Up to 3% Penalty for Intentional or Grossly Negligent Security Breaches Begins Today... Revised Information and Communications Network Act Takes Effect

A daily compliance fine of 0.02% of average daily sales for failing to comply with government correction orders
Executive-level CISOs now mandatory for mid-sized and larger companies
Information security committees must also be established and opera

Starting today, companies that cause repeated security breaches due to willful misconduct or gross negligence will be subject to fines of up to 3% of their related revenues. The Chief Information Security Officer (CISO) at a company must now hold an executive-level position, and an enhanced certification is being added to the Information Security Management System (ISMS) certification system.

According to the Ministry of Science and ICT on October 1, the revised Act on Promotion of Information and Communications Network Utilization and Information Protection (Information and Communications Network Act) takes effect from this day. Last year, following a series of personal information leaks from major companies in the telecommunications and e-commerce sectors, the government announced a “Comprehensive Government-Wide Information Protection Plan.” The revised law now provides the institutional framework to support this plan.

First, companies that repeatedly cause security breaches due to willful misconduct or gross negligence will be fined up to 3% of their related revenues, depending on the severity of the incident. Additionally, companies that do not comply with government corrective orders or requests for information will be subject to a compliance penalty of 0.02% of their average daily sales for each day of non-compliance.

To strengthen corporate information security governance, the position of CISO has been elevated from any employee to executive level. Accordingly, medium-sized and larger companies must appoint an executive-level chief information security officer. However, considering the size and staffing situation of companies, medium-sized companies may still designate the head of their information security department. A six-month grace period will be granted to companies newly subject to the executive CISO appointment requirement.

Companies that are required to report the appointment of a CISO must also establish and operate an internal Information Security Committee. This committee will deliberate on information security matters that require coordination, such as securing the information security budget and personnel. The chairperson of the committee is required to report the committee’s deliberations to the Chief Executive Officer (CEO), and major issues must also be reported to the board of directors.

An enhanced certification system has been newly introduced to the ISMS program. This applies to major information and communications service providers and integrated information and communications facility operators with sales of more than 1 trillion won; information and communications service providers with annual sales of more than 3 trillion won the previous year; and businesses that have, within the last three years, been subject to investigations by joint civilian-government task forces or administrative penalties including fines. In addition, what was previously an optional certification audit will be strengthened by conducting both document reviews and on-site inspections in parallel.

In the event of a security breach, a Security Incident Investigation and Deliberation Committee under the Ministry of Science and ICT will be officially operated to ensure rapid investigation. The committee will comprise 15 members from both the private and public sectors, including the chairperson, with the private sector members serving a two-year term. Meetings may be convened as needed by the chairperson or at the request of the Minister of Science and ICT.

Bae Kyunghoon, Deputy Prime Minister and Minister of Science and ICT, said, “With the enforcement of the revised Information and Communications Network Act and its enforcement decree, we have established a stronger institutional foundation for enhancing the sense of security and accountability among companies.” He added, “I hope companies will recognize security as an essential element of business operations, not merely a cost, and will continue to make active investments in this area.”

This content was produced with the assistance of AI translation services.