Quick read. On 2 June 2026, three enforcement decrees focused on protecting ordinary citizens were launched on the same day in Korea, less than 48 hours after the Lee Jae-myung administration’s one-year anniversary. The Ministry of Land, Infrastructure and Transport (MOLIT) mandates third-party liability insurance for all motorbike delivery riders starting 3 June 2026. The Ministry of Gender Equality and Family extends the maximum shelter stay for underage sexual-violence survivors to age 25, effective 1 July 2026. And the Personal Information Protection Commission (PIPC) requires board-level approval and ISMS-P certification for Chief Privacy Officers (CPOs) at large data processors, with a public-comment window closing 13 July 2026.
The three measures were endorsed alongside the 24th Cabinet Meeting (also serving as the 11th Emergency Economic Inspection Meeting) chaired by President Lee Jae-myung. In his opening remarks, President Lee told ministers: “If we double the pace of governance over the next four years, we can accomplish what would normally take eight.” The triple-decree bundle is the second visible policy salvo of the administration’s second year, paired with the morning’s K-Bio/EUV/Canada advanced-industry package.
1. Delivery riders: no insurance, no rides — effective 3 June 2026
MOLIT’s amendment to the Enforcement Decree and Rules of the Lifestyle Logistics Service Industry Development Act takes effect on 3 June 2026. It mandates that every motorbike delivery worker carry a paid-transportation insurance policy, not the cheaper “personal use” auto policy that historically gave insurers grounds to deny claims after delivery accidents.
The rules specify coverage explicitly: unlimited liability for bodily injury and at least 20 million won (about USD 14,500) for property damage per incident. Riders who do not carry the qualifying policy will be barred from working from the next day — platforms must verify policy status before assigning deliveries. Verification occurs through a new government information system or by document submission, and platforms must reconfirm coverage before policy expiration; for policies running six months or more, reconfirmation must happen every three months.
The rationale is both safety and protection from catastrophic personal liability. Korea’s motorbike fatalities have hovered around 400–500 deaths per year over the past five years, with delivery riders accounting for a growing share as the food-delivery economy expanded. Before the rule, a serious accident could leave a rider personally exposed to multi-hundred-thousand-dollar damages claims, often forcing personal bankruptcy. MOLIT estimates the verification system will eliminate the gray zone of uninsured rides — a structural fix rather than a publicity campaign.
2. Shelter stay to age 25 for underage sexual-violence survivors — effective 1 July 2026
The Ministry of Gender Equality and Family’s amendment to the Enforcement Decree of the Sexual Violence Prevention and Victims Protection Act was passed by the Cabinet on 2 June and will be enforced from 1 July 2026. The core change: a sexual-violence survivor who enters a protective shelter while still a minor may remain there — across all shelter types — until age 25, receiving continuous protection, counseling, and self-reliance support.
The parent statute, passed by the National Assembly in December 2025, removed the prior shelter-type-specific maximum stay that often forced survivors to leave when they were still in high school or had no stable housing. Under the new rules, the maximum-stay extension grounds in the Enforcement Decree are rewritten to align with the parent law’s intent, ensuring that survivors can complete secondary education, transition into college or vocational training, and stabilize their early employment years inside the protective system.
The same Cabinet session also approved amendments to the Enforcement Decree of the Electronic Monitoring Act — a parallel measure within the government’s “public-order and women’s safety” policy track that was highlighted across last week’s one-year-anniversary briefings. Watchpoints for the first six months include shelter occupancy rates, self-reliance budget growth, and continuing-education enrollment among extended-stay residents.
3. CPO board mandate and ISMS-P certification — public-comment to 13 July 2026
The Personal Information Protection Commission (PIPC) on 2 June released a draft amendment to the Enforcement Decree of the Personal Information Protection Act, with public comment open until 13 July 2026. Three pillars stand out.
First, large data processors above a threshold must obtain board-of-directors approval and notify the PIPC whenever appointing, changing, or dismissing their Chief Privacy Officer (CPO). The threshold mirrors the existing rule for mandatory specialized-CPO designation. Notifications must be filed within one month, extendable by one more month under exceptional circumstances. The measure is designed to shield CPOs from arbitrary executive pressure by elevating their status into formal corporate governance.
Second, the decree clarifies ISMS-P (Information Security and Personal Information Protection) certification as mandatory for high-impact data processors. Named categories include PIPC-designated public-system operators, mobile carriers, identity-verification agencies, and firms with revenue of 1 trillion won or more in the previous year. ISMS-P certification involves annual audits and is widely regarded as the strictest privacy/security standard in Korea.
Third, the decree introduces an “undelayed notification” standard. Companies must inform data subjects from the moment a leak becomes possible, not only after a leak is confirmed. The change is aimed at giving consumers the earliest opportunity to take self-protection steps such as changing passwords, freezing cards, or rotating tokens — a major shift from the previous practice of disclosing only after internal investigations concluded.
Why the three decrees were bundled on the same day
The three measures address very different domains — labor safety for gig workers, recovery infrastructure for young survivors, and corporate-governance escalation for data privacy. But they share one feature: each one closes a long-recognized gap between legal text and lived experience. Riders nominally had insurance options; survivors nominally had shelters; data subjects nominally had notification rights. The new decrees make these protections binding in practice.
The bundle also signals the policy cadence of the Lee Jae-myung administration’s second year. After Monday’s package of 81 newly effective June laws and Tuesday morning’s “digital government burden-cut” triple-drop (one-time language-test registration, 181 documents eliminated at city halls, AI-upgraded Employ24), the evening citizen-protection bundle is the third visible salvo in 48 hours. President Lee’s framing — “doubling the pace, broadening the reach” — is being translated into a steady stream of enforcement-decree changes rather than headline-grabbing new legislation.
What to watch in the first six months
For the rider rule: how quickly insurers roll out the new paid-transportation products, how platforms handle the verification system, and whether the higher premium burden lands on riders or platforms. The labor-policy debate around who pays will intensify even as the rule itself is uncontroversial on safety grounds.
For shelter extension: occupancy rates, self-reliance budget expansion, and continuing-education outcomes for residents who choose to stay beyond age 19. Gender Equality Ministry longitudinal studies will be a key dataset.
For CPO governance: board-meeting minutes will, for the first time, routinely contain CPO-approval items at large Korean firms. The ISMS-P consulting and audit market is set to grow, and the “undelayed notification” rule could materially change incident-response playbooks for banks, telecoms, and major platforms.
Read together with the morning’s advanced-industry package, the day’s two bundles align Korea’s “growth” and “protection” tracks on the same policy clock — the clearest expression yet of the second-year governing rhythm. Related: [2026-06-02] Korea Advanced-Industry Triple-Drop.
- MOLIT — Mandatory paid-transportation insurance for delivery riders (2026-06-02)
- Ministry of Gender Equality and Family — Shelter stay extended to age 25 (2026-06-02)
- PIPC — CPO board resolution and ISMS-P certification decree (2026-06-02)
- 24th Cabinet Meeting briefing (2026-06-02)
- Presidential spokesperson written briefing on the 24th Cabinet Meeting (2026-06-02)