South Korea PIPA 34: Notify affected people within 72 hours and report qualifying breaches to the Commission or KISA

What does 34 require?

Article 34 with Decree Articles 39 and 40: on becoming aware of a leak or other loss, theft, forgery, alteration or damage, the controller notifies affected data subjects within 72 hours in writing or equivalent of the items, time and circumstances, self-protection steps, its response and remedies, the contact point, and (since September 2026) their rights to damages, statutory damages and mediation; from 11 September 2026 it must also notify everyone potentially affected when a decree-defined possibility of a leak arises; it takes steps to contain and recover; and within 72 hours it reports to the Commission or KISA where 1,000 or more people, sensitive or unique identifier data, or unlawful external access are involved, filing first what is known.