DEEP RESEARCH · SECURITY REGULATION

Personal Information Protection Act: 10% Revenue Penalty Scenario and Security Market Economics

A report on how a 10% total-revenue penalty scenario could reshape security budgets, cyber insurance, and beneficiary companies.

Published: 2025-12-10 · Security/policy/industry analysis · Naver Blog source

0. Bottom line first

Official fact: The source cites Coupang's 33.7mn-record breach, about KRW 41tn of 2024 sales, and a theoretical maximum KRW 4.1tn penalty under a 10% total-revenue scenario.

Interpretation: Actual penalties would depend on the final law, mitigation, burden of proof, and litigation. But management teams budget against tail-risk scenarios, so the repricing pressure on security spending is real.

1. Regulatory shock

The source identifies the current weakness as the use of revenue directly related to the violation. If a company argues that the leaked data generated little revenue, penalties can be reduced. A total-revenue standard weakens that argument.

• The source compares GDPR's ceiling of 4% of global revenue.
• Korea's proposed 10% rule would be among the strictest regimes globally.
• Punitive damages can already reach up to three times damages, but the source says real-world application has been rare.
• Higher administrative penalties could also raise civil litigation and class-action risk.

2. Security budget reset

Official fact: The source states that 87.9% of Korean companies either spend less than KRW 5mn per year on information security or do not set a budget. For the top 500 companies, security spending averages 0.10-0.13% of sales and 6.0-6.4% of IT budgets.

3. Market size and growth

The source gives 2024 Korean information-security industry revenue, including physical security, at about KRW 18.6tn, with pure cyber security at about KRW 7.1tn. Without legal change, natural growth is estimated at 10-12% annually; under the 10% rule, cyber security growth could accelerate to 18-22% CAGR from 2H 2025.

Interpretation: A 2027 cyber-security market above KRW 12tn would not be just software licenses. Cloud security, AI security, OT security, consulting, managed services, legal advice, and cyber insurance would grow together.

4. Key beneficiaries

• Genians: NAC share of 60-70%, endpoint visibility, ZTNA, and 46% annual EDR growth are the core points.
• Fasoo: DRM encryption and DSPM discovery of sensitive cloud data connect directly to mitigation and compliance logic.
• AhnLab: C-level fear of legal exposure can increase consulting and ISMS-P support demand.
• SK Shieldus: SMEs that cannot build in-house security can use MSS to hedge legal risk.
• SOMANSA and SecuLetter: DLP and CDR are niche but essential compliance technologies.

5. Cyber insurance and risk-management ecosystem

The source treats cyber insurance as the second-order effect. Korea's cyber-insurance market is given at about KRW 270bn, with 38% penetration. If penalty exposure approaches KRW 4tn in a Coupang-like case, companies cannot rely only on internal reserves.

6. Technical terms and comparison data

• NAC identifies devices accessing a network and blocks non-compliant endpoints.
• ZTNA verifies user and device identity every time, regardless of internal or external location.
• DRM controls and encrypts documents, drawings, and other digital content across their lifecycle.
• DSPM discovers where data sits across cloud and on-premise environments and identifies sensitive information.
• EDR detects, analyzes, and responds to suspicious endpoint behavior.
• CDR removes potentially malicious macros or scripts from documents and reconstructs safe content.

7. Conclusion

Companies need to redefine security as an insurance-like investment rather than a cost. The source's three-layer defense is technical controls, management certification, and financial insurance. For investors, I would prioritize vendors with data visibility and control technology, especially those with public-sector and financial-sector references plus global expansion potential.