korea's whole-of-government cybersecurity structure, designating the National Security Office as the apex coordinating body, the National Intelligence Service's National Cyber Security Center as responsible for government network security, the Ministry of Interior and Safety for public-institution security, the Ministry of Science and ICT for private-sector security, and the Defense Ministry for military systems. This framework remained the structural backbone of Korean cybersecurity governance until the 2024 Strategy.
NATO CCDCOE — Tallinn National Cybersecurity Organisation: Republic of Korea (2022)
- LawKorea Internet & Security Agency (KISA) Established
KISA was created in April 1996 as the government's operational arm for internet security policy, cyber-incident response coordination, and safe-internet promotion. It became the technical infrastructure behind cybersecurity enforcement, working alongside content regulators to implement national-level blocking and breach-response directives.
ICANNWiki / KISA
Sources
- practiceguides.chambers.com/practice-guides/cybersecurity-2026/south-korea/trends-and-development
- practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/south-korea/trends-and-d
- resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/asia-pacific/south-korea/
- resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/asia-pacific/south-korea/
- lexology.com/library/detail.aspx?g=016a929c-ad58-4d1d-8bf6-807b4272863e
- elaw.klri.re.kr/eng_mobile/viewer.do?hseq=67981&type=part&key=4
- hunton.com/privacy-and-cybersecurity-law-blog/south-korea-amends-privacy-law-to-
- publications.iadb.org/publications/english/document/National-Cybersecurity-Law-Governance-a
- hoganlovells.com/en/publications/south-korea-considers-updates-to-data-and-cyber-laws
Next for South Korea: Starting a BusinessEasy
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 23 May 2026. Methodology & how to cite · State of Technology Regulation 2026