Personal information issues are no longer just a problem for large corporations. Even small shops that advertise via text and KakaoTalk can be subject to regulations, so here’s a summary of the changes related to personal information that will be implemented in September and October.
## 1. Amendment of the Personal Information Protection Act (Effective September 11, 2026)
The amended law (Law No. 21445) and its enforcement decree (Presidential Decree No. 36671) went into effect together on September 11. Here’s a breakdown of frequently misunderstood aspects based on the articles:
- The upper limit of fines based on sales generally remains at 3%. The commonly known "10% of sales" applies only when all three conditions are met — ① repeated violations within 3 years, ② related to over 10 million information subjects, and ③ failure to comply with a corrective order before a leak.
- Articles related to leak notification/reporting, security measures, and damages are also revised (Articles 30-3, 31, 32-2, 34, 64-2, etc.).
- The mandatory implementation of ISMS-P (Information Security and Personal Information Protection Management System) is July 1, 2027. Don’t be confused with the timing, as it’s not immediate.
⚠️ Specific details such as the reporting criteria for CPOs in the enforcement decree, the criteria for determining a leak, and the reduction ratio are delegated matters and require verification of the original text.
## 2. Amendment of the Information and Communications Network Act (Effective October 1, 2026)
This is particularly important for small business owners.
- The scope of businesses subject to fines for violations of transmitting advertisements for profit is effectively expanded to all businesses. Even small shops that send promotional messages via text and KakaoTalk can be targeted.
Scope of Impact — If you send advertising texts, it’s safe to check ① whether you properly obtained consent, ② whether you included (Advertisement) markings and a free opt-out method, and ③ whether you obtained separate consent for transmissions during nighttime hours (9 PM to 8 AM). Promotional texts that were previously sent as a matter of course could be considered violations.
⚠️ The upper limit of fines (relative to sales) is based on private interpretations and requires verification.
## In Summary
- Amendment of the Personal Information Protection Act 9/11/2026 effective — 10% fine applies only when all 3 conditions are met, general upper limit of 3% remains, ISMS-P mandatory implementation is 7/1/2027.
- Amendment of the Information and Communications Network Act 10/1/2026 effective — Expansion of businesses subject to fines for violations of transmitting advertisements (small business owners may be subject).
The personal information sector is characterized by large fines and lengthy investigations and lawsuits. Please refer to the original text of the laws and regulations for specific details, and if you frequently use advertising texts, we recommend taking this opportunity to organize your consent and marking methods.
*This article is a guide to administrative trends compiled by Hwang Yun-sang Administrative Agent’s Office based on publicly available information. The applicability to individual cases requires verification with the relevant authority.*