South Korea orders Coupang to revise terms over data breach case

South Korea’s privacy regulator has ordered Coupang to change its terms of service and make it easier for users to cancel memberships after a major data breach.

Coupang is a South Korea-based ecommerce company.

The Personal Information Protection Commission (PIPC) reviewed Coupang’s policies following a leak that exposed data of 33.7 million customers, including names, contact details, and delivery information.

The PIPC said Coupang added a clause in November that removed liability for damages caused by illegal third-party access, which the regulator said conflicts with local privacy law.

The commission also found that Coupang made its account deletion process difficult, requiring users to wait until paid memberships expired before canceling.

Coupang must now revise its liability exemption clause, simplify membership cancellations, and set up a task force to address potential secondary damages from the breach.

🔗 Source: Yonhap

🧠 Food for thought

Implications, context, and why it matters.

South Korea’s Personal Information Protection Commission (PIPC) uses post-breach audits to raise compliance standards

PIPC orders to Coupang go beyond a routine breach response. The agency is using the case to address liability waiver terms of service (ToS) clauses and maze-like cancellation flows 1.
The Commission said Coupang’s liability clause conflicts with privacy law, and it ordered simpler account cancellation. That puts governance and user-facing policies at the center of breach remediation alongside back-end security fixes.
These directives push Korean data protection enforcement toward structural remedies. Ecommerce platforms now face higher stakes beyond paying one-off penalties.

Tech vendors can package Personal Information Protection Act (PIPA) compliant subscription user experience (UX) and terms of service (ToS) auditing tools for Korean firms

PIPC ordered Coupang to simplify cancellation and to fix liability exemption clauses 1. Vendors can sell Personal Information Protection Act (PIPA) aligned offboarding (account closure) UX templates, ToS auditing platforms, or cancellation flow testing to teams that want to avoid the same penalties.