Chairperson Song Kyung-hee of the Personal Information Protection Commission said on the 2nd that, to mark 2026, the direction of personal information protection policy will shift to a prevention-centered approach and strong sanctions will be applied for major data breach incidents.
Chairperson Song said in a New Year's address for 2026, "With the spread of the platform economy and the acceleration of data concentration, a single incident can now lead to a large-scale personal information leak," and added, "In the face of repeated incidents, an approach focused only on investigation and disposition has limits in easing the public's anxiety."
Looking back on 2025, Chairperson Song noted that personal information leaks occurred one after another and assessed that social awareness of personal information protection had risen significantly. She went on to say, "We will fundamentally improve our constitution, from the way we work to the overall system."
The Personal Information Protection Commission will make 2026 "the year of transforming the personal information protection framework" and push forward five key policy tasks. For serious or repeated personal information leaks, it plans to apply punitive penalty surcharges of up to 10% of sales and provide practical incentives to corporations that actively invest in security to create a structure where responsibility and incentives coexist.
Second is the shift to a prevention-centered protection framework. The commission will strengthen advance inspections focusing on large-scale personal information processing sectors such as distribution and platforms and on areas that handle sensitive information, and will continuously monitor privacy issues in new-technology environments through the Digital Forensic Center and the Technology Analysis Center. For public institutions, it will strengthen accountability when leaks occur and expand mandatory vulnerability checks for major public systems.
The third task is to build an artificial intelligence (AI) innovation society based on trust. The commission will introduce special exceptions that allow the use of original data for AI training when certain conditions are met, and will operate a one-stop pseudonymization service to support data use in the public institutional sector. During the public AX transition, it will also serve as a dedicated counseling window if personal information issues arise.
Fourth is strengthening the privacy safety net in daily life. The commission will expand the privacy by design (PbD) certification system centered on smart devices such as robot vacuum cleaners and prepare protection measures for special areas such as children, adolescents, and information on the deceased. It also plans to include damages in the scope of class actions and promote the introduction of a fund to enhance the effectiveness of relief for victims.
Lastly, the commission will lead personal information protection policy through international cooperation. It will expand safe means for the overseas transfer of personal information and promote the establishment of a global consultative body to eradicate illegal distribution of personal information, with the aim of spreading Korea's personal information protection policies and systems in the international community.
Chairperson Song said, "We will build a society where personal information protection operates as the default in all fields," and added, "We will do our utmost to ensure that the public can use digital services with peace of mind."