Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,033 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Personal Information Protection Commission (PIPC, 개인정보보호위원회) – 0 % · 1 case
What for?
by area of lawAll areas of law
Who?
by companyWhen?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q4 2023 | 0 | – |
| Q1 2024 | 0 | – |
| Q2 2024 | 0 | – |
| Q3 2024 | 0 | – |
| Q4 2024 | 0 | – |
| Q1 2025 | 0 | – |
| Q2 2025 | 0 | – |
| Q3 2025 | 0 | – |
| Q4 2025 | 1 | – |
| Q1 2026 | 0 | – |
| Q2 2026 | 0 | – |
| Q3 2026 | 0 | – |
| Q4 2026 | 0 | – |
1 case
26 Nov 2025 Starbucks CorporationStarbucks: order over inadequate oversight of audit provider in Korea Order
Starbucks Corporation had suppliers in Korea audited under its Ethical Sourcing Program by Elevate Hong Kong Holdings Limited, did not conclude a processing contract containing all statutory terms and did not supervise the provider adequately; Elevate processed unnecessarily large amounts of data on supplier employees, such as personnel files, wage and working-time records, and transferred them out of the businesses. The authority ordered Starbucks to award such work only under a written contract with all mandatory terms and to train and supervise the provider, and recommended data minimisation; a separate order was issued against Elevate.
Supply chain audits process personal data too – the commissioning company needs a complete processing contract and must check that the audit provider collects no more than necessary.
Data processing in supplier audits
Missing or inadequate training played a role in the decision.
- Authority / court
- Personal Information Protection Commission (PIPC, 개인정보보호위원회)
- Area of law
- Data protection · Data processors
- Legal basis
- Personal Information Protection Act (개인정보 보호법) Art. 26(1) und (4)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Food and agriculture
- Employees
- 10,000 or more
- Published
- 27 Nov 2025
- PIPC, 심의·의결서 제2025-024-301호 (Starbucks Corporation), 26.11.2025 Decision of an authority
- PIPC, Entscheidungsdatenbank (위원회 결정문), Eintrag 2023조일0035 등 3건 Enforcement database of an authority
- PIPC-Pressemitteilung vom 27.11.2025: 개인정보를 과다 수집‧처리한 스타벅스 본사(미국), 엘리베이트(홍콩)에 시정명령 Press release of an authority
- PIPC press release (English), 03.12.2025: The PIPC Issues Correction Orders on Starbucks and Elevate Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link