Severity: Medium New version KR Action required
Personal Information Protection Commission adopts rules on investigation and disposition procedures
Original title: [고시] 개인정보 보호위원회의 조사 및 처분에 관한 규정(개인정보위고시 제2026-13호, 2026.9.11. 시행) N
- Published
- Source: pipc.go.kr
- Effective
- Not stated
- Deadline
- Not stated
- Framework: Korea PIPA
- Personal Information Protection Act (Act No. 21445, in force 11 September 2026) source
- in 120 days
- AI development special rules (Act No. 21910) take effect source
Why it matters
The Personal Information Protection Commission (PIPC) of South Korea has adopted Notice No. 2026-13 establishing formal rules governing the Commission's investigation and disposition procedures. The rules, effective September 11, 2026, provide a comprehensive framework for how the PIPC conducts investigations into personal data protection violations and issues administrative dispositions. Organizations subject to PIPC oversight must understand these procedures to ensure compliance with investigation requirements and potential enforcement actions.
What changed
- The PIPC formally adopts standardized procedures for investigating personal data protection violations, replacing any prior ad-hoc or less formal investigation protocols.
- The Commission establishes clear rules for issuing administrative dispositions (corrective orders, fines, and other sanctions) following investigations.
- The notice becomes effective on September 11, 2026, and applies to all subsequent investigations and enforcement actions by the PIPC.
Who is affected
Organizations and individuals subject to South Korea's personal information protection laws; any entity collecting or processing personal data in South Korea; companies under PIPC regulatory jurisdiction.
What to do
AI-assisted summary of the official document; the official text prevails. Not legal advice.