( October 20, 2026, 06:16 GMT | Official Statement) -- MLex Summary: South Korea will expand mandatory cybersecurity disclosures to all companies listed on the KOSPI and KOSDAQ stock exchanges from January 2027, regardless of revenue, under a revised enforcement decree approved by the cabinet on Tuesday. The new rules remove the existing 300 billion won ($225.8 million) revenue threshold for listed companies, extend disclosure obligations to entities required to obtain Information Security Management System certification and eliminate exemptions for public institutions, small businesses, financial companies and electronic financial service providers. Small businesses will receive a two-year grace period, with their obligations taking effect in January 2029. The disclosures cover cybersecurity investments, personnel, certifications and security-related activities, with the government aiming to improve transparency and encourage greater corporate investment in cybersecurity following a series of breaches.Statement is attached (in Korean)....
Prepare for tomorrow’s regulatory change, today
MLex identifies risk to business wherever it emerges, with specialist reporters across the globe providing exclusive news and deep-dive analysis on the proposals, probes, enforcement actions and rulings that matter to your organization and clients, now and in the longer term.
Know what others in the room don’t, with features including:
- Daily newsletters for Antitrust, M&A, Trade, Data Privacy & Security, Technology, AI and more
- Custom alerts on specific filters including geographies, industries, topics and companies to suit your practice needs
- Predictive analysis from expert journalists across North America, the UK and Europe, Latin America and Asia-Pacific
- Curated case files bringing together news, analysis and source documents in a single timeline
Experience MLex today with a 14-day free trial.