Personal data breach: notice and report are separate, both within 72 hours

This guide is for companies in Korea that hold personal data about customers, users or staff, including foreign-invested companies and their HR and IT teams. When personal data leaks, the law sets two separate duties: notify the affected people, and in some cases report to the regulator. Both are due within 72 hours, but they are triggered differently.

Two duties, not one

A common mistake is to treat a leak as a single task. Article 34 of the Personal Information Protection Act (개인정보 보호법) separates notice to the data subjects, meaning the people the data is about (정보주체), in paragraph (1), from a report to the Personal Information Protection Commission (개인정보 보호위원회, PIPC) or an expert agency in paragraph (3). Articles 39 and 40 of the Act's Enforcement Decree (시행령) set a deadline for each one separately.

The clock starts when you become aware of the leak, not when it happened. The article speaks of the moment the company "becomes aware" that data was lost, stolen or leaked (분실·도난·유출, together called 유출등). So the moment you fix as your awareness is the starting point of the deadline.

When a report is also required

Article 40(1) of the Enforcement Decree limits the report to three cases:

1. Personal data of 1,000 or more data subjects has leaked.
2. Sensitive information (민감정보) or unique identification information (고유식별정보) has leaked.
3. Personal data has leaked through unlawful access from outside to the personal data processing system (개인정보처리시스템), or to a device that staff who handle personal data (개인정보취급자) use for that work.

The third case is broad. A leak caused by hacking, malware or a taken-over account must be reported, whatever the number of people. On the other hand, if an employee sends an email to the wrong recipient and data on 50 people goes out, it is not reportable unless sensitive or unique identification information is involved. You only notify the people.

What you must tell them

The items in Article 34(1) apply to both the notice and the report:

• Which items of personal data leaked.
• When and how the leak happened.
• Information on what the data subjects can do to minimize the damage the leak may cause.
• The company's response measures and the procedure for relief from damage.
• The department and contact details that will take reports from data subjects who suffer damage.

In practice, most companies cannot pin down the items and the circumstances within 72 hours. Article 39(2) and Article 40(2) of the Decree handle this in the same way. If you have not confirmed the details of item 1 or item 2, first notify or report the fact of the leak, what you have confirmed so far, and items 3 to 5. Then notify or report each further detail as soon as you confirm it. Waiting until the investigation ends is not an option.

When you may go past 72 hours

For the notice, the proviso to Article 39(1) allows two exceptions:

• Urgent measures are needed to stop the data spreading or leaking further, such as blocking the access route, checking and fixing vulnerabilities, or retrieving and deleting the leaked data.
• A natural disaster or another unavoidable reason makes notice within 72 hours difficult.

In these cases, notify without delay once the reason has gone. For the report, the proviso to Article 40(1) allows only the natural disaster or other unavoidable reason. Instead, it opens a different door: if you have identified how the data leaked and taken steps such as retrieving or deleting it, so that the risk to the data subjects' rights has become remarkably low, you may choose not to report.

There is also a fallback when you do not have contact details. Under Article 39(3), you may replace the notice by posting it on your website for 30 days or more. If you do not run a website, post it for 30 days or more in a place at your business premises where people can easily see it.

Fix the moment you became aware

Because the 72 hours run from awareness, pinning down that moment is how you manage the deadline. The time an abnormal access shows up in the logs, the time staff checked those logs, and the time the security team decided it was a leak can all differ.

If you do not set a rule in advance, you may later argue over which moment counts. In your incident response procedure, name the person with authority to decide that a leak has occurred and set a form for recording the decision. Use the date and time of that person's decision as the moment of awareness. If the decision was delayed, record the reason too.

For day-to-day controls, see also records of personal data destruction and answering a client's personal data audit.

Checklist: the first 72 hours

• Record the date and time of awareness.
• Make a first count of the leaked items and the estimated number of people.
• Check whether sensitive or unique identification information is included.
• Decide whether unlawful access from outside caused the leak.
• If any of these three triggers apply, open the report track at the same time.
• Take urgent measures first, such as blocking the access route and fixing vulnerabilities (Act Art. 34(2)).
• If urgent measures delay the notice, record the reason.
• Check whether you can obtain the data subjects' contact details.
• If you cannot, prepare the 30-day website posting.
• If you have not confirmed items 1 and 2, notify and report with the other items first.
• File the report with the PIPC or KISA.
• Send follow-up notices and reports as soon as you confirm more details.
• If retrieval or deletion has made the risk remarkably low, document the grounds.
• Describe your response measures and the relief procedure concretely in the notice.
• Keep a time-ordered record of the whole response.