The Context
South Korea’s Personal Information Protection Commission (PIPC) has imposed a record fine of $409.3 million on Coupang Corp. This is the largest data-breach penalty in the country’s history. The breach exposed personal data of over 33.7 million users — roughly two-thirds of South Korea’s population. An ex-employee exploited unrevoked cryptographic signing keys and SQL injection flaws over a five-month window from June to November 2025. PIPC Chairperson Song Kyung-hee publicly stated that Coupang’s cooperation was insufficient and that data was deleted during the investigation. The regulator is now moving to designate CEOs as ultimate data custodians with punitive fines of up to 10% of annual revenue.
The Risk
Directors should consider this judgment a statutory warning. Under Korea’s Personal Information Protection Act, the theoretical cap on Coupang’s fine was 1.5 trillion KRW — a sum that directly threatens enterprise value. The PIPC’s finding that data was deleted during the investigation raises the spectre of obstruction, which in many jurisdictions can trigger personal criminal exposure for executives who condoned or failed to prevent interference with a regulatory probe. In New Zealand, the Privacy Act 2020 imposes fines of up to $10,000 for serious breaches, but the Companies Act 1993 requires directors to exercise reasonable care, diligence, and skill. A failure to oversee a data protection programme that allows a former employee to roam a customer database for five months may indicate a breach of those duties. The Board that tolerates repeated incidents — Coupang had four prior data events while holding ISMS-P certification — is exposed to shareholder suits arguing failure of duty of care and risk oversight.
The Control
The strategic imperative is clear: data protection governance must be elevated to board-level risk oversight, not delegated to IT compliance. The regulator’s move to revoke certifications and impose personal liability on CEOs signals a paradigm shift. Boards must demand a documented, auditable framework for access lifecycle management, incident response, and regulatory cooperation. Specifically, ensure that cryptographic keys are revoked upon employee termination, that SQL injection vulnerabilities are remediated with urgency, and that all data deletion during investigations is logged and approved by legal counsel. The cost of non-compliance is now measured in billions — and in personal reputational destruction.
The Challenge
These are the critical questions you should be raising at the board table:
| Does our organisation have a documented, board-reviewed policy for the revocation of access credentials and cryptographic keys upon employee termination, and can we demonstrate its enforcement within the last 12 months? | |
| If a regulator investigated our data breach response today, would we be able to prove that no data was deleted, altered, or withheld during the probe, or are we at risk of an obstruction finding? | |
| What is the maximum statutory fine our organisation could face under the Privacy Act 2020 and the Companies Act 1993 for a systemic data governance failure, and have we stress-tested our balance sheet against that scenario? |