Average 8-Month Investigation Period for Data Breaches... 'Focus on Major Cases'

According to a budget policy office report, the average investigation period for personal data breaches by the Personal Information Protection Commission increased from 216.3 days in 2021 to 291.9 days in 2023, though slightly decreased to 259.4 days in 2024 and 239.4 days in 2025. These figures represent the average duration from investigation initiation to completion across annual cases. Post-completion procedures such as advance notification and committee deliberations may further delay final decisions. The budget policy office noted that prolonged processing times are not solely due to increased case volume. The commission's investigation division grew from 48 to 60 staff by April 2024, with total capacity expanding from 57 to 75. Major breaches typically receive expedited attention, as seen in SK Telecom's 127-day resolution and Coupang's 201-day process. Both cases involved 14-person task forces including investigators and KISA technical support. The budget policy office emphasized the need for systematic management of case priorities based on breach scale, sensitivity, and complexity, while preventing excessive resource concentration on individual cases.