South Korea's revised Personal Information Protection Act takes effect on September 11, 2026, allowing fines of up to 10% of total revenue for serious violations, including intentional or grossly negligent incidents affecting more than 10 million people, repeat violations within three years and breaches following corrective orders. Repeat-violation surcharges rise to 20% for a first repeat, 40% for a second and 80% for a third or later repeat, while failing to report or notify promptly and contain damage can add up to 30%. Companies can receive reductions of up to 40% for sustained investments in data-protection budgets, staff, facilities, equipment and governance, as well as early detection, prompt notification and measures to limit harm. The revised framework clarifies CEOs' ultimate responsibility, expands CPO authority and requires certain large data processors to obtain board approval and report CPO appointments, changes and dismissals. It also requires notification within 72 hours when illegal access or other circumstances make a leak highly probable, even before exposure is confirmed, and adds forgery, alteration and destruction of personal information to reporting and notification obligations. A grace period for CPO requirements runs through December 31, 2027, while mandatory ISMS-P certification for critical processors begins July 1, 2027.