South Korea has increased data breach fines to 10% of annual revenue

South Korea's regulator has officially tightened the punishment for companies that violate user privacy. The maximum fine for a personal data breach is now 10% of the organization's annual revenue.

The new rules apply to incidents involving information of more than 10 million people. Previously, sanctions were significantly milder, allowing large tech companies to consider fines as operational costs rather than a serious financial risk.

The legislation provides mechanisms for mitigating liability. Companies can expect a reduction in the amount of the fine if they demonstrate prompt detection of the leak and prove that they had made significant investments in data protection systems before the incident. The regulator assesses the effectiveness of the implemented security protocols and the speed of response to threats.

The changes are aimed at forcing AI system developers and cloud providers to exercise stricter control over training samples and user databases. In conditions where models require processing of enormous amounts of data, the risk of compromising personal information becomes a critical factor for business.

This measure puts South Korea in the ranks of countries with the most stringent cybersecurity regulation. Experts discussing the consequences of the initiative note that it will force companies to reconsider their data storage architecture and implement more stringent anonymization methods before using information in generative models.