The end of the compliance tax

South Korea just changed the game. By raising data breach penalties up to 10% of total revenue, Seoul is deciding that privacy slips aren't just a budget line item anymore, and now, they're a threat to the whole balance sheet.

For years, companies looked at GDPR fines as a predictable cost of doing business, since those are capped at 4% of global turnover under Article 83. You pay the fine. You put out a press release about being committed to improvements. Then you just move on. But what happens when the hit is 10%? That isn't just a penalty. It's an existential event.

This shift moves us toward something the SEC calls high impact enforcement. We see this in the US as well, though it happens through settlements instead of statutory caps. Look at the DOJ and the $400 million settlement they got from TikTok over COPPA violations involving children's privacy; is that a slap on the wrist? Not even close. It's a signal that regulators are bored with small fines and want numbers that actually move markets.

The problem is that most firms are still relying on certificates to shield them from this risk.

I don't trust "privacy by design" when it lives on a slide deck instead of in the system blueprints, and revolut is a perfect example. The company recently admitted to a breach after they fell for fraudulent government requests. It wasn't some glitch with an encrypted database or a patch they forgot to install. The human process broke. Someone in the chain trusted a fake request and just handed over sensitive data.

If your "privacy by design" doesn't include a hard, verified protocol for government data requests, you haven't designed anything. You've just bought a certificate.

People usually argue that sticking to a framework like SOC 2 or ISO 27001 gives them a safety net. They think that since an auditor signed off on the controls, they acted in good faith and will get smaller penalties.

That logic is dead.

Regulators do not care about your ISO certificate if ten percent of your revenue hangs in the balance; a piece of paper proves you have a process. It does not prove that process holds up against a motivated social engineer, and the Revolut case proves it is possible to be fully compliant on paper yet wide open to basic fraud.

This creates a nasty second-order problem for insurers, and cyber insurance has always been priced based on foreseeable loss and historical data. But how do you underwrite risk when the maximum loss is not a fixed cap? It becomes a percentage of global turnover. If an insurer must cover a ten percent fine in South Korea or a settlement running into hundreds of millions in the US, premiums will spike hard. We should expect them to stop asking for copies of SOC 2 reports. Instead they will demand evidence of specific operational controls, like verified workflows for government requests.

Auditors are exposed as well. When the era of high impact hits full stride, the focus shifts from existence to effectiveness. Did the control exist? Yes. Was it effective if a simple phishing email bypassed it and triggered a billion dollar fine? If not, liability moves toward the auditor's professional indemnity insurance.

We are leaving behind checkbox compliance. We are moving into an era of operational reality. You cannot hide behind a framework that fails to stop data from leaving the building.

The question facing any CISO right now is simple enough, and strip away every certificate and audit report. What actual mechanism stops a mid-level manager from sending customer data to a fake regulator?

If the answer is "trust" or "policy," you're just waiting for the bill.