Republic of Korea: Adopted amendment to the Enforcement Decree of the Personal Information Protection Act

On 5 September 2023, the Korean Personal Information Protection Commission adopted the amended Enforcement Decree of the Personal Information Protection Act. In particular, the amendment strengthens the principle of consent in order to allow data subjects to exercise their rights regarding their personal information. In addition, the security measures that previously applied only to online settings now also apply to offline. Finally, the criteria for calculating fines have been revised to be proportional to the severity of violations. The amendment to the Enforcement Decree follows the comprehensive amendment of the Personal Information Protection Act (Law No. 19234), which was promulgated on 14 March 2023 and comes into force on 15 September 2023.