Three Korean digital laws change inside three weeks. The personal-data safety-measures notice took effect on 1 July, the amended Network Act on the 7th, and the amended E-Commerce Act arrives on the 21st. A list of which Korean laws apply to your company, written last quarter, is already wrong in three places — and one of those three moves three more times before spring.
Three dates inside three weeks
개인정보의 안전성 확보조치 기준 (고시 제2026-9호), effective 1 July. The technical-safeguards notice under Korea's Personal Information Protection Act. It obliges processors averaging a million daily users to cut internet access for staff who can set access permissions, and for staff who can download or destroy personal data.
정보통신망법, the Network Act (법률 제21305호), effective 7 July. This tranche creates the category of 허위조작정보 — false or manipulated information — and attaches punitive damages of up to five times the loss for circulating it deliberately. Platforms averaging a million daily users take on reporting channels, published operating policies, and half-yearly transparency reports.
전자상거래법, the E-Commerce Act (법률 제21312호), effective 21 July. It widens the seller-identity information a marketplace intermediary must surface about individual sellers. Its domestic-representative duty for foreign operators (제20조의5) follows on 21 January 2027.
One caution about where those dates come from. The 국가법령정보센터 page for the
E-Commerce Act displays a banner reading [시행 2026. 1. 20.]. That date governs
제6조제2항 alone; the body of the amendment takes effect on 21 July, and the 부칙
is the only place that says so.
A 시행일 is a start line
The Network Act's 7 July date carries the false-information provisions. Every provision a security team actually owns has its own, later date:
- 2026-09-11 — 제45조의3, 정보보호 최고책임자의 지정 등. Designating a CISO and filing the designation with the Ministry of Science and ICT.
- 2026-10-01 — 제45조의4, 제47조, 제48조의2 이하. The information-security committee, ISMS certification, and the incident response-and-notification regime.
- 2027-04-01 — 제45조의5, 정보보호수준 평가. An annual assessment of the organisation's security level.
One law, four dates, and every date that reaches a security team falls after the one the headlines carried.
The AI Basic Act shows the same shape from the other direction. It has been in force since 22 January 2026, and the Ministry of Science and ICT has said it will run a guidance period (계도기간) of at least a year before enforcing — during which fact-finding investigations are reserved for exceptional cases such as casualties or human-rights violations. A calendar entry on the 시행일 tells you nothing about either fact.
What we built to keep up
Our Korea Regulation Scoper asks up to nineteen questions about a company — revenue, daily users, whether it processes personal data, whether it builds or deploys AI — and returns the Korean digital instruments that may potentially apply to it. Thirteen of them today.
Each result carries the 시행일 we read out of the 부칙, the grace period where one exists, the staged milestones that follow it, the articles that define its scope, and a link to the official text. The regulation data shows the date it was last checked against law.go.kr, so you can see how stale it has gone. It runs in your browser, stores nothing, and needs no account.
It tells you what may apply and when. It is general information about the law and does not amount to legal advice.
Which of the three did you already know had moved?
References
- 개인정보보호위원회 — 개인정보의 안전성 확보조치 기준 (고시 제2026-9호)
- 국가법령정보센터 — 정보통신망 이용촉진 및 정보보호 등에 관한 법률 (법률 제21305호), 부칙
- 국가법령정보센터 — 전자상거래 등에서의 소비자보호에 관한 법률 (법률 제21312호), 부칙
- 국가법령정보센터 — 인공지능 발전과 신뢰 기반 조성 등에 관한 기본법 (법률 제21311호)
- News1 — "최소 1년 이상 계도기간"…내년 1월 AI기본법 가이드라인 공개
- 법률방송뉴스 — 개정 정보통신망법 시행, 무엇이 허위조작정보인가
Instagram