[Welfare & Veterans] Personal Data Breach Notification and Reporting Within 72 Hours — Must You Report Even Under 1,000 People?

3-Line Summary

1. You must notify the data subjects of the statutory items within 72 hours from the time you become aware of the personal information leak.
2. Even if the number of leaked individuals is less than 1,000, it is subject to reporting (to the Personal Information Protection Commission or the Korea Internet & Security Agency) if sensitive information, such as health information, or unique identification information is included.
3. According to the amended law effective September 11, 2026, the notification must also include information on rights to remedy damages, such as compensation for damages and dispute mediation.

Table of Contents

1. An email received on a Saturday morning
2. The timing of discovery and the 72-hour calculation
3. Why measures to prevent spread were taken first
4. Why it is subject to reporting even with fewer than 1,000 people
5. Items that must be included in the notification
6. How to notify members who cannot be reached
7. Preparing and submitting the report
8. Prevention of recurrence and separate consent for sensitive information
9. Matters to check immediately after a leak incident

1. An email received on a Saturday morning

I am an administrative agent (Haengjeongsa) working in Songdo, Incheon. I would like to introduce an anecdote I encountered while working.

A little after 8:00 AM on a Saturday, an email arrived. The subject line was “The member list was posted in a group chat,” and the body included three screenshots of the chat room and a memo transcribing the column names from an Excel file. The sender was a representative in their late 20s who runs a small Pilates studio in Yeonsu-gu.

The situation was as follows: At around 9:40 PM on Friday night, an employee attempted to post next week’s class schedule to a group chat used for member announcements but accidentally uploaded the member management Excel file located right next to it. The group chat contained about 320 people, including both current and former members. At 10:05 PM, a member sent a private message asking, “Is it okay for this file to be posted?” and the representative read that message at 10:10 PM. The employee deleted the file immediately, but it had remained in the group chat for nearly 30 minutes.

This studio was everything to the representative. In their second year of business, the membership base was stabilizing, and they were currently undergoing loan consultations ahead of a lease agreement for a second location next spring. If the members’ trust were shaken, they would have to reconsider the plans for the second location.

Attached to the end of the email was a draft of an apology text message, written using a template the representative had found online overnight. It was accompanied by the question, “Since the number of members is less than 1,000, it seems I don’t need to report it, and since I deleted the file, is it enough to just send an apology text?”

2. The timing of discovery and the 72-hour calculation

I scheduled a telephone consultation for 10:00 AM and reviewed the photos and notes beforehand. The first thing I checked was when they became aware of it.

Article 39, Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act stipulates that a personal information controller must notify the data subjects of a leak in writing or other methods within 72 hours once they become aware of it. The starting point is not the time the file was uploaded, but the time the controller became aware of the fact of the leak. However, in this case, since there was a record in the form of a private message from a member, it was clearest to use 10:10 PM on Friday night, when the representative read the message, as the baseline.

Looking at it that way, the deadline is 10:10 PM on Monday. During the call, I suggested the following schedule to the representative:

• Saturday: Measures to prevent spread in the group chat, checking Excel file column items, classifying leaked items for each member
• Sunday afternoon: Sending notification text messages to members
• Monday morning: Submitting the report to the Korea Internet & Security Agency (KISA)
• Monday afternoon: Checking members for whom text messages failed and posting a notice at the business premises

If everything is left until the final day of the deadline, even a single error in sending text messages could cause the deadline to be missed. I moved the schedule up by one day each to allow for a buffer.

3. The Reason for Taking Measures to Prevent Spread First

The representative stated, “The files have already been deleted.” However, even if a file is deleted from a chat room, it remains on the mobile phones of anyone who downloaded it within that 30-minute window. Article 34, Paragraph 3 of the Personal Information Protection Act stipulates that if a leak occurs, necessary measures must be taken, including measures to prevent the spread of damage, such as recovery and deletion.

Therefore, I organized the chat room before drafting the notification.

1. Chat Room Notice: I posted a notice stating that files had been uploaded by mistake and requested that anyone who downloaded them delete the files and send a reply confirming the deletion.
2. Record of Deletion Confirmation: I organized the names and times of the members who replied into a table. By Saturday evening, 47 people had replied saying they had “opened and deleted it” or “did not download it.”
3. Changes to Chat Room Management: I re-checked the settings to ensure members could not upload or download files in the announcement room, and I separated the devices so that the staff’s work chat room and the announcement room were not used side-by-side on the same mobile phone screen.

These measures served to reduce damage and would also be included verbatim in the “Response Measures” section of the notification and the report to be written later. In administrative documents, the order is reversed. You must first have a record of what you did before you can write that you did it.

4. Why It Is Subject to Reporting Despite Having Fewer Than 1,000 People

The Excel file contained information on 860 people. This was the total number of current members and dormant members combined. This was the basis for the representative’s thought that “since it is not 1,000 people, we do not need to report it.”

Article 40, Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act defines three categories for reporting subjects:

If even one of these three applies, a report must be filed within 72 hours. The problem was the ‘Memo’ column on the far right of the Excel file. Since the representative had only written the column name in the memo sent to me, I asked over the phone what was contained in that column. After opening the file briefly, the representative replied, “I wrote those down to be careful during classes. Things like herniated discs, knee surgeries, weeks of pregnancy, and so on.” Among the 860 people, 140 had such memos.

Article 23, Paragraph 1 of the Personal Information Protection Act defines information regarding health as sensitive information. Even if an instructor wrote the memo to ensure safety during class, if the content concerns health status, it is sensitive information. While it was not a reporting subject based on the number of people, it became a reporting subject because of this single column.

The proviso in Article 40, Paragraph 1 of the Enforcement Decree also states that a report may not be filed if the route of the leak is confirmed and the possibility of infringement on the rights and interests of the data subjects has been significantly reduced through measures such as recovery and deletion. I also reviewed this proviso. However, there were 320 people in the chat room, and only 47 people had confirmed deletion. There was no way to verify whether the remaining people had downloaded the files. I judged that it was difficult to view the situation as “the possibility has been significantly reduced” in this state, so I decided to file the report.

5. Items that must be included in the notification

The apology text written by the representative was polite. However, because it was an old template found on the internet, it did not match the items required by current law.

The notification items prescribed by Article 34, Paragraph 1 of the Personal Information Protection Act are as follows:

1. Items of the leaked personal information
2. The timing and circumstances of the leak
3. Specific information on methods the data subject can take to minimize damage
4. The personal information controller’s response measures and damage relief procedures
5. The department in charge and contact information for reporting damage, etc.
6. The data subject’s legal rights, such as claims for damages or statutory damages and dispute mediation, and the methods for exercising them
7. Other matters prescribed by Presidential Decree

Among these, item 6 is an item that was revised in March 2026 and went into effect on September 11. The template the representative found was from before the revision, so it only went up to item 5. Since it has been only about a month since it went into effect, many templates floating around the internet were still the old versions.

The notification was written in two versions.

• For the 140 people with notes: I listed the leaked items as “Name, mobile phone number, date of birth, membership type, and class reference notes (including health-related content).”
• For the remaining 720 people: I excluded the notes item and only listed name, mobile phone number, date of birth, and membership type.

If a single notification stating “includes health information” were sent to everyone, the 720 people without notes would become unnecessarily anxious. Conversely, if it were unified as “no health information,” it would be an inaccurate notification to the 140 people. The “items” in item 1 must be accurate for each member.

In item 3, I included specific guidance stating, “Please do not respond to texts or calls claiming to be from the studio that request payment or personal information; please verify through the studio’s official number.” This is because, in cases where mobile phone numbers and names are leaked together, the first type of damage that can occur is impersonation contact. In item 6, I stated that one can apply for dispute mediation through the Personal Information Dispute Mediation Committee (Article 43 of the Act) and the right to claim damages.

6. Method of notifying members who cannot be reached

At 3:00 PM on Sunday, before sending the texts, I performed a test broadcast to the representative’s mobile phone. The first line of the received text was “[Name] Member.” The name field in the text broadcasting program had not been linked. The representative laughed for a while and said, “I almost sent that to 860 people.” After fixing the connection, I tested it again and then proceeded with the actual broadcast.

As a result of the broadcast, the messages were delivered to 837 people, and 23 failed. Most were cases where the numbers had changed because they were dormant members from several years ago.

Article 39, Paragraph 3 of the Enforcement Decree stipulates that if there are justifiable reasons, such as when the contact information of the data subject is unknown, notification can be substituted by posting the notification items on the internet website for 30 days or more. This studio did not have a website; it only had business information on map services and an SNS account. The proviso of the same paragraph states that a controller who does not operate a website may post the notice in a conspicuous place, such as the business premises, for 30 days or more.

Therefore, on Monday afternoon, I posted a notice containing the notification items on the inside of the studio entrance and next to the counter, and I wrote the posting start date and the date 30 days later at the bottom of the notice. I also posted the same content on the SNS account. I took photos of the posted notices so that the dates would be visible. If I am asked later whether the notification was made, these photos will serve as the answer.

7. Preparation and Submission of the Report

Reports must be made to the Personal Information Protection Commission or the Korea Internet & Security Agency (KISA) (Enforcement Decree, Article 40, Paragraph 3). In practice, reports are often submitted online through the personal information breach reporting portal. In this case, the report was also submitted online, and we entered the details we had drafted together after the representative completed identity verification.

The report includes items such as the notification details. The specific details we organized for this case are as follows:

• Scale of Breach: 860 people, including 140 people whose health-related notes were included.
• Circumstances of Breach: An employee mistakenly uploaded a member management file instead of a timetable to a group chat room used for announcements; exposed for approximately 30 minutes.
• Time of Discovery: Friday at 10:10 PM (attached are records of private messages received from members).
• Response Measures: File deleted, notice posted requesting deletion of the chat room, confirmed deletion for 47 people, individual notification sent to 837 people, posted at the business premises for 23 people.
• Recurrence Prevention Plan: As detailed in Section 8 below.

Article 40, Paragraph 2 of the Enforcement Decree stipulates that if the specific items or circumstances of the breach cannot be fully identified, one should first report the information confirmed up to that point and then report additional details as soon as they are identified. Since we finished categorizing the items on Saturday, we were able to report everything at once in this case. If we had not been able to check all the contents of the “notes” column, it would have been correct to submit the report with only the confirmed information to avoid missing the deadline.

The report was submitted on Monday at 11:00 AM. There were only about 11 hours left until the deadline. Failure to notify or report can lead to an administrative fine of up to 30 million won pursuant to Article 75, Paragraph 2 of the Act.

8. Recurrence Prevention and Separate Consent for Sensitive Information

After completing the report, the remaining task was to ensure that the same incident would not happen again. However, while reviewing the “notes” column, one more thing troubled me: whether there was a legal basis for processing these health notes.

Article 23, Paragraph 1 of the Personal Information Protection Act, in principle, prohibits the processing of sensitive information and only allows it if the data subject is informed and provides consent separately from consent for other personal information processing. While the studio’s membership application form had a “Health Status Check” section, the consent box was bundled together. It was difficult to view this as separate consent.

Therefore, I organized the recurrence prevention measures into three parts:

1. Revision of the Consent Form: I revised the application form to separate the consent sections for general personal information and health information. For health information, I added specific details regarding the purpose of collection (prevention of injury during class), the items collected, and the retention period to obtain separate consent. For existing members, we decided to obtain the new consent form upon their next membership renewal.
2. File Separation and Password Protection: I separated the member contact list from the health notes into different files and applied a password to the health notes file so that only the representative and the instructor in charge could open it. This constitutes the technical and administrative safeguards required under Articles 23, Paragraph 2 and 29 of the Act.
3. Staff Guidance: I created a short checklist for the staff member in charge of announcements. It was a simple task, such as reading the file name aloud before uploading a file, but that single moment of verification was the cause of this incident.

About two weeks after the report, KISA contacted us to ask for the results of the measures taken. We replied with the list of confirmed deletions, text message transmission results, photos of the posting at the business, and the revised consent form. In this case, no separate notice of administrative disposition was issued even several weeks later. Please note that the existence and severity of a disposition vary by case, so the same result cannot be guaranteed.

The representative proceeded with the contract for the second branch as planned. The membership application form for the second branch was created using the new consent form from the very beginning.

9. Matters to Verify Immediately After a Breach Incident

In such a situation, please check the following in this order:

1. Record the time of discovery. Keep evidence showing when the processor became aware of the breach, such as message, email, or call logs, and calculate 72 hours from that time.
2. Take measures to prevent spread first. Delete posts, block access, and request deletion and confirmation of deletion from those who have downloaded the files.
3. Divide the breached items by individual. Separate those whose sensitive information (health, unique identification information, etc.) was leaked from those who were not, and divide the notification letters accordingly.
4. Check if you are subject to reporting based on three criteria. If you meet even one of the following—1,000 or more people, sensitive information/unique identification information, or unauthorized external access—you must report within 72 hours.
5. Include guidance on the right to remedies for damages in the notification. For notifications made after September 11, 2026, it is necessary to provide guidance on legal rights such as compensation for damages and dispute mediation.

Since requirements vary by case, individual verification is necessary. For accurate statutory provisions and interpretations, please check the National Law Information Center or the relevant authorities.

Services of the Administrative Agent Office

For businesses that have experienced a personal information leakage incident, the Hwang Yunsang Administrative Agent (Haengjeongsa) Office provides services such as verifying the time and deadline of the leakage, drafting notices for data subjects, and handling the preparation and submission of leakage reports to the Personal Information Protection Commission (PIPC) and the Korea Internet & Security Agency (KISA). We also assist in organizing the results of measures taken to respond to requests for additional documentation after reporting, as well as refining separate consent forms for sensitive information and personal information processing policies.

In smaller businesses, personal information is often concentrated in a single Excel file or a single chat room. An accident can occur with a single click, but how you spend the 72 hours following that incident determines your relationship with your members.

This has been reconstructed for the sake of understanding and is not related to any specific person or event.