Who was sanctioned, and for what?

According to the sanctions disclosure of the Financial Supervisory Service (FSS, Korea's financial supervisor), the online lending platform PFC Technologies transferred the resident registration numbers of 8,497 customers to a third party without their consent on 28 September 2022 in order to calculate the error rate of a new service for mortgage customers, and received credit information on the same customers from that third party, likewise without consent (such as the address and official value of their properties); in addition, when the inspection began it had not implemented password rules against easily guessed numbers. The sanction of 17 September 2026 comprises an institutional warning, an administrative fine (과태료) of KRW 24 million and a penalty surcharge (과징금) of KRW 49 million, KRW 73 million in total.

Authority / court

Financial Supervisory Service (FSS)

Area of law

Data protection

Legal basis

Art. 19, 32 und 34 Credit Information Use and Protection Act; Art. 16, 28 und 29 Durchführungsverordnung

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Liability of senior managers

Measures against individuals are not set out here.

Published

17 Sep 2026

Original amount 73,000,000 KRW, converted at the ECB reference rate of 17 Sep 2026.

Checked against the official source on 4 Oct 2026 · Direct link

According to the KFTC (Korea Fair Trade Commission, Korea's competition authority), six manufacturers and distributors of printing paper fixed in advance the winning bidder, cover bidders and bid prices in six tenders issued by the publisher Nongmin News Corp. between June 2021 and November 2024; the average winning bid rate was around 96.2%, compared with 87.6% in 2018 to 2020. The KFTC issued corrective orders, imposed fines totalling KRW 3,009 million (Moorim SP KRW 59 million, Moorim Paper KRW 573 million, Moorim P&P KRW 948 million, Hansol Paper KRW 556 million, Hankuk Paper KRW 515 million, Hongwon Paper KRW 358 million).

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 40 Abs. 1 Nr. 8 MRFTA (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Manufacturing and mechanical engineering

Published

9 Sep 2026

Original amount 3,009,000,000 KRW, converted at the ECB reference rate of 9 Sep 2026.

Checked against the official source on 4 Oct 2026 · Direct link

Using credentials stolen elsewhere, attackers logged in en masse on the websites of GS SHOP (June 2024 to February 2025) and GS25 (December 2024 to January 2025) and obtained data on 1,581,025 and 79,128 people respectively; GS Retail Co., Ltd. detected neither the bursts of login attempts from the same IP addresses nor the rising number of failed attempts, and after the first discovery at GS25 did not stop the parallel attack on GS SHOP. The authority also found an inadequate data protection organisation and that 1,599 further people were notified more than 72 hours late, imposed a penalty surcharge of 12,836,000,000 KRW and an administrative fine of 3,000,000 KRW (12,839,000,000 KRW in total) and ordered detection measures and a review of the data protection organisation.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Art. 34(1); Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

negligent

Mitigating circumstances

Reduction of 30% because no benefit was derived and 40% for cooperation, remediation and protective efforts (ISMS-P certification, self-regulation, privacy impact assessment); increase of 50% because the infringement lasted more than two years.

Liability of senior managers

The company was ordered to deploy dedicated data protection staff and to define the powers and responsibility of its chief privacy officer (CPO) clearly.

Published

31 Aug 2026

Original amount 12,839,000,000 KRW, converted at the ECB reference rate of 26 Aug 2026.

Checked against the official source on 4 Oct 2026 · Direct link

Attackers copied certificates from lost femtocells of KT Corporation into home-made devices, stayed connected to the mobile network undetected for around eleven months, intercepted data on 16,647 subscribers (phone number, IMSI, IMEI) and used intercepted confirmation codes to trigger unauthorised mobile payments of around 240 million KRW affecting 368 people. For inadequate access control – certificates valid for ten years, no IP restriction, no detection of unknown cell IDs – the authority imposed a penalty surcharge of 53,979,000,000 KRW and ordered vulnerability checks and a stronger role for the chief privacy officer.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Sanktion nach Art. 64-2(1) Nr. 9; gesonderter Beschluss 제2026-015-094호: Art. 63(1)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Reduction of 30% because no benefit was derived and a further 50% for cooperation, remediation, compensation of those affected and protective efforts; increase of 50% because the infringement lasted more than two years.

Liability of senior managers

The company was ordered to define the responsibility and role of its chief privacy officer (CPO) for the whole company clearly and to revise its governance.

Published

30 Jul 2026

Original amount 53,979,000,000 KRW, converted at the ECB reference rate of 29 Jul 2026.

Checked against the official source on 4 Oct 2026 · Direct link

In its flight booking flow, Agoda Company Pte. Ltd. did not show clearly whether a ticket was refundable and which cancellation or change fees applied – the information could only be reached via a link to baggage rules – and, for accommodation paid later, displayed a price without the possible surcharge of up to 5%, partly in a foreign currency. The authority regarded this as a breach of the duty to explain key terms under the Telecommunications Business Act (전기통신사업법), imposed a fine of 2,424,000,000 KRW and ordered Agoda to show conditions, fees and final prices early and clearly, to check screen flows internally in advance and to have Korean translations reviewed by professionals.

Authority / court

Korea Media and Communications Commission (KMCC, 방송미디어통신위원회)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Telecommunications Business Act (전기통신사업법) Art. 50(1) Nr. 5-2, Art. 52, Art. 53; Enforcement Decree Art. 42 i. V. m. Anhang 4

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

no

Mitigating circumstances

Reduction of 10% because the authority had not imposed a fine in the preceding three years; partial voluntary corrections made after the investigation began were not accepted as a mitigating factor.

Published

6 Jul 2026

Original amount 2,424,000,000 KRW, converted at the ECB reference rate of 6 Jul 2026.

Checked against the official source on 4 Oct 2026 · Direct link

A former employee used authentication signing keys that had been accessible to him in plain text during his employment and were neither renewed nor destroyed after he left to create forged tokens and, from April to November 2025, retrieve data on around 33.22 million customers and delivery data on around 4.33 million other people. For inadequate security measures the authority imposed a penalty surcharge of 423,575,000,000 KRW on Coupang Corp. and, for late notification and failure to delete, an administrative fine of 16,800,000 KRW (423,591,800,000 KRW in total) and criticised the exclusion of the chief privacy officer from the internal investigation. A separate decision on the same day imposed a further 201,106,000,000 KRW for collecting behavioural data on third-party websites and apps without consent.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Art. 34(1), Art. 21(1), Art. 31(6), Art. 63(2); Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

negligent

Repeat case

yes

Mitigating circumstances

Reduction of 30% because no benefit was derived and 50% for remediation, compensation, certification and proportionality; increases of 25% (duration of the infringement), 30% (at least two previous penalties) and 10% (obstruction of the investigation).

Liability of senior managers

The chief privacy officer (CPO) was excluded from the internal investigation and publication; the company was ordered to set up governance that secures the CPO’s independent work and access to information in incidents.

Published

11 Jun 2026

Original amount 423,591,800,000 KRW, converted at the ECB reference rate of 10 Jun 2026.

Checked against the official source on 4 Oct 2026 · Direct link

From 26 August 2020 to 15 May 2022, Coupang advertised a 'WOW Member Price' below the regular selling price in its online shop without disclosing that it included a coupon redeemable only once by new members of its paid WOW subscription. The KFTC (Korea Fair Trade Commission, Korea's competition and consumer authority) treated the omission of this information as deceptive advertising, issued a corrective order and imposed a fine of KRW 500 million, the statutory maximum fixed-amount fine.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 3 Abs. 1 Nr. 2 Act on Fair Labeling and Advertising (täuschende Werbung)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Published

9 Jun 2026

Original amount 500,000,000 KRW, converted at the ECB reference rate of 9 Jun 2026.

Checked against the official source on 4 Oct 2026 · Direct link

According to the KFTC (Korea Fair Trade Commission, Korea's competition authority), seven flour manufacturers with a combined 87.7% of the B2B market coordinated, on 24 occasions between November 2019 and October 2025, the timing and extent of price changes as well as supply volumes and supply rankings towards large buyers such as noodle and confectionery manufacturers, including while receiving government price stabilisation subsidies. In addition to a cease-and-desist order, the KFTC ordered an independent re-determination of prices and imposed fines totalling KRW 671,045 million, the highest amount in any cartel case to date: Sajo DongAOne KRW 183,097 million, Daehan Flour Mills KRW 179,273 million, CJ CheilJedang KRW 131,701 million, Samyang KRW 94,787 million, Daesun Flour Mills KRW 38,448 million, Hantop KRW 24,291 million, Samhwa Flour Mills KRW 19,448 million.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 40 Abs. 1 Nr. 1 und Nr. 3 MRFTA (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Food and agriculture

Repeat case

yes

Liability of senior managers

Measures against individuals are not set out here.

Published

20 May 2026

Original amount 671,045,000,000 KRW, converted at the ECB reference rate of 20 May 2026.

Checked against the official source on 4 Oct 2026 · Direct link

In its own online shop for Galaxy S25 pre-orders, KT Corporation stated that benefits would apply unless the end of the promotion was shown, but then limited them to the first 1,000 orders and unilaterally cancelled 7,127 pre-orders that had come in via a YouTube channel and Genie TV and had already been fully completed. The authority regarded this as false information on key terms and an unjustified refusal to conclude contracts under the Telecommunications Business Act (전기통신사업법), imposed a fine of 640,000,000 KRW and ordered KT to show additional pre-order benefits clearly in future.

Authority / court

Korea Media and Communications Commission (KMCC, 방송미디어통신위원회)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Telecommunications Business Act (전기통신사업법) Art. 50(1) Nr. 5 und Nr. 5-2

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

8 May 2026

Original amount 640,000,000 KRW, converted at the ECB reference rate of 8 May 2026.

Checked against the official source on 4 Oct 2026 · Direct link

The KoFIU (Korea Financial Intelligence Unit) found that the crypto exchange Bithumb had processed 45,772 transfers of crypto assets with 18 virtual asset service providers that had not complied with their reporting obligation between August 2022 and April 2025, and had breached customer identification duties and the associated transaction restrictions in large numbers; there were also shortcomings in suspicious transaction reporting, record keeping and the risk assessment of new products. On 17 March 2026 it ordered a six-month partial suspension of business (no transfers of crypto assets for new customers from 27 March to 26 September 2026) and imposed a fine of KRW 36,873.5 million. The amount and the facts have not been confirmed against the primary source.

Authority / court

Korea Financial Intelligence Unit (KoFIU)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Art. 4, 5, 5-2, 5-4 und 8 Act on Reporting and Using Specified Financial Transaction Information; Art. 9, 10-6, 10-9 und 10-20 Durchführungsverordnung (Teilsperre wegen Art. 8 i. V. m. Art. 10-20 DVO: Geschäfte mit nicht gemeldeten Anbietern)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Liability of senior managers

Measures against individuals are not set out here.

Published

17 Mar 2026

Original amount 36,873,500,000 KRW, converted at the ECB reference rate of 17 Mar 2026.

Checked against the official source on 4 Oct 2026 · Direct link

According to the KFTC (Korea Fair Trade Commission, Korea's competition authority), the four banks exchanged their complete loan-to-value (LTV) ratios for mortgage lending over a long period, between 736 and 7,500 individual values per bank, and adjusted their own ratios accordingly; only conduct from December 2021, when the express prohibition of anti-competitive information exchange entered into force, was pursued. The KFTC issued cease-and-desist orders and fines totalling KRW 272,014 million (Kookmin KRW 69,747 million, Shinhan KRW 63,801 million, Woori KRW 51,535 million, Hana KRW 86,931 million), the first application of that provision.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 40 Abs. 1 Nr. 9 MRFTA i. V. m. Art. 44 Abs. 2 Nr. 3 Durchführungsverordnung (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

21 Jan 2026

Original amount 272,014,000,000 KRW, converted at the ECB reference rate of 21 Jan 2026.

Checked against the official source on 4 Oct 2026 · Direct link

The KoFIU (Korea Financial Intelligence Unit) found that Dunamu, operator of the crypto exchange Upbit, had failed to identify customers with due care in 5,324,165 cases between October 2021 and October 2024, for instance where identity documents could not be verified, were mere copies or photos, or where addresses were blank or implausible, and had nevertheless allowed transactions in 3,331,570 of these cases. In addition, it failed to file suspicious transaction reports on 15 customers linked to warrant applications by investigative authorities, and its monitoring system did not detect unusual patterns such as large crypto deposits followed by sale and withdrawal; KoFIU imposed a fine of KRW 35,215.6 million on 9 December 2025. The amount and the facts have not been confirmed against the primary source.

Authority / court

Korea Financial Intelligence Unit (KoFIU)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Art. 4, 5, 5-2 und 8 Act on Reporting and Using Specified Financial Transaction Information; Art. 9, 10-4, 10-6 und 10-20 Durchführungsverordnung

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

9 Dec 2025

Original amount 35,215,600,000 KRW, converted at the ECB reference rate of 9 Dec 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Starbucks Corporation had suppliers in Korea audited under its Ethical Sourcing Program by Elevate Hong Kong Holdings Limited, did not conclude a processing contract containing all statutory terms and did not supervise the provider adequately; Elevate processed unnecessarily large amounts of data on supplier employees, such as personnel files, wage and working-time records, and transferred them out of the businesses. The authority ordered Starbucks to award such work only under a written contract with all mandatory terms and to train and supervise the provider, and recommended data minimisation; a separate order was issued against Elevate.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data processors

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 26(1) und (4)

Action

Order

Status of proceedings

unknown

Sector

Food and agriculture

Employees

10,000 or more

Published

27 Nov 2025

Checked against the official source on 4 Oct 2026 · Direct link

In January 2025 attackers infected the work computer of an employee of the online job portal Incruit with malware, took over the employee’s database access and, until February 2025, extracted data on all 7,275,843 members and 54,475 stored CVs, cover letters and copies of certificates (438 GB in total). Despite conspicuous database access outside business hours, the company only noticed the leak through an extortion message; it had already been sanctioned in July 2023 for inadequate access controls. The authority imposed a penalty surcharge of 463,000,000 KRW and ordered the appointment of a qualified chief privacy officer and a plan to prevent further incidents and support those affected.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29; Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Mitigating circumstances

Reduction of 55% because no benefit was derived and the company is a medium-sized enterprise under the Korean Framework Act on Small and Medium Enterprises, and a further 20% for cooperation, remediation and self-regulation; increase of 65% because the infringement lasted more than two years and because of the July 2023 sanction.

Liability of senior managers

The company was ordered to appoint a new, qualified chief privacy officer (CPO) and to define the CPO’s responsibility clearly.

Published

23 Oct 2025

Original amount 463,000,000 KRW, converted at the ECB reference rate of 22 Oct 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Attackers who had planted malware in systems of SK Telecom Co., Ltd. since August 2021 took 9.82 GB of data on around 23 million subscribers from the home subscriber server in April 2025, including USIM authentication keys and IMSI. The authority found a lack of network segregation and access controls, authentication data not securely encrypted, missing security updates, an inadequate set-up of the chief privacy officer function and late notification of those affected. It imposed a penalty surcharge of 134,791,000,000 KRW and an administrative fine of 9,600,000 KRW (134,800,600,000 KRW in total) and issued orders on security, governance and oversight of service providers and sales partners.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Art. 31(1) und (3), Art. 34(1); Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

yes

Mitigating circumstances

Reduction of 30% because no benefit was derived and a further 50% for completed remediation, compensation of those affected and protective efforts; increase of 50% because the infringement lasted more than two years. Cooperation was not taken into account because documents were submitted late.

Liability of senior managers

There was no chief privacy officer (CPO) with overall responsibility; the company was ordered to define the CPO’s responsibility and role clearly and to rebuild its governance.

Published

28 Aug 2025

Original amount 134,800,600,000 KRW, converted at the ECB reference rate of 27 Aug 2025.

Checked against the official source on 4 Oct 2026 · Direct link

The two leading accommodation booking platforms sold small and medium-sized lodging businesses advertising packages whose price included discount coupons for guests, and let unused coupons expire without compensation (Yanolja at the end of the contract period, Yeogi Eottae through a validity of only one day). The KFTC (Korea Fair Trade Commission, Korea's competition authority) treated this as an abuse of a superior bargaining position, issued corrective and notification orders and imposed fines totalling KRW 1,540 million: KRW 540 million on Nol Universe (Yanolja) and KRW 1,000 million, the statutory maximum fixed-amount fine, on Yeogi Eottae.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 45 Abs. 1 Nr. 6 MRFTA i. V. m. Art. 52 und Anhang 2 Nr. 6 lit. d Durchführungsverordnung (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

12 Aug 2025

Original amount 1,540,000,000 KRW, converted at the ECB reference rate of 12 Aug 2025.

Checked against the official source on 4 Oct 2026 · Direct link

The KFTC (Korea Fair Trade Commission, Korea's competition and consumer authority) found that Musinsa, Shinsung Tongsang, E-Land World and ITX Korea (operator of ZARA in Korea) had advertised leather products, including those made of synthetic materials, with blanket environmental terms such as 'eco' without sufficient evidence, and treated this as false, exaggerated and misleading advertising under the Labeling and Advertising Act. Because all four admitted the violations and corrected them voluntarily, it limited itself to warnings, issued between 2 April and 8 May 2025 (Shinsung Tongsang 2 April, Musinsa 10 April, E-Land World and ITX Korea 8 May); according to the KFTC it was the first sanctioned greenwashing case in the fashion sector.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Environment and sustainability · Misleading environmental and sustainability claims

Legal basis

Art. 3 Abs. 1 Nr. 1 Act on Fair Labeling and Advertising (Labeling and Advertising Act; falsche oder übertriebene Werbung)

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Retail and e-commerce

Mitigating circumstances

All four companies admitted the violations and corrected them voluntarily; the KFTC therefore limited itself to warnings.

Published

15 May 2025

Checked against the official source on 4 Oct 2026 · Direct link

From July 2022 to April 2024, the Incheon sales branch of Woori Card Co., Ltd. looked up data on at least 207,538 owners of card-accepting merchants in the merchant management system, including resident registration numbers, and passed it via chat and e-mail to card recruiters, who used it to market new credit cards; 74,692 of those affected had not consented to marketing. The authority also criticised excessively broad access rights and the company’s failure to intervene despite more than 30 million look-ups and downloads a month, and imposed a penalty surcharge of 13,451,000,000 KRW. It ordered a review of internal controls, training and supervision of staff, minimised access rights and regular log reviews.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Marketing and consent

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 18(1), Art. 24-2(1), Art. 29; Sanktion nach Art. 64-2(1) Nr. 1

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Reduction of 50% for an ISMS-P certification; increase of 25% because the infringement lasted around one year and nine months.

Liability of senior managers

Measures against individuals are not set out here.

Published

27 Mar 2025

Original amount 13,451,000,000 KRW, converted at the ECB reference rate of 26 Mar 2025.

Checked against the official source on 4 Oct 2026 · Direct link

According to the KFTC (Korea Fair Trade Commission, Korea's competition authority), the three mobile network operators agreed in November 2015 to balance net gains and losses of new subscribers porting their numbers so that they would not concentrate on one operator, and implemented this until the end of September 2022 by coordinating their sales incentives for dealers with one another; they exchanged the information in a joint market monitoring group with the industry association KAIT. The KFTC issued cease-and-desist orders and provisionally set fines totalling KRW 114,026 million (SK Telecom KRW 42,662 million, KT KRW 33,029 million, LG Uplus KRW 38,334 million).

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 40 Abs. 1 Nr. 3 MRFTA (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

12 Mar 2025

Original amount 114,026,000,000 KRW, converted at the ECB reference rate of 12 Mar 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Kakaopay Corp. transferred data on all users three times in 2018 and, from June 2019 to May 2024, data on around 40 million users every day without consent to Alipay in Singapore, which used it to calculate for Apple a score for the likelihood of insufficient funds on bundled App Store payments (NSF score). The authority treated this as an unlawful transfer abroad, imposed a penalty surcharge of 5,968,000,000 KRW and ordered remediation and publication of the decision on the company’s website. In separate decisions on the same day Apple received a penalty surcharge of 2,405,000,000 KRW and an administrative fine of 2,200,000 KRW, and Alipay was ordered to delete the scoring model.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · International data transfers

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 28-8(1); Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Reduction of 30% for completed remediation, cooperation and ISMS-P certification; increase of 50% because the infringement lasted more than two years (June 2019 to May 2024).

Published

23 Jan 2025

Original amount 5,968,000,000 KRW, converted at the ECB reference rate of 22 Jan 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Through a port between the internal and external networks that had been opened for convenience, attackers entered the e-litigation server of the National Court Administration and took 1,014 GB of case documents; the 4.7 GB that were recovered contained data on 17,998 people, including resident registration numbers. The authority criticised unencrypted documents, unchanged, easily guessed initial passwords on administrator accounts, missing security software on one server and a report only in December 2023, although there had been indications of the leak since April 2023. It imposed a penalty surcharge of 207,000,000 KRW and an administrative fine of 6,000,000 KRW (213,000,000 KRW in total), recommended disciplinary action and improvements and is publishing the imposition of the administrative fine on its website for one year.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 24(3), Art. 24-2(2), Art. 29, Art. 34(1) und (3); Sanktion nach Art. 34-2 a. F.

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Culpability

negligent

Mitigating circumstances

After an increase of 20%, the amount was reduced by 25%, taking into account protective efforts such as an ISMS certification (2020–2023).

Liability of senior managers

Measures against individuals are not set out here.

Published

9 Jan 2025

Original amount 213,000,000 KRW, converted at the ECB reference rate of 8 Jan 2025.

Checked against the official source on 4 Oct 2026 · Direct link

According to the KFTC (Korea Fair Trade Commission, Korea's competition authority), Kakao Mobility, dominant in app-based general taxi hailing with a 96% share (2022), required four competing franchise taxi operators (UT, TADA, Banban, Macaron Taxi) to sign partnership agreements granting real-time access to business-sensitive data and otherwise excluded their drivers from general hailing via Kakao T. Following its plenary deliberation on 25 September 2024, the KFTC ordered remedies and announced a provisional fine of KRW 72.4 billion; after the Securities and Futures Commission had determined that revenue must be recognised on a net basis, it announced on 17 December 2024 that the fine had been finally set at KRW 15.1 billion.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 5 Abs. 1 Nr. 3 und Art. 45 Abs. 1 Nr. 6 MRFTA (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

17 Dec 2024

Original amount 15,100,000,000 KRW, converted at the ECB reference rate of 17 Dec 2024.

Checked against the official source on 4 Oct 2026 · Direct link

Hyundai Marine & Fire Insurance showed users of its online car insurance premium calculator who had declined consent to product marketing a further pop-up, swapped the effect of its buttons in July 2022 and mentioned neither the processing of data nor the mandatory information in it; the consents obtained in this way were invalid, and other insurers copied the pattern. The authority imposed a penalty surcharge of 6,198,000,000 KRW and ordered lawful consent, deletion of data from abandoned premium calculations and stronger internal controls with independent powers for the chief privacy officer. In the same session eleven further direct insurers were sanctioned, including AXA General Insurance (2,715,000,000 KRW) and Hana Insurance (273,000,000 KRW). The amount and the facts have not been confirmed against the primary source.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Marketing and consent

Legal basis

Personal Information Protection Act (개인정보 보호법, frühere Fassung) Art. 39-3(1), Art. 31(2), Art. 21(1); Sanktion nach Art. 39-15(1) Nr. 6 a. F.

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

no

Mitigating circumstances

Reduction of 50% because no penalty had been imposed in the preceding three years, a further 30% for reasons including cooperation with the investigation and finally 40% following the Commission’s deliberations; increase of 25% because the infringement lasted from July 2022 to September 2023.

Liability of senior managers

Marketing and direct sales were able to design the consent flow without any involvement of the chief privacy officer (CPO); the authority found a breach of former Art. 31(2) and ordered that the CPO be given independent powers.

Published

12 Dec 2024

Original amount 6,198,000,000 KRW, converted at the ECB reference rate of 11 Dec 2024.

Checked against the official source on 4 Oct 2026 · Direct link

After a login outage of around 75 minutes on Instagram on 22 March 2024 that affected some 3.35 million users in Korea, Meta Platforms reported the incident only 24 hours and 19 minutes after it began, despite three requests from the Ministry. A report within 10 minutes and a written report within two hours are required; the Ministry imposed an administrative fine of 5,000,000 KRW under the Framework Act on Broadcasting and Communications Development (방송통신발전 기본법). The amount and the facts have not been confirmed against the primary source.

Authority / court

Ministry of Science and ICT (MSIT, 과학기술정보통신부)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Framework Act on Broadcasting and Communications Development (방송통신발전 기본법) Art. 38; Basisplan zum Management von Kommunikationsstörungen 2024

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

28 Nov 2024

Original amount 5,000,000 KRW, converted at the ECB reference rate of 28 Nov 2024.

Checked against the official source on 4 Oct 2026 · Direct link

Through Facebook profiles and usage behaviour, Meta Platforms, Inc. collected sensitive characteristics of around 980,000 users in Korea – such as religion, political views or same-sex marriage – and made advertising topics built on them available to around 4,000 advertisers without obtaining separate consent. Meta also refused access requests without a legitimate reason and left an unused account-recovery page online through which passwords were reset with forged ID documents and data on ten users was obtained. The authority imposed a penalty surcharge of 21,613,000,000 KRW and an administrative fine of 10,200,000 KRW (21,623,200,000 KRW in total) together with corrective orders.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Marketing and consent

Legal basis

Personal Information Protection Act (개인정보 보호법, frühere Fassung) Art. 23(1), Art. 29, Art. 35(3)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

5 Nov 2024

Original amount 21,623,200,000 KRW, converted at the ECB reference rate of 4 Nov 2024.

Checked against the official source on 4 Oct 2026 · Direct link

The Securities and Futures Commission (SFC) of the Financial Services Commission (Korea's financial regulator) found that the Swiss bank (now part of another banking group) had placed short sale orders worth around KRW 60.33 billion (162,365 shares in 20 stocks) between 7 April 2021 and 9 June 2022, and its Singapore subsidiary orders worth around KRW 35.28 billion (401,195 shares in five stocks) between 29 November 2021 and 9 June 2022, without holding the shares. At its meeting on 3 July 2024 it imposed fines totalling KRW 27,173 million (around KRW 16.94 billion on the Swiss bank and around KRW 10.23 billion on the Singapore subsidiary), according to the FSC the highest and third-highest individual fines for naked short selling since such fines were introduced in April 2021.

Authority / court

Securities and Futures Commission (SFC) der Financial Services Commission (FSC)

Area of law

Capital markets and financial supervision · Market abuse and insider dealing

Legal basis

Leerverkaufsvorschriften des Financial Investment Services and Capital Markets Act (FSCMA)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Employees

10,000 or more

Published

3 Jul 2024

Original amount 27,173,000,000 KRW, converted at the ECB reference rate of 3 Jul 2024.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 3 Jul 2026 · Direct link

Attackers obtained the company's VPN credentials, including an administrator account, accessed a file server open to all employees and exposed data on more than 2.21 million customers and employees on the dark web, including 5,831 resident registration numbers stored unencrypted. For inadequate security measures, missing encryption and failure to delete data no longer needed on around 380,000 people, the authority imposed a penalty surcharge of 7,504,000,000 KRW and an administrative fine of 5,400,000 KRW (7,509,400,000 KRW in total). It also ordered a revised internal data protection management, a stronger role for the chief privacy officer and regular data protection training for all employees.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Art. 24-2(2), Art. 21(1); Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Other

Mitigating circumstances

Reduction of 30% because no benefit was derived from the infringement and a further 30% for cooperation with the investigation; increase of 50% because the infringement lasted more than two years (August 2020 to November 2023).

Liability of senior managers

The company was ordered to strengthen the standing and role of its chief privacy officer (CPO).

Published

9 May 2024

Original amount 7,509,400,000 KRW, converted at the ECB reference rate of 8 May 2024.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 8 May 2026 · Direct link

The KFTC (Korea Fair Trade Commission, Korea's competition and consumer authority) found that the games company had changed the probabilities of paid random items (loot boxes) in two of its online games to the players' disadvantage and had failed to disclose this or disclosed it falsely. It treated this as deceiving consumers under the E-Commerce Act and, in addition to a cease-and-desist order, provisionally set fines totalling KRW 11,642 million (KRW 11,593 million for one game, KRW 49 million for the other), according to the KFTC the highest amount under that Act at the time.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 21 Abs. 1 Nr. 1 Act on the Consumer Protection in Electronic Commerce (E-Commerce-Gesetz)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

yes

Published

3 Jan 2024

Original amount 11,642,000,000 KRW, converted at the ECB reference rate of 3 Jan 2024.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 3 Jan 2026 · Direct link

The company charged 50% of the fees for the remaining term when an annual plan paid monthly was cancelled after 14 days, and did not refund annual fees paid in advance; the notices about this could only be reached via an information icon during checkout. The authority regarded this as a restriction of the right to cancel and a breach of the duty to explain key contract terms clearly, imposed fines of 876,000,000 KRW and 433,000,000 KRW (1,309,000,000 KRW in total) under the Telecommunications Business Act (전기통신사업법) and ordered the company to display the consequences of cancellation clearly and to improve its penalty and refund rules.

Authority / court

Korea Communications Commission (KCC, 방송통신위원회; seit Oktober 2025 Korea Media and Communications Commission, 방송미디어통신위원회)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Telecommunications Business Act (전기통신사업법) Art. 50(1) Nr. 5 und Nr. 5-2, Art. 52, Art. 53

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

29 Nov 2023

Original amount 1,309,000,000 KRW, converted at the ECB reference rate of 29 Nov 2023.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 29 Nov 2025 · Direct link

The Korea Financial Intelligence Unit (KoFIU, Korea's financial intelligence unit) found that the insurer had reported 44 suspicious transactions from February 2021 to March 2022, which it had internally classified as reportable, not within three business days but between 2 and 324 business days late, and had filed 28 reportable cash transactions from 2018 to 2022 between 1 and 552 days late. KoFIU imposed a fine of KRW 75.9 million on 10 October 2023.

Authority / court

Korea Financial Intelligence Unit (KoFIU)

Area of law

Money laundering and terrorist financing · Suspicious activity reports

Legal basis

Art. 4 Abs. 1 und Art. 4-2 Abs. 1 Act on Reporting and Using Specified Financial Transaction Information; Art. 8-2 Durchführungsverordnung

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

12 Oct 2023

Original amount 75,900,000 KRW, converted at the ECB reference rate of 10 Oct 2023.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 10 Oct 2025 · Direct link

Data on 297,117 people – including phone numbers, names, addresses and USIM numbers – from the operator's customer authentication system (CAS) ended up on illegal online marketplaces; the authority found outdated software no longer supported by its vendors, inadequately configured firewalls and intrusion prevention systems and database credentials stored in plain text, and former customers were notified late. It imposed a penalty surcharge of 6,800,452,000 KRW and an administrative fine of 27,000,000 KRW (6,827,452,000 KRW in total) and ordered, among other things, remediation of vulnerabilities across all systems, a reorganised data protection governance and deletion of data no longer needed.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법, Fassung 2020) Art. 29, Art. 21(1), Art. 39-4(1); Sanktion nach Art. 39-15(1) Nr. 5

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Repeat case

yes

Mitigating circumstances

Reduction of 30% for a recognised data protection certification, active cooperation and self-reporting of the incident; at the same time an increase of 50% because the infringement lasted more than two years.

Liability of senior managers

The company was ordered to strengthen the role, standing (including a reporting line directly to top management) and expertise of its chief privacy officer (CPO).

Published

12 Jul 2023

Original amount 6,827,452,000 KRW, converted at the ECB reference rate of 12 Jul 2023.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 12 Jul 2025 · Direct link

According to the KFTC (Korea Fair Trade Commission, Korea's competition authority), from June 2016 to April 2018 the group made benefits for game developers, such as prominent placement (featuring) in its app store and support for overseas expansion, conditional on their not releasing their games on a rival Korean app market. The KFTC treated this as an abuse of a dominant position and as unfair exclusive dealing, prohibited the practice, required an internal monitoring system with a reporting obligation and provisionally set a fine of KRW 42.1 billion against the parent company and its Korean and Asia-Pacific subsidiaries.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 3-2 Abs. 1 Nr. 5 und Art. 23 Abs. 1 Nr. 5 MRFTA a. F. (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

11 Apr 2023

Original amount 42,100,000,000 KRW, converted at the ECB reference rate of 11 Apr 2023.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 11 Apr 2025 · Direct link

The KFTC (Korea Fair Trade Commission, Korea's competition authority) sanctioned an agreement reached in 2006 by the four German manufacturers to use a dosing strategy with lower AdBlue consumption in the software of their SCR exhaust after-treatment systems; in doing so they had blocked the development of more effective nitrogen oxide reduction and deprived buyers in Korea of the choice of cleaner diesel cars. In addition to cease-and-desist orders, it provisionally set fines totalling KRW 42,372 million (first manufacturer KRW 20,743 million, second manufacturer KRW 15,656 million, third manufacturer KRW 5,973 million; the breakdown shows no amount for the fourth manufacturer). According to the KFTC, it was its first action against an agreement in the field of research and development.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 19 Abs. 1 Nr. 6 MRFTA a. F. (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Automotive

Employees

10,000 or more

Published

9 Feb 2023

Original amount 42,372,000,000 KRW, converted at the ECB reference rate of 9 Feb 2023.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 9 Feb 2025 · Direct link

The Korea Fair Trade Commission (KFTC, Korea's competition authority) objected to an agreement concluded at the end of September 2016 under which the generics side undertook not to manufacture or launch generic versions of three cancer drugs in Korea from October 2016 to December 2020, receiving in return exclusive distribution rights for these originator products from the originator side; according to the KFTC, the arrangement was terminated early on 12 January 2018. It issued cease-and-desist orders against all five companies (two on the originator side, including its Korean company, and three on the generics side, including its Korean company) and provisionally set fines totalling KRW 2,645 million: KRW 1,146 million for the originator side and KRW 1,499 million for the generics side.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 19 Abs. 1 Nr. 3 MRFTA a. F. (Monopoly Regulation and Fair Trade Act; heute Art. 40 Abs. 1 Nr. 3)

Action

Fine

Status of proceedings

unknown

Sector

Chemicals and pharmaceuticals

Published

13 Oct 2022

Original amount 2,645,000,000 KRW, converted at the ECB reference rate of 13 Oct 2022.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 13 Oct 2024 · Direct link

The group recorded what signed-in users in Korea did on third-party websites and apps and used this behavioural data for personalised advertising without explaining this clearly at account creation; the relevant settings sat behind “More options” and were pre-set to consent. The authority imposed a penalty surcharge of 69,241,000,000 KRW and ordered the group to obtain informed and freely given consent in future. According to the authority’s press release of 23 January 2025, the Seoul Administrative Court dismissed the group’s action against the decision.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Cookies and tracking

Legal basis

Personal Information Protection Act (개인정보 보호법, Fassung 2020) Art. 39-3(1); Sanktion nach Art. 39-15

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Repeat case

no

Mitigating circumstances

Reduction of 50% because no penalty had been imposed in the preceding three years; at the same time an increase of 50% because the infringement lasted more than two years (since June 2016).

Published

14 Sep 2022

Original amount 69,241,000,000 KRW, converted at the ECB reference rate of 14 Sep 2022.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 14 Sep 2024 · Direct link