Deadlines and First-Notice Format for Data Breaches: Quick Report in 3–5 Days, Final Report in 30 Days (60 for Malicious Intent)

The obligation to report leaks and similar incidents is judged against four situations defined in the enforcement regulations of the Personal Information Protection Commission (PPC). The applicable categories are "sensitive personal information," "risk of financial harm," "risk of malicious intent," and "cases affecting more than 1,000 individuals," and because each includes situations where there is a 'risk' of occurrence, organizations must begin consideration without waiting for confirmation.

Reporting is done in two stages: a quick report and a final report. The quick report must be submitted "promptly" (the PPC gives roughly 3–5 days as a guideline) and may report only the facts known at that time. The final report is due within 30 days from the date of awareness (60 days if there is a risk of malicious intent), and any items unknown at the time of the final report must be completed later. The start date is the day any department within the organization "became aware," not the date the issue reached senior management.

Past cases often show that the numbers and scope indicated in the first notice expand in subsequent reports. Therefore, treat the first notice on the assumption that figures may increase, and divide it into four items to avoid misunderstanding: (1) what is known, (2) what is unconfirmed (indicate an upper bound or a range), (3) actions users should take, and (4) the timing of the next update. Companies should prepare contact trees, decision checklists/ledgers, and PPC reporting templates in advance so they are not uncertain on the day of an incident.

The article also references the PPC advisory (2026-10-07) and the promulgation of the amended Personal Information Protection Law (2026-07-17), presenting practical pointers under the current rules. It states that the content is not legal advice and encourages organizations to confirm final judgments in individual cases with their legal departments or via PPC materials and inquiries.