The South Korean data protection authority, the Personal Information Protection Commission (PIPC), has presented a plan to reform its investigation procedures on data breaches to make them faster, fairer, and more transparent.

Faced with a rapid increase in data breach notifications, rising from 167 in 2022 to 447 in 2025 and 432 during the first half of 2026, the authority is implementing strategic case management. Important cases, defined as affecting more than one million people or having a strong social impact, will be prioritized within a 12-month timeframe. General and minor cases must be handled within 6 and 3 months respectively. For minor cases involving small businesses, the focus will be on remediation and technical support, with a possible exemption from the first fine. Additionally, to speed up processing, the use of subcommittees will be extended to administrative fines below 100 million won.

The plan also aims to enhance transparency and the rights of the defense. Entities subject to an investigation will be informed of its opening, closure, or extension. They will receive preliminary factual findings in complex cases and will have formal opportunities to present their observations. At the same time, the PIPC intends to strengthen its capacities by training specialized investigators and ensuring case continuity. Finally, the publication of information will be extended to include detailed statistics on investigations, case studies, and an explanation of the calculation process for administrative fines.