The Personal Information Protection Commission (PIPC) of South Korea has announced the introduction of a bonus and malus points system in the evaluation criteria for hotel rankings, based on their personal data protection activities.

This measure, which will come into effect on July 1, 2026, results from an amendment to the "Hotel Ranking Guidelines" requested by the PIPC to the Ministry of Culture, Sports and Tourism (MCST) to encourage the sector to rigorously manage customer data. A new indicator, "Operation of a personal data protection management system for customers," will allow hotels to earn additional points: 10 points for implementing three or more activities, 7 points for two, and 4 points for one. Eligible activities include participation in Personal Data Protection Week, adherence to the self-regulation program, establishment of a dedicated team, or obtaining certification of the Information Security Management System and Personal Data Protection (ISMS-P). At the same time, a malus of 10 points will be applied to establishments that have been subject to administrative sanctions for violations of the data protection law. The PIPC plans to extend this model to other sectors.