ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION

영문법령 불러오는 중…

ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION — 법갈피

Article 4(Formulating policy on promotion of utilization of information and communications networks and protection of information) #

(1) The Minister of Science and ICT or the Korea Media and Communications Commission shall formulate policy measures to lay the foundations for an information society through the promotion of utilization of information and communications networks, the stable management and operation of such networks, the protection of users, and other related activities (hereinafter referred to as "promotion of utilization of information and communications networks, the protection of information, and other related matters"). <Amended on Mar. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Feb. 4, 2020; Oct. 1, 2025>

(2) The policy measures under paragraph (1) shall contain descriptions of the following: <Amended on Dec. 24, 2018; Jun. 9, 2020>

1. Development and dissemination of technology related to information and communications networks;

2. Standardization of information and communications networks;

3. Promotion of utilization of information and communications networks, including the development of contents of information and applied service for information and communications networks under Article 11;

4. Facilitation of sharing information through information and communications networks;

5. Promotion of use of the Internet;

6. Deleted; <Feb. 4, 2020>

6-2. Deleted; <Feb. 4, 2020>

7. Protection of youths in information and communications networks;

7-2. Development and dissemination of technologies that identify false sounds, visions, pictorial images, etc., made using artificial intelligence technology, among information circulated through information and communications networks;

8. Enhancement of safety and reliability of information and communications networks;

9. Other matters necessary for the promotion of utilization of information and communications networks, the protection of information, and other related matters.

(3) When preparing the policy measures under paragraph (1), the Minister of Science and ICT or the Korea Media and Communications Commission shall ensure that the policy measures are linked to the comprehensive plan for the intelligent information society under Article 6 of the Framework Act on Intelligent Informatization. <Amended on Mar. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Jun. 9, 2020; Oct. 1, 2025>

[This Article Wholly Amended on Jun. 13, 2008]

Article 8(Standardization and certification of information and communications networks) #

(1) The Minister of Science and ICT shall establish and give public notice of the standards for information and communications networks in order to promote the utilization of information and communications networks, and may recommend providers of information and communications services or persons who manufacture or supply products related to information and communications networks to comply with the standards; provided, the matters for which the Korean Industrial Standards under Article 12 of the Industrial Standardization Act have already been established shall comply with such standards. <Amended on Mar. 23, 2013; Jul. 26, 2017>

(2) A person who manufactures or supplies a product related to information communications in conformity with the standards publicly notified pursuant to paragraph (1) may put on the product a mark stating that the product conforms to the standards, subject to the prior certification of the certification body under Article 9 (1).

(3) Where a product falls under the proviso of paragraph (1) and the certification under Article 15 of the Industrial Standardization Act has been already given to the product, the product shall be deemed to have been certified pursuant to paragraph (2).

(4) No person other than a person who holds the certification under paragraph (2) may put a mark verifying that his or her product conforms to the standards or put any similar mark, nor may he or she sell a product with any similar mark or display such product for the purpose of sale.

(5) The Minister of Science and ICT may order a person who sells a product or displays such product for the purpose of sale in violation of paragraph (4), to collect and recall the product or to obtain certification to put such mark; or may take any other corrective measure as necessary. <Amended on Mar. 23, 2013; Jul. 26, 2017>

(6) Matters regarding the subject matters of the standardization, the methods and procedures for such standardization, and a mark of certification under paragraphs (1) through (3), and the collection, recall, corrective measures, etc. under paragraph (5) shall be prescribed by Decree of the Ministry of Science and ICT. <Amended on Mar. 23, 2013; Jul. 26, 2017>

[This Article Wholly Amended on Jun. 13, 2008]

Article 22-2(Consent to access authority) #

(1) Where a provider of information and communications services needs authority to access (hereinafter referred to as "access authority") information stored and functions installed in mobile devices of users in order to provide the relevant services, the provider shall inform users of the following so that users may clearly recognize such matters, and shall obtain consent of users:

1. In the case of access authority certainly necessary to provide the relevant services:

(a) Items of the information and functions for which access authority is necessary;

(b) Grounds that access authority is necessary;

2. In the case of access authority not certainly necessary to provide the relevant services:

(a) Items of the information and functions for which access authority is necessary;

(b) Grounds that access authority is necessary;

(2) No provider of information and communications services shall refuse to provide the relevant services to users on the ground that the users give no consent to the establishment of access authority not certainly necessary to provide the relevant services.

(3) Persons manufacturing and providing a basic operating system (referring to an operating environment in which software installed in mobile devices can be run) of mobile devices, manufacturers of mobile devices, and persons manufacturing and providing a software for mobile devices shall take measures necessary for protecting user information, such as devising methods for users to give or revoke consent to access authority where the provider of information and communications services intends to access the information stored and functions installed in mobile devices.

(4) The Korea Media and Communications Commission may conduct compliance inspections to ascertain that access authority is set for relevant services in accordance with paragraphs (1) through (3). <Added on Jun. 12, 2018; Oct. 1, 2025>

(5) The scope of, and methods for consenting to, access authority referred to in paragraph (1), the measures necessary for protecting user information referred to in paragraph (3), and other necessary matters shall be prescribed by Presidential Decree. <Amended on Jun. 12, 2018>

[This Article Added on Mar. 22, 2016]

Article 23-5(Creation and processing of connecting information) #

(1) An identity verification agency shall not create, provide, use, compare, link irreversibly encrypted form of any user's resident registration number (hereinafter referred to as "connecting information") or perform other similar acts (hereinafter referred to as "processing") for the purpose of interlinking the services of a provider of information and communication services, except in cases falling under any of the following subparagraphs: <Amended on Oct. 1, 2025>

1. Where providing services to safely identify and authenticate users using information entered by the users;

2. Where administrative agencies and public institutions (hereinafter referred to as "administrative agencies, etc.") holding uniquely identifiable information under Article 24 of the Personal Information Protection Act (hereinafter in this Article referred to as "uniquely identifiable information") utilize connecting information to provide electronic government service defined in subparagraph 5 of Article 2 of the Electronic Government Act, in any of the following cases:

(a) Where the head of a central agency responsible for administrative affairs under subparagraph 4 of Article 2 of the Electronic Government Act requests for the creation and processing of connecting information in order to provide integral support to administrative agencies, etc. for the identification of users;

(b) Where an administrative agency, etc. inevitably requests the creation and processing of connecting information without obtaining the user's consent within the scope of the purpose of processing uniquely identifiable information;

3. Where a person holding uniquely identifiable information requests the creation and processing of connecting information of a data subject who has requested the transmission of personal information in order to fulfill the obligation to transmit personal information pursuant to Article 35-2 of the Personal Information Protection Act;

4. Where the processing of resident registration numbers is permitted under the subparagraphs of Article 24-2 (1) of the Personal Information Protection Act, and the identity verification agency and the relevant provider of information and communications services together have obtained approval from the Korea Media and Communications Commission for providing information and communication services prescribed by the Presidential Decree for which it is inevitable to create and process connecting information without obtaining the consent of the user.

(2) Where the Korea Media and Communications Commission intends to approve the creation and processing of connecting information under paragraph (1) 4, the Commission shall comprehensively examine the following matters: <Amended on Oct. 1, 2025>

1. Appropriateness and innovativeness of the realization of services to be provided:

2. Adequacy of procedures for creating and processing connecting information;

3. Plans for physical, technical, and administrative measures to ensure safety in creating and processing connecting information;

4. Adequacy of measures to protect the rights of users:

5. Impacts and effects on relevant markets and user benefits:

(3) The Korea Media and Communications Commission may revoke approval for the creation and processing of connecting information under paragraph (1) 4 in any of the following; provided, in the case of subparagraph 1, the approval shall be revoked: <Amended on Oct. 1, 2025>

1. Where they have obtained approval for the creation and processing of connecting information under paragraph (1) 4 by fraud or in any other improper means;

2. Where they fail to comply with the matters examined under each subparagraph of paragraph (2);

3. Where they violate the obligation to take physical, technical, or administrative measures under Article 23-6 (1);

4. Where they violate a statute or regulation related to the protection of personal information and the reason for such violation is material.

(4) A person who is provided with connecting information from an identity verification agency (hereinafter referred to as a "entity using connecting information") for the services under the subparagraphs of paragraph (1) may process the connecting information within the scope of purposes for which the person has been provided; provided, if the data subject separately consents, the connecting information may be processed within the scope of the consented purpose.

(5) Matters necessary for approval procedures for creating and processing connecting information under paragraphs (1) through (4), detailed examination criteria for each approval, criteria for revoking approval, and other matters shall be prescribed by Presidential Decree.

[This Article Added on Jan. 23, 2024]

Article 44-2(Request for deletion of information) #

(1) Where information provided through an information and communications network purposely to be made public intrudes on other persons' privacy, defames other persons, or violates other persons' right otherwise, the victim of such violation may request the provider of information and communications services who managed the information to delete the information or publish a rebuttable statement (hereinafter referred to as "deletion or rebuttal"), presenting explanatory materials supporting the alleged violation. In such cases, a person who requesting deletion or rebuttal (hereafter in this Article referred to as "applicant") may designate a means to be notified of the progress and results of such processing, such as a text message or e-mail, and a person who has posted the relevant information (hereafter in this Article referred to as "person who posted information") may designate in advance the means to be notified of the fact of taking measures under paragraph (2), such as text messages or e-mails. <Amended on Mar. 22, 2016; Jan. 3, 2023>

(2) Upon receipt of a request for deletion or rebuttal of the information under paragraph (1), a provider of information and communications services shall delete the information or take a temporary or any other necessary measure and shall notify the applicant and the publisher of the information without delay. In such cases, the provider of information and communications services shall make it known to users that he or she has taken necessary measures by posting a public notification on the relevant message board or in any other way.

(3) If there is any media product harmful to youths published in violation of the labeling method under Article 42 in the information and communications network operated and managed by a provider of information and communications services or if a content advertising any media product harmful to youths is displayed in such network without any measures to restrict access by youths under Article 42-2, the provider shall delete such content without delay.

(4) Notwithstanding a request for deletion of the information under paragraph (1), if it is impracticable to judge whether information violates any right or it is anticipated that there will probably be a dispute between interested parties, a provider of information and communications services may take a measure to block access to the information temporarily (hereinafter referred to as "temporary measures"). In such cases, the period for the temporary measure shall not exceed 30 days.

(5) Every provider of information and communications services shall clearly state in advance the details, procedures, and other matters regarding necessary measures in the terms and conditions.

(6) If a provider of information and communications services takes necessary measures under paragraph (2) for the information circulated through the information and communications network operated and managed by himself or herself, the provider may have his or her liability to indemnify loss incurred by such information mitigated or discharged.

[This Article Wholly Amended on Jun. 13, 2008]

Article 44-7(Prohibition on circulation of unlawful information) #

(1) No one may circulate any of the following information through an information and communications network: <Amended on Sep. 15, 2011; Mar. 22, 2016; Jun. 12, 2018; Jan. 21, 2025>

1. Information with obscene content distributed, sold, rented, or displayed openly in the form of code, words, sound, images, or motion picture;

2. Information with content that defames other persons by divulging a fact or false information, openly and with intent to disparage the person's reputation;

3. Information with content that arouses fear or apprehension by reaching other persons repeatedly in the form of code, words, sound, image, or motion picture;

4. Information with content that damages, destroys, alters, or forges an information and communications system, data, a program, or similar or that interferes with the operation of such system, data, program, or similar without good cause;

5. Information with content that amounts to a media product harmful to youths under the Youth Protection Act and that is provided for profit without fulfilling the duties and obligations under the relevant statutes and regulations, including the duty to verify the subject's age and the duty of labeling;

6. Information with content that amounts to speculative activities prohibited by statutes and regulations;

6-2. Information with content of transactions of personal information in violation of this Act or any other statute or regulation regarding the protection of personal information;

6-3. Information regarding methods, drawings, etc. for manufacturing guns or explosives (including things with a yield that may expose people to risk of life or bodily injury);

6-4. Information with content of the use, manufacture, sale, or mediation of the sale of narcotics prohibited by the Narcotic Drugs Control Act;

7. Information with content that divulges a State secret, including secrets classified under statutes and regulations;

8. Information with content that violates the National Security Act;

9. Other information with content that attempts to commit, aids, or abets a crime.

(2) The Korea Media and Communications Commission may order a provider of information and communications services or a manager or an operator of a message board to reject, suspend, or restrict management of information under paragraph (1) 1 through 6, 6-2 through 6-4, subject to deliberation by the Communications Standards Commission; provided, if the information falls under paragraph (1) 2 or 3, the Commission shall not issue an order to reject, suspend, or restrict such management against the intention specifically manifested by the victim of the relevant information. <Amended on Mar. 22, 2016; Jun. 12, 2018; Jan. 21, 2025; Oct. 1, 2025>

(3) The Korea Media and Communications Commission shall order a provider of information and communications services or a manager or an operator of a message board to reject, suspend, or restrict management of information under paragraph (1) 7 through 9, if the information falls under all of the following: <Amended on Mar. 22, 2016; Dec. 24, 2018; Dec. 3, 2024; Oct. 1, 2025>

1. A request shall have been made by the head of the relevant central administrative agency [including requests from the head of an investigative agency for photographs and videos, compilations, composites, processed products, or their duplicates (including duplicates of duplicates) under Articles 14 and 14-2 of the Special Act on the Punishment of Sexual Crimes, and for child or youth sexual exploitation materials under subparagraph 5 of Article 2 of the Act on the Protection of Children and Youth against Sex Offenses];

2. A demand for correction was made pursuant to subparagraph 4 of Article 22 of the Act on the Establishment and Operation of Korea Media and Communications Commission after deliberation by the Communications Standards Commission within 7 days from the date the request under subparagraph 1 had been received;

3. The provider of information and communications services or the manager or operator of the message board has not complied with the demand for correction.

(4) The Korea Media and Communications Commission shall provide an opportunity to the provider of information and communications services or the manager, operator, or relevant user of the message board to whom an order is to be issued pursuant to paragraph (2) or (3) to present his or her opinion in advance; provided, the Commission need not provide an opportunity to present an opinion in any of the following cases: <Amended on Oct. 1, 2025>

1. Where it is necessary to make an urgent disposition for public safety or welfare;

2. Where there is a ground prescribed by Presidential Decree to believe that it is obviously impracticable or evidently unnecessary to hear an opinion;

3. Where a person concerned clearly manifests his or her intent to give up the opportunity to present his or her opinion.

(5) An information and communication service provider that installs and operates a domestic server for temporary storage of data and meets the criteria prescribed by the Presidential Decree for the type and scale of business shall take the following technical and administrative measures to prevent the distribution of information falling under the subparagraphs of paragraph (1): <Added on Jan. 23, 2024>

1. Measures to identify whether the information described in each of the subparagraphs of paragraph (1) is stored on the server and to promptly restrict access to it, subject to deliberation by the Communications Standards Commission in accordance with paragraphs 2 and 3;

2. Measures to request the person who posted the information identified under subparagraph 1 to prohibit the distribution of the relevant information;

3. Measures to have the actual status of the operation and management of the measures under subparagraph 1 recorded automatically in the system, and to keep it for the period prescribed by Presidential Decree;

4. Other measures prescribed by Presidential Decree as necessary to prevent the distribution of information falling under the subparagraphs of paragraph (1).

[This Article Wholly Amended on Jun. 13, 2008]

Articles 44-8 (Protection of children in interactive information and communications services) When a provider of information and communications services provides children under 14 years of age with information and communications services based on a system that processes information by engaging in a conversation with a human user through text messages or voice chat, it shall endeavor not to provide information containing inappropriate content to such children.

[This Article Added on Dec. 24, 2018]

Article 45(Securing of stability of information and communications networks) #

(1) Any of the following persons shall take protective measures to secure the reliability of the information and ensure the stability of the information and communications networks used to provide information and communications services: <Amended on Jun. 9, 2020>

1. A provider of information and communications services;

2. A person who manufactures or imports devices, equipment, and facilities prescribed by Presidential Decree, among devices, equipment, and facilities which can transmit or receive information by being connected to an information and communications network (hereinafter referred to as "devices and the like connected to an information and communications network").

(2) The Minister of Science and ICT may determine and give public notice of guidelines for protective measures for information (hereinafter referred to as "information protection guidelines"), specifying details of the protective measures under paragraph (1) and may recommend any of the persons falling under paragraph (1) to observe the guidelines. <Amended on Feb. 17, 2012; Mar. 23, 2013; Jul. 26, 2017; Jun. 9, 2020>

(3) The information protection guidelines shall contain descriptions of the following: <Amended on Mar. 22, 2016; Jun. 9, 2020>

1. Technical and physical protective measures, including installation and operation of an information security system, to prevent or counteract access to or invasion upon an information and communications network by a person with no due authorization;

2. Technical protective measures for preventing unlawful leakage, forgery, alteration, or deletion of information;

3. Technical and physical protective measures for securing the state of enabling continuous use of information and communications networks;

4. Administrative protective measures for stabilization of information and communications networks and protection of information, including securing human resources, organization, and expenses and establishing related plans;

5. Technical protective measures for information security of devices and the like connected to an information and communications network.

(4) The Minister of Science and ICT may request the heads of relevant central administrative agencies to reflect the content of the information security guidelines in standards for testing, inspection, certification, etc. related to devices and the like connected to information and communications networks with regard to the substantive areas under their jurisdictions. <Added on Jun. 9, 2020>

[This Article Wholly Amended on Jun. 13, 2008]

Article 45-3(Designation of chief information security officers) #

(1) A provider of information and communications services shall designate an executive officer or employee meeting the standards prescribed by Presidential Decree as a chief information security officer and shall file a report thereon to the Minister of Science and ICT, in order to ensure the security of information and communications systems, etc. and safe management of information; provided, a provider of information and communications services whose total assets, turnover, and the like meet the criteria prescribed by Presidential Decree need not file a report on such chief information security officer. <Amended on May 28, 2014; Jul. 26, 2017; Jun. 12, 2018; Jun. 8, 2021>

(2) Methods and procedures for reporting under paragraph (1) and other matters shall be prescribed by Presidential Decree. <Added on May 28, 2014>

(3) No chief information security officer designated and reported under the main clause of paragraph (1) (limited to where a provider of information and communications services whose total assets, turnover, and the like meet the criteria prescribed by Presidential Decree) may hold another office concurrently, other than perform duties referred to in paragraph (4). <Added on Jun. 12, 2018>

(4) A chief information security officer shall perform the following duties: <Amended on Jun. 8 2021>

1. The chief information security officer shall be responsible for the following duties:

(a) To formulate, implement, and improve information protection plans;

(b) To conduct regular audit and improve the actual conditions and practices of information protection;

(c) To identify and evaluate risks relating to information protection and develop countermeasures for information protection;

(d) To formulate and implement plans for information protection education and simulation training;

2. The chief information security officer may hold another office concurrently to perform the following:

(a) Duties of providing information security disclosure under Article 13 of the Act on the Promotion of Information Security Industry;

(b) Duties of chief information security officers under Article 5 (5) of the Act on the Protection of Information and Communications Infrastructure;

(d) Duties of privacy officers under Article 31 (2) of the Personal Information Protection Act;

(e) Taking other measure necessary for information protection in accordance with this Act or any other relevant statute or regulation.

(5) A provider of information and communications services may establish and operate a council of chief information security officers comprised of chief information security officers prescribed in paragraph (1) in order to jointly prevent and respond to a cyber security incident, share necessary information, and implement other joint programs prescribed by Presidential Decree. <Amended on May 28, 2014; Jun. 12, 2018>

(6) The Government may fully or partially provide support to the Council of Information Security Officers under paragraph (5) for expenses incurred in conducting its activities. <Amended on May 28, 2014; Jun. 22, 2015; Jun. 12, 2018>

(7) Necessary matters regarding qualifications, etc. of chief information security officers shall be prescribed by Presidential Decree. <Added on Jun. 12, 2018>

[This Article Added on Feb. 17, 2012]

Article 46(Protection of integrated information and communication facilities) #

(1) Among the following information and communications service providers who meet the standards prescribed by Presidential Decree in terms of the scale, etc. of information and communications facilities (hereinafter referred to as "integrated information and communication facility operator, etc.") shall take protective measures, as prescribed by Presidential Decree, in order to operate information and communications facilities in a stable manner: <Amended on Jun. 9, 2020; Jan. 3, 2023>

1. A person who operates and manages integrated information and communications facilities to provide information and communications services for others (hereinafter referred to as "integrated information and communication facility operator");

2. A person who operates and manages integrated information and communication facilities directly to provide his or her own information and communications services.

(2) Every integrated information and communication facility operator shall purchase insurance policies as prescribed by Presidential Decree to cover damages that may be caused by destruction or damage of integrated information and communication facilities or any other trouble in operation.

(3) The Minister of Science and ICT may regularly inspect whether protective measures under paragraph (1) have been implemented and may order the integrated information and communication facility operator, etc. to take corrective measures with respect to matters requiring supplementation; provided, in cases of matters for which inspection under Article 36-2 (2) of the Framework Act on Broadcasting Communications Development has been conducted with respect to an integrated information and communication facility operator, etc. such matters shall be excluded from the inspection on whether protective measures under paragraph (1) have been implemented. <Added on Jan. 3, 2023>

(4) The Minister of Science and ICT may request providers of information and communications services falling under any subparagraph of paragraph (1), the heads of relevant central administrative agencies, the heads of local governments, and the heads of institutions designated as public institutions pursuant to Article 4 of the Act on the Management of Public Institutions to submit materials in order to verify whether they fall under the category of integrated information and communication facility operators and to conduct an inspection under paragraph (3). Upon receipt of a request for submission of materials in such cases, a person in receipt of such request shall comply therewith, in the absence of good cause, and Article 64 (6) and (9) through (11) shall apply mutatis mutandis to the procedures, methods, etc. for requesting submission of materials. <Added on Jan. 3, 2023>

(5) Article 64-2 shall apply mutatis mutandis to the protection and destruction of materials submitted pursuant to paragraph (4). <Added on Jan. 3, 2023>

(6) Where the provision of information and communications services has been interrupted during the period prescribed by Presidential Decree due to a disaster, calamity, or other physical or functional defects, an integrated information and communication facility operator shall report to the Minister of Science and ICT without delay the current status of interruption, causes of such interruption, emergency measures, and recovery measures. In such cases, the Minister of Science and ICT may provide technical support necessary for the recovery and protection of integrated information and communications facilities. <Added on Jan. 3, 2023>

(7) A provider of information and communications services who has leased an integrated information and communications facility provided by an integrated information and communication facility operator shall actively cooperate with the integrated information and communication facility operator in implementing protective measures under paragraph (1), and if exclusively operating and managing the leased facility, including directly installing and operating facilities necessary for protective measures under paragraph (1) or controlling access to such facilities, he or she shall take measures prescribed by Presidential Decree, such as implementing protective measures and reporting service interruption due to a disaster, etc. <Added on Jan. 3, 2023>

(8) The Minister of Science and ICT may entrust affairs regarding the inspection under paragraph (3) and technical support under paragraph (6) to a specialized organization prescribed by Presidential Decree. <Added on Jan. 3, 2023>

(9) The frequency and method of inspection under paragraph (3), the method of reporting under paragraph (6), and other necessary matters shall be prescribed by Presidential Decree. <Added on Jan. 3, 2023>

[This Article Wholly Amended on Jun. 13, 2008]

Article 47(Certification of information security management systems) #

(1) With respect to a person who establishes and operates a comprehensive management system, including administrative, technical, and physical protective measures, for ensuring stability and reliability of an information and communications network (hereinafter referred to as "information security management system"), the Minister of Science and ICT may certify as to whether such person meets the standards under paragraph (4). <Amended on Feb. 17, 2012; Mar. 23, 2013; Dec. 1, 2015; Jul. 26, 2017>

(2) A telecommunications business operator under subparagraph 8 of Article 2 of the Telecommunications Business Act, or any of the following persons who provides or intermediates the provision of information by using telecommunications services of any telecommunications business operator, shall receive the certification under paragraph (1): <Added on Feb. 17, 2012; Dec. 1, 2015; Dec. 24, 2018; Jun. 9, 2020; Jan. 23, 2024>

1. A person who renders information and communications network services, as prescribed by Presidential Decree, as a person registered pursuant to Article 6 (1) of the Telecommunications Business Act (hereinafter referred to as a "major provider of information and communications services");

2. A integrated information and communication facility operator;

3. A person meeting the standards prescribed by Presidential Decree, whose sales, tax revenue, or any similar for the previous year is at least 150 billion won, whose sales in the information and communications service sector for the previous year is at least 10 billion won, or whose average daily users for the previous year is at least 1 million.

(3) Where a person required to be certified in accordance with paragraph (2) is certified for conformity with international standards for information protection or takes measures for information protection, as prescribed by Decree of the Ministry of Science and ICT, the Minister of Science and ICT may omit part of certification examination under paragraph (1). In such cases, the detailed scope of omitted certification examination shall be determined and publicly notified by the Minister of Science and ICT. <Added on Dec. 1, 2015; Jul. 26, 2017>

(4) For the purpose of certification of an information security management system under paragraph (1), the Minister of Science and ICT may determine and publicly notify certification standards, etc. including countermeasures for administrative, technical, and physical protection and other necessary matters. <Amended on Feb. 17, 2012; Mar. 23. 2013; Dec. 1, 2015; Jul. 26, 2017>

(5) The period of validity of the certification of an information security management system under paragraph (1) shall be 3 years; provided, upon receipt of any information security management gradein accordance with Article 47-5 (1), the certification under paragraph (1) shall be deemed effective during the period of validity of such rating. <Added on Feb. 17, 2012; Dec. 1, 2015>

(6) The Minister of Science and ICT may have the Korea Internet and Security Agency or any institution designated by the Minister of Science and ICT (hereinafter referred to as "certification body for information security management systems") perform the following affairs related to the certification under paragraphs (1) and (2): <Added on Feb. 17, 2012; Mar. 23. 2013; Dec. 1, 2015; Jul. 26, 2017>

1. Examination to verify whether the information security management system established by an applicant for certification meets the certification standards under paragraph (4) (hereinafter referred to as "examination for certification");

2. Review on the results of examination for certification;

3. Issuance and management of written certifications;

4. Follow-up management of granted certifications;

5. Fosterage and qualification management of the certification examiners of information security management systems;

6. Other affairs regarding the certification of information security management systems.

(7) If necessary for the efficient conduct of affairs related to certification, the Minister of Science and ICT may designate an institution that performs affairs related to examination for certification (hereinafter referred to as "examination institution for information security management systems"). <Added on Dec. 1, 2015; Jul. 26, 2017>

(8) The Korea Internet and Security Agency, a certification body for information security management systems, and an examination institution for information security management systems shall, in order to enhance the efficiency of information security management systems, perform follow-up management at least once a year and notify the Minister of Science and ICT of the results thereof. <Added on Feb. 17, 2012; Mar. 23. 2013; Dec. 1, 2015; Jul. 26, 2017>

(9) A person who has received the certification of an information security management system in accordance with paragraphs (1) and (2) may indicate or publicize the content of the certification, as prescribed by Presidential Decree. <Amended on Feb. 17, 2012; Dec. 1, 2015>

(10) The Minister of Science and ICT may revoke the certification where any of the following grounds is found; provided, in cases falling under subparagraph 1, the Minister of Science and ICT shall revoke the certification: <Added on Feb. 17, 2012; Mar. 23. 2013; Dec. 1, 2015; Jul. 26, 2017>

1. Having received the certification of an information security management system by fraud or other improper means;

2. Falling short of the certification standards under paragraph (4);

3. Refusing or obstructing the follow-up management under paragraph (8).

(11) Methods and procedures for, and scope and fees of, certification under paragraphs (1) and (2), methods and procedures for follow-up management under paragraph (8), methods and procedures for revoking certification under paragraph (10), and other necessary matters shall be prescribed by Presidential Decree. <Amended on Feb. 17, 2012; Dec. 1, 2015>

(12) Standards and procedures for, and period of validity of, the designation of a certification body for information security management systems and an examination institution for information security management systems, and other necessary matters shall be prescribed by Presidential Decree. <Amended on Feb. 17, 2012; Dec. 1, 2015>

[This Article Wholly Amended on Jun. 13, 2008]

Article 48-2(Countermeasures against cyber security incidents) #

(1) The Minister of Science and ICT shall perform the following business affairs to take proper countermeasures against cyber security incidents and may have the Korea Internet and Security Agency fully or partially perform the business affairs, if necessary to do so: <Amended on Apr. 22, 2009; Mar. 23, 2013; Jul. 26, 2017>

1. Collection and spread of information about cyber security incidents;

2. Precaution and warning of computer security incidents;

3. Emergency measures against cyber security incidents;

4. Other countermeasures against cyber security incidents prescribed by Presidential Decree.

(2) Any of the following persons shall furnish the Minister of Science and ICT or the Korea Internet and Security Agency with the information related to cyber security incidents, including statistics by type of cyber security incidents, statistics of traffic of the relevant information and communications network, and statistics of use by access channel, as prescribed by Presidential Decree: <Amended on Apr. 22, 2009; Mar. 23, 2013; Jul. 26, 2017>

1. A major provider of information and communications services;

2. A integrated information and communication facility operator;

3. Other persons prescribed by Presidential Decree from among those who operate an information and communications network.

(3) The Korea Internet and Security Agency shall analyze the information under paragraph (2) and report it to the Minister of Science and ICT. <Amended on Apr. 22, 2009; Mar. 23, 2013; Jul. 26, 2017; Jul. 26, 2017>

(4) If a business operator obligated to furnish the information in accordance with paragraph (2) refuses to do so without good cause or furnishes false information, the Minister of Science and ICT may order the business operator to make a correction within a reasonable period. <Amended on Mar. 23, 2013; Jul. 26, 2017>

(5) The Minister of Science and ICT or the Korea Internet and Security Agency shall use the information furnished in accordance with paragraph (2) properly within the extent necessary for taking countermeasures against a cyber security incident. <Amended on Apr. 22, 2009; Mar. 23, 2013; Jul. 26, 2017>

(6) If necessary to take countermeasures against a cyber security incident, the Minister of Science and ICT or the Korea Internet and Security Agency may request a person falling under any subparagraph of paragraph (2) to provide human resources for assistance. <Amended on Apr. 22, 2009; Mar. 23, 2013; Jul. 26, 2017>

[This Article Wholly Amended on Jun. 13, 2008]

Article 48-4(Analysis of causes of cyber security incidents) #

(1) If a cyber security incident occurs, a person who operates an information and communications network, including a provider of information and communications services, shall analyze the causes of the cyber security incident; respond thereto, based on the results of analysis, for stopping damage from spreading; and take measures necessary to recover from the damage and prevent a recurrence of such cyber security incident. <Amended on Jun. 10, 2022>

(2) If a cyber security incident occurs in an information and communications network operated by a provider of information and communications services, the Minister of Science and ICT may analyze the causes of the cyber security incident and develop countermeasures to stop damage from spreading, to respond to such incident, to recover from damage, and to prevent a recurrence of such incident; and may order the provider of information and communications services (excluding public institutions) to implement necessary measures. <Added on Jun. 10, 2022; Feb. 13, 2024>

(3) The Minister of Science and ICT may inspect whether measures under paragraph (2) have been implemented and order the provider of information and communications services to make a correction for matters requiring supplementation. <Added on Feb. 13, 2024>

(4) Where a serious cyber security incident occurs in an information and communications network operated by a provider of information and communications services, the Minister of Science and ICT may organize a private-public joint investigation team having expertise in the protection of information and analyze the causes of such cyber security incident if necessary for analyzing such causes and developing countermeasures pursuant to paragraph (2). <Amended on Mar. 23, 2013; Jul. 26, 2017; Jun. 10, 2022; Feb. 13, 2024>

(5) If deemed necessary for analyzing the causes of a cyber security incident and developing countermeasures pursuant to paragraph (2), the Minister of Science and ICT may order the relevant provider of information and communications services to preserve relevant data, such as records on access to the relevant information and communications network. <Amended on Mar. 23, 2013; Jul. 26, 2017; Jun. 10, 2022; Feb. 13, 2024>

(6) The Minister of Science and ICT may demand a provider of information and communications services to submit data related to a cyber security incident, if deemed necessary for analyzing the causes of such cyber security incident and developing countermeasures pursuant to paragraph (2); and in the case of a serious cyber security incident, the Minister may require public officials under his or her jurisdiction or a private-public joint investigation team under paragraph (4) to enter the place of business of the relevant person and to investigate the causes of the incident; provided, data corresponding to the communication confirmation data defined in subparagraph 11 of Article 2 of the Protection of Communications Secrets Act shall be submitted in the manner prescribed by that Act. <Amended on Mar. 23, 2013; Jul. 26, 2017; Jun. 10, 2022; Feb. 13, 2024>

(7) The Minister of Science and ICT or the private-public joint investigation team shall not use the information learned through the data submitted and the investigation conducted in accordance with paragraph (6) for any purpose other than the analysis of the causes of the cyber security incident and development of countermeasures and shall destroy it immediately after the analysis of the causes is completed. <Amended on Mar. 23, 2013; Jul. 26, 2017; Jun. 10, 2022; Feb. 13, 2024>

(8) Matters necessary for the methods and procedures for inspection under paragraph (3), the organization and operation of a private-public joint investigation team under paragraph (4), the protection of data submitted pursuant to paragraph (6), the methods and procedures for investigations, etc. shall be prescribed by Presidential Decree. <Amended on Jun. 10, 2022; Feb. 13, 2024>

[This Article Wholly Amended on Jun. 13, 2008]

Article 48-5(Countermeasures against cyber security incidents related to devices and the like connected to information and communications networks) #

(1) Where a computer security incident related to devices and the like connected to an information and communications network occurs, the Minister of Science and ICT may analyze the cause of the relevant computer security incident in cooperation with the heads of relevant central administrative agencies.

(2) Where there occurs a computer security incident related to devices and the like connected to an information and communications network, which is likely to cause any danger to the lives, bodies, or property of citizens, the Minister of Science and ICT may request the heads of relevant central administrative agencies to take the following measures:

1. Measures, such as the inspection of vulnerabilities and technical support under Article 47-4 (1);

2. Measures necessary for precluding the spread of damage;

3. Improvement of other systems for the information security of devices and the like connected to an information and communications network.

(3) Where there occurs a cyber security incident related to devices and the like connected to an information and communications network, the Minister of Science and ICT may recommend a person who manufactures or imports the relevant devices and the like connected to an information and communications network to take measures, such as improving vulnerabilities thereof, for preventing an expansion or recurrence of the cyber security incident.

(4) The Minister of Science and ICT may provide support to a specialized organization prescribed by Presidential Decree for expenses incurred in conducting the following business activities:

1. Research to formulate guidelines for information security related to devices and the like connected to information and communications networks;

2. Research for improving standards for testing, inspection, authentication, etc. related to devices or the like connected to information and communications networks.

[This Article Added on Jun. 9, 2020]

Article 48-6(Certification of devices and the like connected to information and communications networks) #

(1) Where devices and the like connected to an information and communications network meet the certification standards under paragraph (2) as a result of an examination conducted by a testing agency for certification under paragraph (4), the Minister of Science and ICT may grant information security certification.

(2) The Minister of Science and ICT may determine and publicly notify certification standards for ensuring the stability of information and communications networks and securing the reliability of information, with regard to the information security certification under paragraph (1) (hereinafter referred to as "information security certification").

(3) Where a person who has obtained information security certification falls under any of the following subparagraphs, the Minister of Science and ICT may revoke such certification; provided, in cases falling under subparagraph 1, such certification shall be revoked:

1. Where he or she has obtained information security certification by fraud or other improper means;

2. Where he or she fails to meet the certification standards provided for in paragraph (2).

(4) In order to efficiently conduct tests verifying whether devices and the like connected to an information and communications network meet the certification standards referred to in paragraph (2), the Minister of Science and ICT may, if necessary, designate, as a testing agency for certification, an institution satisfying the designation standards prescribed by Presidential Decree.

(5) Where a testing agency for certification designated pursuant to paragraph (4) (hereinafter referred to as a "testing agency for certification") falls under any of the following cases, the Minister of Science and ICT may revoke such designation; provided, in cases falling under subparagraph 1, such certification shall be revoked:

1. Where it has obtained the designation by fraud or other improper means;

2. If it fails to meet the criteria for designation under paragraph (4).

(6) The Minister of Science and ICT may entrust affairs related to information security certification and the revocation thereof to the Korea Internet and Security Agency.

(7) Necessary matters regarding procedures, etc. for information security certification and cancellation of such certification and procedures, etc. for designation of testing agencies for certification and cancellation of such designation shall be prescribed by Presidential Decree.

[This Article Added on Jun. 9, 2020]

Article 49-2(Prohibition on collection of information by deception) #

(1) No one shall collect another person's information or entice another person to furnish information through an information and communications network by deception.

(2) Whenever a provider of information and communications services discovers a violation of paragraph (1), he or she immediately report it to the Minister of Science and ICT or the Korea Internet and Security Agency. <Amended on Apr. 22, 2009; Mar. 22, 2016; Jul. 26, 2017; Feb. 4, 2020>

(3) Upon receipt of a report under paragraph (2) or becoming aware of a violation of paragraph (1), the Minister of Science and ICT or the Korea Internet and Security Agency shall take the following measures as necessary: <Amended on Apr. 22, 2009; Mar. 22, 2016; Jul. 26, 2017; Feb. 4, 2020; Jun. 10, 2022>

1. Collection and diffusion of the information related to the violation;

2. Precaution and warning of similar damage;

3. Emergency measures for preventing damage and spread thereof, including requesting a provider of information and communications services to conduct all or some of the following:

(a) Blockage of access paths;

(b) Suspension of the provision of information and communications services for telephone numbers used for a violation described in paragraph (1);

(4) To take measures referred to in paragraph (3) 3, the Minister of Science and ICT may order providers of information and communications services to take necessary measures, such as sharing among themselves information regarding deception through information and communications networks. <Added on Mar. 22, 2016; Jul. 26, 2017; Feb. 4, 2020>

(5) Upon receipt of a request made under paragraph (3) 3, a provider of information and communications services may take the relevant measures in the manner prescribed by relevant terms and conditions of use. <Added on Jun. 10, 2022>

(6) Details to be stipulated by the terms and conditions of use under paragraph (5) shall be prescribed by Presidential Decree. <Added on Jun. 10, 2022>

[This Article Wholly Amended on Jun. 13, 2008]

[Title Amended on Feb. 4, 2020]

Article 50(Restrictions on transmission of advertising information for profit-making purpose) #

(1) If any person intends to transmit advertising information for profit-making purpose by using an electronic transmission medium, he or she shall obtain express prior consent from an addressee of such information; provided, he or she need not obtain prior consent in any of the following cases: <Amended on Mar. 22, 2016; Jun. 9, 2020>

1. Where a person who has directly collected contact details from the addressee in his or her dealings of goods, etc. intends to transmit advertising information for profit-making purpose on the same kinds of goods, etc. as those he or she manages and has dealt with the addressee within a period prescribed by Presidential Decree;

2. Where a telemarketer under the Act on Door-to-Door Sales informs prospective customers of the collection source of their personal information by voice, and solicits them to buy products or services by means of a telephone call.

(2) Notwithstanding paragraph (1), where an addressee expresses his or her intention to refuse to receive information or revokes his or her prior consent, no person who intends to transmit advertising information for profit-making purpose by using an electronic transmission medium shall transmit advertising information for profit-making purpose.

(3) Notwithstanding paragraph (1), a person who intends to transmit advertising information for profit-making purpose by using an electronic transmission medium during the time between 9:00 pm and 8:00 am of the following day shall obtain express prior consent from the addressee of such information; provided, the forgoing shall not apply to media prescribed by Presidential Decree.

(4) A person who transmits advertising information for profit-making purpose by using an electronic transmission medium shall specify the following matters in advertising information, as prescribed by Presidential Decree:

1. The name and contact details of a sender;

2. Matters regarding measures and methods by which an addressee can readily express his or her intention to refuse to receive information or to revoke his or her consent to receive information.

(5) A person who transmits advertising information for profit-making purpose by using an electronic transmission medium shall not engage in any of the following acts: <Amended on Jan. 23, 2024>

1. Act of evading or preventing addressees from opting out or withdrawing their consent to receive advertising information;

2. Act of automatically generating an addressee's contact information, such as a telephone number and e-mail address, using a combination of numbers, symbols, or letters;

3. Act of automatically registering a telephone number or e-mail address for the purpose of transmitting advertising information for profit-making purpose;

4. Various acts to conceal the identity of the sender of advertising information or the source of the transmission of the advertisement;

5. Various acts to deceive an addressee into responding for the purpose of transmitting advertising information for profit-making purpose.

(6) A person who transmits advertising information for profit-making purpose by using an electronic transmission medium shall take necessary measures so that an addressee does not incur any cost, such as telephone charges, when the addressee refuses to receive or revokes his or her consent to receive such information, as prescribed by Presidential Decree.

(7) A person who intends to transmit advertising information for profit-making purpose using an electronic transmission medium shall, when an addressee expresses his or her intention to consent to the receipt of such information under paragraphs (1) and (3) refuse to receive, or revoke his or her consent to receive, advertising information under paragraph (2), inform the relevant addressee of the outcomes of measures taken in relation to consent to receive, refusal to receive, or revocation of consent to receive, advertising information, as prescribed by Presidential Decree. <Amended on Jan. 23, 2024>

(8) A person who obtains consent to receive advertising information pursuant to paragraph (1) or (3) shall regularly verify whether an addressee of advertising information consents to receive such information, as prescribed by Presidential Decree.

[This Article Wholly Amended on May 28, 2014]

Article 52(Korea Internet and Security Agency) #

(1) The Government shall establish the Korea Internet and Security Agency (hereinafter referred to as the "Internet and Security Agency") to upgrade information and communications networks (excluding matters regarding establishment, improvement, and management of information and telecommunications networks), encourage the safe use thereof, and promote the international cooperation and advancement into the overseas market in relation to broadcasting and communications. <Amended on Apr. 22, 2009; Jun. 9, 2020>

(2) The Internet and Security Agency shall be a corporation. <Amended on Apr. 22, 2009>

(3) The Internet and Security Agency shall perform the following business affairs: <Amended on Apr. 22, 2009; Feb. 17, 2012; Mar. 23, 2013; Nov. 19, 2014; Jun. 22, 2015; Jul. 26, 2017; Feb. 4, 2020; Jun. 9, 2020; Jun. 8, 2021; Jun. 10, 2022; Jan. 23, 2024; Oct. 1, 2025>

1. Survey and research of laws, policies, and systems for the use and protection of information and telecommunications networks, promotion of the international cooperation and advancement into the overseas market in relation to broadcasting and communications, etc.;

2. Survey and analysis of statistics regarding the use and protection of information and telecommunications networks;

3. Analysis of negative effects arising from the use of information and telecommunications networks and research on countermeasures;

4. Public relations activities, education, and training for using and protecting information and telecommunications networks;

5. Information protection for information and telecommunications networks, development of technologies regarding the Internet address resources and standardization thereof;

6. Support for policies for the information security industry, development of relevant technology, and fostering of human resources;

7. Implementation of certification and evaluation of information security, such as certification of information security management systems, certification and evaluation of information security systems, certification of information security of devices and the like connected to information and communications networks, and software development security assessment; and the provision of support therefor;

8. Research of countermeasures for protecting personal information, and support for development and dissemination of protective technologies under the Personal Information Protection Act;

9. Operation of a personal information infringement call center under the Personal Information Protection Act;

10. Consultation on and processing of complaints related to transmission of advertising information and online advertisements;

11. Management of cyber security incidents in information and communications networks, analysis of causes thereof, operation of systems for responding thereto; and promotion of chief information security officers' activities to prevent and respond to such incidents and to cooperate each other;

12. Support for policies on electronic signature certification under Article 21 of the Electronic Signature Act;

13. Support for an efficient operation of the Internet and encouragement of wider use thereof;

14. Support for the protection of stored information of the Internet users;

15. Support for service policies pertaining to the Internet;

16. Protection of users and support for the dissemination of sound information on the Internet;

17. Affairs related to the management of Internet address resources under the Internet Address Resources Act;

18. Support for the operation of the Internet Address Dispute Resolution Committee under Article 16 of the Internet Address Resources Act;

19. Support for operation of the conciliation committee under Article 25 (7) of the Act on the Promotion of Information Security Industry;

20. Support for such international cooperation, overseas expansion, and overseas publicity activities as are regarding broadcasting and communications;

21. Support for policies related to identity verification services and to the creation and processing of connecting information;

22. Any other business incidental to the business referred to in subparagraphs 1 through 21;

23. Other business determined to fall under the affairs of, or entrusted to, the Internet and Security Agency in accordance with this Act, or any other statute or regulation, or other business entrusted by the Minister of Science and ICT, the Minister of the Interior and Safety, the Korea Media and Communications Commission, or the head of any other administrative agency.

(4) Expenses necessary for the business affairs of the Internet and Security Agency shall be funded by the following financial resources: <Amended on Mar. 22, 2016>

1. Government’s contributions;

2. Revenues accrued from the business referred to in each subparagraph of paragraph (3);

3. Other revenues accrued from operating the Internet and Security Agency.

(5) Except as provided in this Act, the provisions governing incorporated foundations under the Civil Act shall apply mutatis mutandis to matters regarding the Internet and Security Agency. <Amended on Apr. 22, 2009>

(6) No person, other than the Internet and Security Agency, shall use the name "Korea Internet and Security Agency". <Amended on Apr. 22, 2009>

(7) Matters necessary for the operation of the Internet and Security Agency and performance of its business affairs shall be prescribed by Presidential Decree. <Amended on Apr. 22, 2009>

[This Article Wholly Amended on Jun. 13, 2008]

[Title Amended on Apr. 22, 2009]

Article 53(Registration of providers of telecommunications billing services) #

(1) A person who intends to render telecommunications billing services shall meet the following requirements and file for registration with the Minister of Science and ICT, as prescribed by Presidential Decree: <Amended on Feb. 29, 2008; Mar. 23, 2013; Jul. 26, 2017>

1. Financial soundness;

2. A plan for protection of users of telecommunications billing services;

3. Human resources and physical facilities required for conducting the business;

4. A business plan.

(2) A person eligible for the registration under paragraph (1) shall be either a company under Article 170 of the Commercial Act or a corporation under Article 32 of the Civil Act; and the total amount of its capital, contributions, or fundamental property shall be at least the amount prescribed by Presidential Decree, not less than 500 million won.

(3) Notwithstanding Article 22 of the Telecommunications Business Act, a provider of telecommunications billing services need not file a report of a value-added telecommunications business operator. <Amended on Mar. 22, 2010>

(4) Articles 23 through 26 of the Telecommunications Business Act shall apply mutatis mutandis to the modification of registered matters of a provider of telecommunications billing services, the transfer of business or acquisition by transfer of business, or the merger or inheritance of business, the succession to business, and the temporary closure, permanent closure, dissolution, or similar of business of a provider of telecommunications billing services. In such cases, "special telecommunications business operator" shall be construed as "provider of telecommunications billing services", and "special telecommunications business" as "telecommunications billing services". <Amended on Mar. 22, 2010; Jun. 9, 2020>

(5) Detailed requirements and procedures for the registration under paragraph (1) and other necessary matters shall be prescribed by Presidential Decree.

[This Article Added on Dec. 21, 2007]

[Previous Article 53 moved to Article 62 <Dec. 21, 2007>]

Article 58(Rights of users of telecommunications billing services) #

(1) When the price for goods, etc. sold or provided must be paid, or a provider of telecommunications billing services charges the price therefor; such provider shall notify the users of telecommunications billing services of the following: <Amended on Apr. 5, 2011; May 28, 2014>

1. Date and time telecommunications billing services are used;

2. Trade name and contact information of the other party with respect to purchasing or using any good or service through telecommunications billing services (referring to a person who sells or provides any good or service in a transaction through telecommunications billing services; hereinafter referred to as "other party to a transaction");

3. Amount purchased or used through telecommunications billing services and details thereof;

4. Methods for raising an objection and contact information.

(2) A provider of telecommunications billing services shall provide users of telecommunications billing services with a method by which users can verify the details of purchase and use and shall also furnish a user, upon request, with a written statement on the details of purchase and use (including an electronic document; hereinafter the same shall apply) within 2 weeks from the date of the request.

(3) A user of telecommunications billing services discovers that the telecommunications billing services have been rendered against his or her will, the user may request the provider of telecommunications billing services to make corrections (excluding where there is an intentional act or negligence on the part of the user of the telecommunications billing services), and where the provider of telecommunications billing services finds that the user's request for correction is reasonable, the provider shall withhold the payment of the price for use to a seller and shall notify the user of the results thereof within 2 weeks from the date of the request for correction. <Amended on May 28, 2014>

(4) Every provider of telecommunications billing services shall preserve records of telecommunications billing services during the period, within 5 years, prescribed by Presidential Decree.

(5) Where a provider of telecommunications billing services (referring to a person who provides services under Article 2 (1) 10 (a)) provides telecommunications billing services or increases the upper limits of use, he or she shall obtain consent from a user of the relevant telecommunications billing services in advance. <Added on May 28, 2014>

(6) When a provider of telecommunications billing services (referring to a person who provides services under Article 2 (1) 10 (a)) amends the terms and conditions, he or she shall notify users of the amendment thereof 1 month prior to the effective date of the amended terms and conditions. In such cases, a user who has an objection to the amended terms and conditions may terminate the contract for telecommunications billing services. <Added on May 28, 2014>

(7) The period, types, and scope of the details of purchase and use that a provider of telecommunications billing services should provide pursuant to paragraph (2); the types of records that a provider of telecommunications billing services should preserve pursuant to paragraph (4) and the methods for preserving such records; the methods for notifying amendment to the terms and conditions pursuant to paragraph (6); and matters necessary for terminating the contract, such as the period and procedures for raising an objection; shall be prescribed by Presidential Decree. <Amended on May 28, 2014>

(8) The Minister of Science and ICT shall prescribe and provide public notice of matters necessary for methods for giving consent, etc. under paragraph (5). <Added on May 28, 2014; Jul. 26, 2017>

(9) The Minister of Science and ICT may prescribe and provide public notice of detailed matters regarding the methods for settling accounts, etc. so that telecommunications billing services are not provided against the will of users of telecommunications billing services. <Added on May 28, 2014; Jul. 26, 2017>

[This Article Added on Dec. 21, 2007]

[Previous Article 58 Moved to Article 67 <Dec. 21, 2007>]

Article 64(Submission of data) #

(1) The Minister of Science and ICT or the Korea Media and Communications Commission may require a provider of information and communications services (including a domestic agent; hereafter in this Article the same shall apply) to submit related articles, documents, and others in any of the following cases: <Amended on Mar. 29, 2011; Feb. 17, 2012; Mar. 23, 2013; Jul. 26, 2017; Sep. 18, 2018; Feb. 4, 2020; Oct. 1, 2025>

1. Where the Minister or the Commission becomes aware of a violation or suspected violation of this Act;

2. Where the Minister or the Commission receives a report or petition on a violation of this Act;

2-2. Where an event, accident, or similar occurs or is likely to occur that noticeably damages safety and reliability of user information;

3. Where there is any other ground prescribed by Presidential Decree to believe that it is necessary for the protection of users.

(2) When the Korea Media and Communications Commission intends to take the following measures against a person who transmitted any advertising information for profit-making purpose in violation of this Act, it may request a provider of information and communications services to let it peruse or to submit data of the person who transmitted the advertising information, such as the name, address, and resident registration number of the person and the period for access: <Amended on Feb. 4, 2020; Oct. 1, 2025>

1. Corrective measures under paragraph (4);

2. Imposition of administrative fines under Article 76;

3. Any similar measures.

(3) If a provider of information and communications services fails to submit data under paragraph (1) or (2) or if it is found that a provider of information and communications services has violated this Act, the Minister of Science and ICT or the Korea Media and Communications Commission may assign public officials under his, her, or its control to enter the place of business of the person concerned related to such violation of this Act, including the provider of information and communications services, for inspecting the current status of business, account books, documents, and others. <Amended on Mar. 29, 2011; Mar. 23, 2013; Mar. 22, 2016; Jul. 26, 2017; Feb. 4, 2020; Oct. 1, 2025>

(4) The Minister of Science and ICT or the Korea Media and Communications Commission may order a provider of information and communications services who has violated this Act to take corrective measures as necessary to stop or correct the violation and may also require a provider of information and communications services who has been ordered to take corrective measures to announce to the public the fact that he or she received the order to take such corrective measures. In such cases, the matters necessary for the methods, guidelines, and procedures for the public announcement and other related matters shall be prescribed by Presidential Decree. <Amended on Mar. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Feb. 4, 2020; Oct. 1, 2025>

(5) In cases of issuing an order to take corrective measures as necessary pursuant to paragraph (4), the Minister of Science and ICT or the Korea Media and Communications Commission may disclose to the public the issuance of the order to take corrective measures. In such cases, the matters necessary for the methods, guidelines, and procedures for the public disclosure and other related matters shall be prescribed by Presidential Decree. <Amended on Mar. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Oct. 1, 2025>

(6) When demanding submission or perusal of data or other materials pursuant to paragraph (1) or (2), the Minister of Science and ICT or the Korea Media and Communications Commission shall give a written notice (including an electronic document), specifically stating the reasons and legal authority for such demand, the time limit for submission or the date and time for perusal, the details of data subject to the submission or perusal, and other related matters. <Amended on Mar. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Oct. 1, 2025>

(7) When an inspection under paragraph (3) is to be conducted, the plan for the inspection, including the date and time of, and the reasons for and details of, the inspection, shall be notified to the relevant provider of information and communications services not later than 7 days before the commencement of the inspection; provided, the plan for such inspection shall not be notified in an emergency case or if it is deemed impossible to accomplish the purposes of the inspection because of anticipated destruction of evidence or any other factor if a prior notice is given. <Amended on Feb. 4, 2020>

(8) The public officials who conduct an inspection pursuant to paragraph (3) shall carry an identification indicating their authority with them to present it to people concerned, and shall deliver to the people concerned a document stating their names, the time and purposes of access, and other related matters, whenever they access to a place of business.

(9) In cases of receiving, perusing, or inspecting data or any other material submitted pursuant to paragraphs (1) through (3), the Minister of Science and ICT or the Korea Media and Communications Commission shall notify the relevant provider of information and communications services of the results thereof (including the details of disposition, in cases of intending to make a disposition, such as an order to take corrective measures, as a result of the inspection) in writing. <Amended on Mar. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Feb. 4, 2020; Oct. 1, 2025>

(10) The Minister of Science and ICT or the Korea Media and Communications Commission may ask technical advice or any other support of the head of the Internet and Security Agency as necessary in demanding submission of data or conducting an inspection pursuant to paragraphs (1) through (4). <Amended on Apr. 22, 2009; Mar. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Oct. 1, 2025>

(11) Demand for submission of data or any other material, and perusal and inspection thereof under paragraphs (1) through (3) shall be limited to the least extent necessary for the enforcement of this Act and shall be not abused for any other purpose.

[This Article Wholly Amended on Jun. 13, 2008]

Article 64-2(Protection and destruction of data) #

(1) If asked by a provider of information and communications services to protect documents, data, or any other material submitted or collected pursuant to Article 64, the Minister of Science and ICT or the Korea Media and Communications Commission shall not furnish them to a third party or disclose them to the general public. <Amended on Mar. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Feb. 4, 2020; Oct. 1, 2025>

(2) In cases of receiving data submitted through an information and communications network or converting collected data or any other material into an electronic format, the Minister of Science and ICT or the Korea Media and Communications Commission shall take systematic and technical measures for security to protect personal information, trade secret, or similar from being leaked. <Amended on Mar 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Oct. 1, 2025>

(3) If any of the following events occurs, the Minister of Science and ICT or the Korea Media and Communications Commission shall immediately destroy documents, data, or any other material submitted or collected pursuant to Article 64, except as otherwise provided in any other statute. The same shall apply to a person to whom the authority of the Minister of Science and ICT or the Korea Media and Communications Commission has been fully or partially delegated or entrusted under Article 65: <Amended on Mar. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Oct. 1, 2025>

1. If the objectives of demanding submission of data, conducting a field inspection, or issuing an order to take corrective measures pursuant to Article 64 have been achieved;

2. If an administrative trial or administrative litigation is filed against an order issued to take corrective measures pursuant to Article 64 (4), when proceedings of such administrative trial are completed;

3. If a disposition is made to impose an administrative fine under Article 76 (4) and there is no objection to it, when the period to raise an objection under paragraph (5) of that Article ends;

4. If there is an objection filed against disposition of an administrative fine under Article 76 (4), when the non-contentious case procedures are closed at the competent court.

[This Article Wholly Amended on Jun. 13, 2008]

Article 64-5(Obligation to submit transparency reports) #

(1) A provider of information and communications services who meet the criteria prescribed Presidential Decree, such as the average number of daily users, sales, and types of business, shall prepare an annual report stating the following (hereinafter referred to as "transparency report") with regard to the disposition of illegally filmed materials or the like circulated through information and communications services rendered by the provider and shall submit the report to the Korea Media and Communications Commission by January 31 of the following year: <Amended on Oct. 1, 2025>

1. Matters concerning the general efforts made by the provider of information and communications services to prevent the circulation of illegally filmed materials or the like;

2. Matters concerning the number, details, criteria for processing, results of examination, and results of processing of reports on illegally filmed materials or the like and requests for deletion, etc. of such materials under Article 22-5 (1) of the Telecommunications Business Act;

3. Matters concerning the preparation and operation of procedures necessary for preventing circulation, such as deleting illegally filmed materials or the like and blocking access thereto, under Article 22-5 (1) of the Telecommunications Business Act;

4. Matters concerning the placement of persons responsible for preventing the circulation of illegally filmed materials or the like;

5. Matters concerning the provision of internal training and support for preventing the circulation of illegally filmed materials or the like.

(2) The Korea Media and Communications Commission shall disclose transparency reports through the information and communications network operated and managed by it. <Amended on Oct. 1, 2025>

(3) The Korea Media and Communications Commission may request a provider of information and communications services to submit data to ascertain the facts of a transparency report or ascertain the authenticity of the submitted data. <Amended on Oct. 1, 2025>

[This Article Added on Jun. 9, 2020]

Article 76(Administrative fines) #

(1) Any of the following persons and any of the following persons who commit an act falling under any of subparagraphs 7 through 11 shall be subject to an administrative fine not exceeding 30 million won: <Amended on Mar. 29, 2011; Feb. 17, 2012; Mar. 23, 2013; May 28, 2014; Jun. 22, 2015; Dec. 1, 2015; Mar. 22, 2016; Jul. 26, 2017; Sep. 18, 2018; Feb. 4, 2020; Jun. 8, 2021; Jan. 3, 2023; Jan. 23, 2024; Feb. 13, 2024; Oct. 1, 2025>

1. A person who refuses to provide services, in violation of Article 22-2 (2);

1-2. A person who fails to take measures necessary to protect user information such as devising methods for users to give or revoke consent to access authority, in violation of Article 22-2 (3);

2. A person who collects or uses resident registration numbers in violation of Article 23-2 (1) or fails to take necessary measures in violation of Article 23-2 (2);

2-2. Deleted; <Feb. 4, 2020>

2-3. Deleted; <Feb. 4, 2020>

2-4. Deleted; <Feb. 4, 2020>

2-5. A person who fails to take physical, technical or administrative measures under Article 23-6 (1);

2-6. A person who fails to take safety measures in accordance with Article 23-6 (2);

3. Deleted; <Feb. 4, 2020>

4. Deleted; <Feb. 4, 2020>

5. Deleted; <Feb. 4, 2020>

5-2. Deleted; <Feb. 4, 2020>

6. Deleted; <May 28, 2014>

6-2. A person who fails to designate an executive officer or employee meeting the standards prescribed by Presidential Decree as a chief information security officer, or fails to report the designation of a chief information security officer, in violation of Article 45-3 (1);

6-3. A person who requires a chief information security officer to hold another office concurrently other than to perform duties prescribed in Article 45-3 (4), in violation of paragraph (3) of that Article;

6-4. A person who fails to comply with a corrective order issued under Article 46 (3);

6-5. A person who fails to have an information security management system certified, in violation of Article 47 (2);

6-6. A person who fails to report a cyber security incident, in violation of Article 48-3 (1);

6-7. A person who fails to comply with a corrective order issued under Article 48-4 (3);

7. A person who transmits any advertising information for profit, in violation of Article 50 (1) through (3);

8. A person who fails to state the matters required to be stated, or who states false information on such matters, when transmitting any advertising information, in violation of Article 50 (4);

9. A person who imposes the burden of any expense on an addressee, in violation of Article 50 (6);

9-2. A person who fails to verify whether an addressee consents to receiving advertising information, in violation of Article 50 (8);

9-3. A person who fails to take necessary measures, in violation of Article 50-4 (4);

10. A person who installs a program without consent of the relevant user, in violation of Article 50-5;

11. A person who posts any advertising information for profit-making purpose on a website, in violation of Article 50-7 (1) or (2);

11-2. Deleted; <Feb. 4, 2020>

12. A person who fails to comply with an order issued, for violation of this Act, by the Minister of Science and ICT or the Korea Media and Communications Commission pursuant to Article 64 (4).

(2) Any of the following persons shall be subject to an administrative fine not exceeding 20 million won: <Amended on Mar. 22, 2016; Jun 12, 2018; Sep. 18, 2018; Feb. 4, 2020; Jun. 9, 2020>

1. Deleted; <Feb. 4, 2020>

1-2. Deleted; <Feb. 4, 2020>

2. Deleted; <Feb. 4, 2020>

3. Deleted; <Feb. 4, 2020>

4. Deleted; <Feb. 4, 2020>

4-2. A person who fails to take out insurance, in violation of Article 46 (2);

4-3. A person who fails to designate a domestic agent, in violation of Article 32-5 (1);

4-4. A person who fails to designate a person responsible for preventing the circulation of illegally filmed materials or the like, in violation of Article 44-9 (1);

5. Deleted. <Feb. 4, 2020>

(3) Any of the following persons shall be subject to an administrative fine not exceeding 10 million won: <Amended on Apr. 22, 2009; Apr. 5, 2011; Feb. 17, 2012; May 28, 2014; Jun. 22, 2015; Dec. 1, 2015; Mar. 22, 2016; Jul. 26, 2017; Jun. 12, 2018; Jun. 12, 2018; Feb. 4, 2020; Jun. 9, 2020; Jun. 10, 2022; Jan. 3, 2023; Jan. 23, 2024; Feb. 13, 2024; Oct. 1, 2025>

1. Deleted; <Jun. 22, 2015>

2. Deleted; <Jun. 22, 2015>

2-2. A person who engages in the identity verification service without being designated as an identity verification agency, in violation of Article 23-3 (1);

2-3. A person who fails to notify as to the temporary discontinuation of the identity verification service under Article 23-3 (2) or as to the permanent discontinuation of the identity verification service under Article 23-3 (3) to users or who fails to report the same to the Korea Media and Communications Commission;

2-4. A person who continuously engages in the identity verification service notwithstanding a disposition for suspension of the identity verification service and revocation of the designation as an identity verification agency under Article 23-4 (1);

2-5. Deleted; <Feb. 4, 2020>

3. A person who fails to designate a person responsible for protection of youths in violation of Article 42-3 (1);

4. A person who fails to preserve information, in violation of Article 43;

4-2. A person who fails to take technical and administrative measures, in violation of Article 44-7 (5);

4-3. A person who fails to comply without good cause with a request to submit data under Article 46 (4) of the Act; provided, the foregoing shall not apply to the heads of relevant central administrative agencies (including their affiliated agencies) shall be excluded;

4-4. A person who fails to file a report or files a false report, in violation of Article 46 (6);

5. Deleted; <Jun. 12, 2018>

6. Deleted; <Dec. 1, 2015>

7. A person who advertises false details of the certification he or she has obtained, in violation of Articles 47 (9);

8. Deleted; <Feb. 17, 2012>

9. Deleted; <Feb. 17, 2012>

10. A person who fails to give notice to users of software, in violation of Article 47-4 (4);

11. A person who fails to comply with an order issued pursuant to Article 48-2 (4) to take corrective measures;

11-2. Deleted; <Feb. 13, 2024>

11-3. A person who fails to submit data demanded under Article 48-4 (6) or submits false data;

12. A person who obstructs, refuses, or evades access to a place of business to conduct an investigation under Article 48-4 (6);

12-2. A person who fails to comply with an order issued by the Minister of Science and ICT or the Korea Media and Communications Commission, in violation of Article 49-2 (4);

12-3. A person who fails to inform the results of handling consent to receive, refusal to receive, or revocation of consent to receive, advertising information, in violation of Article 50 (7);

12-4. Deleted; <Jan. 23, 2024>

13. A person who uses the name of the Korea Internet and Security Agency, in violation of Article 52 (6);

14. A person who fails to file a report on temporary closure, permanent closure, or dissolution of business, in violation of Article 53 (4);

15. A person who fails to report terms and conditions, in violation of Article 56 (1);

16. A person who fails to take administrative or technical measures, in violation of Article 57 (2);

17. A person who fails to notify a user of telecommunications billing services of the date and time of using the aforementioned services and other necessary matters, in violation of Article 58 (1);

18. A person who fails to provide a user of telecommunications billing services with the method by which the user can verify the details of purchase or use, or who fails to respond to a request by a user of telecommunications billing services for the provision of such method, in violation of Article 58 (2);

19. A person who fails to withhold payment of the price though a request to correct a telecommunications bill he or she has received from a user of telecommunications billing services is reasonable or who fails to notify the user of telecommunications billing services of the results of the measures taken in response to a request of the user, in violation of Article 58 (3);

20. A person who fails to preserve records of telecommunications billing services, in violation of Article 58 (4);

20-2. A person who provides telecommunications billing services or increases the maximum use without obtaining consent from a user of telecommunications billing services, in violation of Article 58 (5);

20-3. A person who fails to give notice regarding amendment to the terms and conditions of telecommunications billing services, in violation of Article 58 (6);

20-4. A person who fails to comply with a request by a user of telecommunications billing services for information, in violation of Article 58-2 (including where that Article shall apply mutatis mutandis under Article 59 (2));

21. A person who fails to prepare the procedures for raising an objection by users of telecommunications billing services and redressing their infringed rights or who fails to stipulate such procedures when he or she enters into a contract for telecommunications billing services, in violation of Article 59 (3);

22. A person who fails to submit, or who falsely submitted, goods, documents, or any other material under Article 64 (1);

23. A person who fails to respond to a request for perusal or submission of data under Article 64 (2);

24. A person who refuses, obstructs or evades access and inspection under Article 64 (3);

25. A person who fails to submit rules, etc. in violation of Article 64-5 (1).

(4) The administrative fines prescribed in paragraphs (1) through (3) shall be imposed and collected by the Minister of Science and ICT or the Korea Media and Communications Commission, as prescribed by Presidential Decree. <Amended on Mar. 29, 2011; Mar. 23, 2013; Jul. 26, 2017; Oct. 1, 2025>

(5) Deleted. <Mar. 14, 2017>

(6) Deleted. <Mar. 14, 2017>

(7) Deleted. <Mar. 14, 2017>

[This Article Wholly Amended on Jun. 13, 2008]

ACT ON PROMOTION OF INFORMATION AND COMMUNICATIONS NETWORK UTILIZATION AND INFORMATION PROTECTION

Article 1(Purpose) #

Article 2(Definitions) #

Article 3(Responsibilities of providers and users of information and communications services) #

Article 4(Formulating policy on promotion of utilization of information and communications networks and protection of information) #

Article 4-2(Policy measures to prevent harm caused by synthesized videos, etc.) #

Article 5(Relationship to other statutes) #

Article 5-2(Application to acts done overseas) #

Article 6(Development of technology) #

Article 7(Management and dissemination of technology-related information) #

Article 8(Standardization and certification of information and communications networks) #

Article 9(Designation of certification bodies) #

Article 10(Support for development of contents of information) #

Article 11(Acceleration of development of applied services for information and communications networks) #

Article 12(Establishment of system for sharing information) #

Article 13(Projects for promoting utilization of information and communications networks) #

Article 14(Proliferation of the Internet) #

Article 15(Improvement of quality of internet services) #

Article 16 #

Article 17 #

Article 18 #

Article 19 #

Article 20 #

Article 21 #

Article 22 #

Article 22-2(Consent to access authority) #

Article 23 #

Article 23-2(Restrictions on use of resident registration numbers) #

Article 23-3(Designation of identification service agencies) #

Article 23-4(Suspension of identity verification services and revocation of designation of identification service agencies) #

Article 23-5(Creation and processing of connecting information) #

Article 23-6(Obligation to take safety measures for connecting information) #

Article 24 #

Article 24-2 #

Article 25 #

Article 26 #

Article 26-2 #

Article 27 #

Article 27-2 #

Article 27-3 #

Article 28 #

Article 28-2 #

Article 29 #

Article 29-2 #

Article 30 #

Article 30-2 #

Article 31 #

Article 32 #

Article 32-2 #

Article 32-3 #

Article 32-4 #

Article 32-5(Designation of domestic agents) #

Article 33 #

Article 33-2 #

Article 34 #

Article 35 #

Article 36 #

Article 37 #

Article 38 #

Article 39 #

Article 40 #

Article 41(Preparation of policy on protection of youths) #

Article 42(Labeling of media products harmful to youths) #

Article 42-2(Prohibition on advertisement of media products harmful to youths) #

Article 42-3(Designation of persons responsible for protection of youths) #

Article 43(Duty of providers of visual or sound Information to keep information) #

Article 44(Protection of rights in information and communications networks) #

Article 44-2(Request for deletion of information) #

Article 44-3(Discretionary temporary measures) #

Article 44-4(Self-regulation) #

Article 44-5(Identity verification of users of message boards) #

Article 44-6(Claim to furnish user information) #

Article 44-7(Prohibition on circulation of unlawful information) #

Article 44-9(Persons responsible for preventing circulation of illegally filmed materials or the like) #

Article 44-10(Defamation dispute conciliation division) #

Article 45(Securing of stability of information and communications networks) #

Article 45-2(Information security pre-inspection) #

Article 45-3(Designation of chief information security officers) #

Article 46(Protection of integrated information and communication facilities) #

Article 46-2(Emergency countermeasures of integrated information and communication facility operators) #