A leaked resident registration number can be changed — 90-day review, 100-day processing, 30 days to object
Most people who get a data breach notification change a password and move on. If the leaked list includes your resident registration number, that is not enough. A password can be replaced; a resident registration number follows you for life, and once it is circulating there is no way to call it back. So the law leaves one door open. If a leak has caused you harm, or is likely to, you can have your resident registration number changed. The basis is Article 7-4 of the Resident Registration Act, and a separate committee decides.

The qualifying grounds are fixed
Not every leak qualifies. Article 7-4 allows an application from someone who, as a result of a leaked resident registration number, is in one of the following positions.
- There is recognised harm, or risk of harm, to life or body
- There is recognised damage, or risk of damage, to property
- Separately designated categories, including victims of sexual violence, prostitution or domestic violence, and victims of sexual offences against children and adolescents
The key point is that a leak has to have happened first. An application because you dislike the number is not eligible. The grounds for refusal are spelled out too: where the purpose is to conceal a criminal record or evade a legal obligation, to obstruct an investigation or trial, or where the application offends public order and good morals.
The first step is establishing whether your number is actually in circulation. The channels for checking are set out in how to check whether your personal data has leaked.
Where to file — your registered district office
The application goes to the mayor or head of the district where you are registered. In practice that means visiting the community service centre for your registered address, or filing online through Government24. It is easy to trip on this: the test is where you are registered, not where you currently live.
Two documents are needed. A resident registration number change application form (the prescribed form in the Enforcement Rules) and documents proving the grounds. The second is what actually determines the outcome. A breach notification, a report receipt, a police confirmation of the incident, a copy of a judgment — documents created by a third party are what carry weight. A statement you wrote yourself is often not enough.
There is no fee. Filing costs nothing.
The Resident Registration Number Change Committee decides
The district office that receives your application does not make the decision. The file goes to the Resident Registration Number Change Committee, which reviews and resolves it. The committee runs its own site (rrncc.go.kr) with guidance on the scheme and how to apply.
That structure is why it takes time. Filing at a community service centre does not mean the officer there can give you an answer; the counter handles intake and notification only.

100 days to process, 90 days to review, 45 if it is urgent
Several numbers get quoted and they are easy to conflate. Separated out:
- 100-day processing period — the overall figure Government24 publishes for the application, covering intake through to notification of the outcome.
- Committee review within 90 days — the time the committee takes to consider the case and reach a resolution.
- Extension of up to 30 days — the committee can resolve to extend its review period.
- 45 days where urgent — review is shortened from 90 days to 45 where a threat to life or body is imminent and both seriousness and urgency are recognised. This has been in force since 17 February 2024. Sexual violence and stalking are cited as typical examples.
The shortening is not automatic. You have to evidence the urgency at the application stage to enter the 45-day track. If stalking or threats are ongoing, the material showing that has to go in with the application.
One practical note. Harm can continue during the three months a review takes, so it is worth putting the blocks you can activate immediately in place separately from the change application. Telecom identity-theft blocks and financial blocks belong here. The same channels are listed in what to do in the first 30 minutes after losing your phone.
What changes, and what does not
All thirteen digits do not change. The first six digits (date of birth) and the first digit of the second block (sex) stay as they are, and it is the following six digits that are replaced. The regional information those digits once carried has already been abolished and the digits are now assigned at random.
So the hope that changing the number makes you a different person on paper is misplaced. Date of birth and sex remain. What does change is that the leaked combination stops being valid, which shuts down identity-theft attempts that rely on it.
Once a change is granted you have to be issued a new resident registration card, and then tell everyone holding your number — banks, telecom providers, your employer. Government agencies notify each other, but private counterparties are not tidied up automatically. Running a request to access, delete or suspend processing of your personal data alongside that helps clear the old number from companies you no longer deal with.
Refused? You have 30 days to object
The outcome is not always a decision to change. It can be dismissed or rejected. The remedy is an objection. Under Article 7-4(4), you may object within 30 days of being notified of a decision other than a decision to change, and the objection goes to the mayor or head of the district where you are registered.
Thirty days is short. It runs out while the notification sits on a shelf. The substance of an objection is reading the stated grounds for refusal and supplying the proof that was found wanting. Filing the same documents again produces the same result.

Applications are rising
Government figures show applications climbing sharply. When the Ministry of the Interior and Safety announced the shortened processing period, it cited a 125.5% increase in applications over the previous year as background. More frequent breaches mean more people know the scheme exists.
Put differently, this is no longer a procedure used only by exceptional victims — it has become a channel ordinary people affected by a leak actually use. If money has already been taken, there are separate payment-suspension and refund procedures; see account freezes and how to object.
The order to work in
1. Establish whether there was a leak and what was in it. 2. Put telecom and financial blocks in place first, to limit harm while the review runs. 3. Collect third-party proof — the breach notification, report receipts, police incident confirmations. 4. File the change application form at your registered community service centre or on Government24 (no fee). 5. If it is urgent, evidence that and request the 45-day expedited review. 6. Wait for the outcome (100-day processing period; 90-day review plus up to 30 days' extension). 7. If dismissed or rejected, supplement and object within 30 days of notification. 8. Once changed, get a new registration card and notify private counterparties directly — banks, telecoms and the rest.
This article reflects Article 7-4 of the Resident Registration Act as of August 2026, together with Government24 civil service guidance, guidance from the Resident Registration Number Change Committee, and the Ministry of the Interior and Safety announcement shortening the review period to 45 days, in force from 17 February 2024. Whether an individual case qualifies depends on the committee's decision, and this article does not substitute for legal advice. Confirm the exact requirements and documents with your registered community service centre or the committee before applying.
All content is fact-checked under our editorial standards.