ENFORCEMENT DECREE OF THE PERSONAL INFORMATION PROTECTION ACT

영문법령 불러오는 중…

ENFORCEMENT DECREE OF THE PERSONAL INFORMATION PROTECTION ACT — 법갈피

Article 5-2(Personal Information Protection Policy Council) #

(1) For the consistent implementation of personal information protection policies, and to facilitate consultation among relevant central administrative agencies with respect to matters related to the protection of personal information, the Personal Information Protection Policy Council (hereinafter referred to as the "Policy Council") may be established within the Protection Commission.

(2) The Policy Council shall consult on the following matters:

1. Major personal information protection policies, including the Master Plan for the protection of personal information under Article 9 of the Act and the implementation plan under Article 10 of the Act;

2. The enactment and amendment of major statutes or regulations related to the protection of personal information;

3. Cooperation and coordination of opinions on major personal information protection policies;

4. The prevention of and response to personal information breach incidents;

5. The development of technology and professional workforce for the protection of personal information;

6. Other matters requiring consultation among relevant central administrative agencies in connection with the protection of personal information.

(3) The Policy Council shall be comprised of the Senior Executive Service members of the relevant central administrative agencies or equivalent public officials in charge of work related to personal information protection, and they shall be appointed by the head of the relevant central administrative agencies, but the chairperson of the Policy Council (hereinafter referred to as the "Chairperson" in this Article) shall be the Vice Chairperson of the Protection Commission.

(4) If necessary to perform its duties, the Policy Council may have working-level councils or sector-specific councils.

(5) The chairpersons of the sector-specific councils and working-level councils shall be the Protection Commission’s public officials designated by the Chairperson of the Protection Commission.

(6) If necessary to do the work, the Policy Council, and working-level councils and sector-specific councils may request attendance, submission of materials or opinions, or other necessary cooperation from the related agency, organization, expert, etc.

(7) Except as provided in paragraphs (1) through (6), matters necessary for the operation of the Policy Council shall be determined by the chairperson through a resolution of the Policy Council.

[This Article Added on Aug. 4, 2020]

Article 9-3(Procedures for assessment of personal information breach incident factors) #

(1) The head of a central administrative agency who intends to request an assessment of personal information breach incident factors pursuant to Article 8-2 (1) of the Act (hereinafter referred to as "assessment of personal information breach incident factors") shall submit to the Protection Commission a written request (or an electronic request form) for an assessment of personal information breach incident factors which contains the following matters:

1. The purposes and major contents of the policy and systems in need of personal information processing to be adopted or changed by the statutes or regulations (including the draft);

2. Self-analysis of personal information breach incident factors with respect to the matters prescribed in paragraph (2) following the adoption and change of the policy and system in need of personal information processing;

3. Measures to protect personal information following the adoption and change of the policy and system in need of personal information processing.

(2) Upon receipt of a written request under paragraph (1), the Protection Commission shall assess data breach incident factors taking into account the following matters, and shall notify the result thereof to the head of the related central administrative agency:

1. Necessity for processing personal information;

2. Appropriateness of guarantees for the rights of data subjects;

3. Safety in the management of personal information;

4. Other matters necessary to assess data breach incident factors.

(3) The head of a central administrative agency who has been advised as prescribed in Article 8-2 (2) of the Act shall endeavor to implement as advised, such as incorporating such advice in the relevant draft statute or regulation; provided, where it is impracticable to implement as advised by the Protection Commission, the reason therefor shall be notified to the Protection Commission.

(4) The Protection Commission may request materials necessary to assess data breach incident factors from the head of the related central administrative agency.

(5) The Protection Commission may establish guidelines necessary to assess data breach incident factors, including detailed criteria for and methods of the assessment of data breach incident factors; and shall notify the heads of central administrative agencies of the guidelines.

(6) The Protection Commission may seek counsel, etc. from relevant experts where necessary to assess data breach incident factors.

[This Article Added on Jul. 22, 2016]

Article 13-2(Subject matters, standards, methods, and procedures for evaluation of level of personal information protection) #

(1) "Institutions prescribed by Presidential Decree" in Article 11-2 (1) of the Act means the following institutions:

1. A public institution defined in Article 4 of the Act on the Management of Public Institutions;

2. Public corporations and public agencies under the Local Public Enterprises Act;

3. Other public institutions referred to in subparagraphs 4 and 5 of Article 2, which meet the standards publicly notified by the Protection Commission in consideration of the characteristics of personal information processing business of the public institutions.

(2) The standards for the evaluation of the level of personal information protection under Article 11-2 (1) of the Act (hereinafter referred to as "evaluation of the level of personal information protection") shall be as follows:

1. Personal information protection policies and performance records and degree of improvement;

2. Appropriateness of personal information management system;

3. Measures taken to guarantee rights of data subjects and degree of implementation;

4. Measures to prevent infringement of personal information and degree of implementation of measures to ensure safety;

5. Compliance with other measures necessary for the processing and safe management of personal information.

(3) Before conducting evaluation of the level of personal information protection level, the Protection Commission shall prepare an evaluation plan including the subject matter, criteria, methods, indexes, etc. of evaluation and notify the head of an institution subject to evaluation of the level of personal information protection (hereinafter referred to as "institution subject to evaluation") of the evaluation of the level of personal information protection.

(4) In order to efficiently conduct the evaluation of the level of personal information protection, the Protection Commission may organize and operate an evaluation team, including experts with abundant expertise and experience in personal information protection.

(5) The Protection Commission may require the following materials to be submitted pursuant to Article 11-2 (2) of the Act:

1. Where an institution subject to evaluation conducts its own inspection of the level of personal information protection, the results thereof and evidential data;

2. Data necessary for verifying evidentiary materials under subparagraph 1;

3. Other data necessary to evaluate the level of personal information protection, such as whether personal information is safely managed.

(6) The Protection Commission may conduct an evaluation based on the data submitted by the head of an institution subject to evaluation pursuant to paragraph (5) or visit an institution subject to evaluation to conduct such evaluation.

(7) The Protection Commission may request the head of a central administrative agency or the head of a local government to provide support necessary for measures to protect personal information based on the preparation for evaluation or the results of evaluation by an institution subject to evaluation in the relevant field, such as an institution under its jurisdiction. In such cases, upon receipt of such request, the head of a central administrative agency or the head of a local government shall endeavor to provide support upon receipt of such request.

(8) Details of the evaluation of the level of personal information protection under paragraphs (1) through (7) shall be determined and publicly notified by the Protection Commission.

[This Article Added on Mar. 12, 2024]

Article 15-2(Matters subject to notification, such as sources of personal information collected, and methods and procedures for notification) #

(1) "Personal information controller satisfying the criteria prescribed by Presidential Decree" in the main clause of Article 20 (2) of the Act means any of the following personal information controllers; in such cases, the number of data subjects prescribed in the following shall be calculated based on the daily average during the immediately preceding three months as of the end of the previous year: <Amended on Sep. 12, 2023>

1. A person who processes sensitive information defined in Article 23 of the Act (hereinafter referred to as "sensitive information") or personally identifiable information defined in Article 24 (1) of the Act (hereinafter referred to as "personally identifiable information") of at least 50 thousand data subjects;

2. A person who processes personal information of at least one million data subjects.

(2) A personal information controller who falls under any subparagraph of paragraph (1) shall notify data subjects of the matters referred to in the subparagraphs of Article 20 (1) of the Act by any of the following methods within three months from the date of being provided with their personal information; provided, where the personal information controller is regularly provided with and processes personal information at least twice a year to the extent that the personal information controller has obtained consent from the data subjects under Article 17 (1) 1 of the Act about the matters prescribed in Article 17 (2) 1 through 4 of the Act, he or she shall notify the data subjects within three months from the date of being provided with their personal information, or at least once a year counting from the date of the consent: <Amended on Sep. 12, 2023>

1. A method by which a data subject can easily confirm the details of notification, such as in writing, electronic mail, telephone, or text message;

2. Giving notification in the course of providing goods or services through a notification window so that the data subjects can easily recognize the relevant matters.

(3) A personal information controller may give the following notices simultaneously: <Amended on Feb. 25, 2025>

1. Notification of sources, etc. of personal information collected under Article 20 (2) of the Act;

2. Notification of details of use and provision of personal information under Article 20-2 (1) of the Act;

3. Notification of details of transmission of information subject to request for transmission under the main clause of Article 42-6 (10).

(4) A personal information controller specified in any subparagraph of paragraph (1) who has made notification under paragraph (2) shall retain and manage the following matters until the relevant personal information is destroyed pursuant to Article 21 or 37 (5) of the Act: <Amended on Sep. 12, 2023>

1. The fact that data subjects are notified;

2. When notification is made;

3. How notification is made.

[This Article Added on Sep. 29, 2016]

[Title Amended on Sep. 12, 2023]

Article 15-3(Notification of details of use and provision of personal information) #

(1) "Personal information controller who meets the criteria prescribed by Presidential Decree" in the main clause of Article 20-2 (1) of the Act means any of the following personal information controllers; in such cases, the number of data subjects prescribed in the following subparagraphs shall be calculated based on the daily average during the immediately preceding three months as of the end of the previous year:

1. A person who processes sensitive information or personally identifiable information of at least 50 thousand data subjects;

2. A person who processes personal information of at least one million data subjects.

(2) A data subject to be given notification under Article 20-2 (1) of the Act shall be a data subject except the following:

1. A data subject who expresses his or her intention to refuse notification;

2. Where a personal information controller processes the personal information of executive officers and employees under his or her control to perform his or her work, the relevant data subject;

3. Where a personal information controller processes the personal information of executive officers or employees of other public institutions, corporations, or organizations or individuals, including their contact information, to perform his or her work, the relevant data subject;

4. A data subject of personal information that is used or provided under provisions otherwise provided in statutes or for the purpose of complying with legal obligations;

5. A data subject of personal information that is used or provided by public institutions for the purpose of performing their work prescribed in statutes, regulations, etc.

(3) Information to be notified to data subjects under Article 20-2 (1) of the Act shall be as follows:

1. The purpose of collecting and using personal information and the particulars of the personal information collected and used;

2. A third party provided with personal information, the purpose of providing the personal information, and the particulars of the personal information provided; provided, excluded herefrom shall be information provided under Articles 13, 13-2, and 13-4 of the Protection of Communications Secrets Act and Article 83 (3) of the Telecommunications Business Act.

(4) Notification under Article 20-2 (1) of the Act shall be given at least once a year by any of the following methods:

1. A method by which a data subject can easily confirm the details of notification, such as in writing, electronic mail, telephone, or text message;

2. Giving notification in the course of providing goods or services through a notification window so that a data subject can easily recognize the relevant details (limited to where notification is given regarding the methods of accessing the information system through which the details of the use and provision of personal information are confirmed under Article 20-2 (1) of the Act).

[This Article Added on Sep. 12, 2023]

Article 17(Methods of obtaining consent) #

(1) A personal information controller shall meet all of the following requirements when obtaining consent from a data subject to the processing of his or her personal information pursuant to Article 22 of the Act: <Added on Sep. 12, 2023>

1. The data subject shall be able to decide whether to give his or her consent based on his or her free will;

2. Details requiring the consent of the data subject shall be specific and clear;

3. The personal information controller shall use phrases that are easily readable and understandable for the relevant details;

4. The personal information controller shall provide the data subject with the methods of clearly indicating whether to give consent.

(2) A personal information controller shall obtain consent from a data subject to the processing of his or her personal information pursuant to Article 22 of the Act by any of the following methods: <Amended on Sep. 12, 2023>

1. To issue a document stating the matters requiring consent, either in person or by mail or facsimile, to the data subject, and obtain a written consent on which the data subject has affixed his or her signature or seal;

2. To inform the data subject of the matters requiring consent, and confirm his or her intent of consent by telephone;

3. To inform the data subject of the matters requiring consent by telephone, have the data subject confirm the matters requiring his or her consent posted on a designated website, etc.; and reconfirm his or her intent of consent by telephone;

4. To post the matters requiring consent on a designated website, etc., and have the data subject express his or her consent thereto;

5. To send an electronic mail containing the matters requiring consent to the data subject, and receiving an e-mail indicating his or her consent thereto;

6. Other methods to inform the data subject of the matters requiring consent by a method similar to those referred to in subparagraphs 1 through 5 and confirm his or her intent of consent.

(3) "Important matters prescribed by Presidential Decree" in Article 22 (2) of the Act means the following: <Added on Oct. 17, 2017; Sep. 12, 2023>

1. The fact that a data subject may be contacted to promote goods or services or solicit purchase thereof using the data subject’s personal information with respect to the purpose of collecting and using personal information;

2. The following matters with respect to the particulars of personal information to be processed:

(a) Sensitive information;

(b) Passport numbers, driver’s license numbers, and alien registration numbers as set forth in subparagraphs 2 through 4 of Article 19;

3. The period for retaining and using personal information (in the case of provision, meaning the period for retaining and using personal information by the recipient);

4. The recipient of personal information and the purpose for which the recipient of the personal information uses such information.

(4) Where a personal information controller intends to obtain consent from a data subject under the subparagraphs of Article 22 (1) of the Act, he or she shall clearly indicate the fact that the data subject may choose whether to give consent. <Amended on Sep. 12, 2023>

(5) "Means prescribed by Presidential Decree" in the former part of Article 22 (3) of the Act means in writing, or by electronic mail, facsimile, telephone, or text message, or any other means equivalent thereto (hereinafter referred to as "in writing, etc."). <Amended on Sep. 12, 2023>

(6) The head of a central administrative agency may establish the standards for appropriate methods of obtaining consent, out of the various methods of consent stated in paragraph (2), through the personal information protection guidelines under Article 12 (2) of the Act (hereinafter referred to as "personal information protection guidelines"), in consideration of the work of each personal information controller under his or her jurisdiction, the characteristics of their business, the number of data subjects, etc., and may encourage personal information controllers to obtain consent in accordance with such standards. <Added on Dec. 30, 2015; Oct. 17, 2017; Sep. 12, 2023>

Article 17-2(Protection of children's personal information) #

(1) A personal information controller shall confirm whether a legal representative has granted consent pursuant to Article 22-2 (1) of the Act by any of the following methods:

1. Requesting the legal representative to indicate whether to give consent on the website where matters requiring consent are posted, and informing him or her by mobile phone text message that the personal information controller confirms the indication of the consent;

2. Requesting the legal representative to indicate whether to give consent on the website where matters requiring consent are posted, and being provided with information on his or her card, such as a credit card or debit card;

3. Requesting the legal representative to indicate whether to give consent on the website where matters requiring consent are posted, and verifying the identity of the legal representative through identity verification on his or her mobile phone;

4. Issuing the legal representative a document specifying matters requiring consent, either in person or by mail or fax, and requesting him or her to submit the document after signing and affixing seal on it with respect to such matters;

5. Sending the legal representative an electronic mail that specifies matters requiring consent, and requesting him or her to send an electronic mail with consent indicated;

6. Notifying the legal representative of matters requiring consent by telephone to obtain consent, or providing him or her with information on the methods of confirming matters requiring consent, such as via the Internet address, to obtain consent by telephone;

7. Other methods equivalent to those prescribed in subparagraphs 1 through 6 by which matters requiring consent are notified to the legal representative and an indication of his or her consent is confirmed.

(2) "Information prescribed by Presidential Decree" in Article 22-2 (2) of the Act means information on the name and contact details of a legal representative.

(3) Where it is impracticable for a personal information controller to indicate all matters requiring consent due to the characteristics of a medium by which personal information is collected, the personal information controller may provide a legal representative with information on the methods of confirming matters requiring consent, such as the Internet address or the telephone number of the place of business.

[This Article Added on Sep. 12, 2023]

Article 21(Measures to ensure safety of personally identifiable information) #

(1) Article 30 shall apply mutatis mutandis to measures to ensure the safety of personally identifiable information under Article 24 (3) of the Act. In such cases, "Article 29 of the Act" shall be construed as "Article 24 (3) of the Act"; and "personal information" as "personally identifiable information", respectively. <Amended on Aug. 4, 2020; Sep. 12, 2023>

(2) "Personal information controller" who meets the standards prescribed by Presidential Decree in Article 24 (4) of the Act means any of the following personal information controllers: <Amended on Mar. 12, 2024>

1. A public institution that processes personally identifiable information of at least 10,000 data subjects;

2. A public institution which the Protection Commission deems it necessary to conduct an investigation under Article 24 (4) of the Act in consideration of the history of violations of the Act, the details and degree of violation, the risk of processing personally identifiable information, etc.;

3. A person, other than a public institution, who processes personally identifiable information on at least 50,000 data subjects.

(3) The Protection Commission shall investigate whether a personal information controller falling under any subparagraph of paragraph (2) has taken measures necessary to ensure safety pursuant to Article 24 (4) of the Act at least once every three years. <Amended on Jul. 26, 2017; Aug. 4, 2020; Mar. 12, 2024>

(4) Inspection of measures to ensure the safety of personally identifiable information has been conducted in any of the following cases, an investigation under paragraph (3) shall be deemed to have been conducted. <Added on Mar. 12, 2024>

1. Where the evaluation of the level of personal information protection has been conducted pursuant to Article 11-2 of the Act;

2. Where personal information protection is certified pursuant to Article 32-2 of the Act;

3. Where a regular inspection is conducted on whether measures to ensure the safety of personally identifiable information have been implemented under other Acts, such as a regular evaluation of the status of utilization and management of personal credit information under Article 45-5 of the Credit Information Use and Protection Act, and where the Protection Commission deems that the relevant inspection is equivalent to an investigation under paragraph (3) at the request of the head of the relevant central administrative agency.

(5) The investigation under paragraph (3) shall be conducted by requiring a personal information controller falling under any subparagraph of paragraph (2) to submit necessary materials online or in writing. <Amended on Mar. 12, 2024>

(6) "Specialized Institution prescribed by Presidential Decree” in Article 24 (5) of the Act means any of the following institutions: <Amended on Jul. 26, 2017; Aug. 4, 2020; Mar. 12, 2024>

1. The Korea Internet and Security Agency established under Article 52 of the Act on Promotion of Information and Communications Network Utilization and Information Protection. (hereinafter referred to as the "Korea Internet and Security Agency");

2. A corporation, organization, or institution determined and publicly notified by the Protection Commission as deemed to have technical and financial capacity and equipment to conduct the inspection pursuant to Article 24 (4) of the Act.

[This Article Wholly Amended on Sep. 29, 2016]

Article 24(Posting of notice on signboard) #

(1) A person who installs and operates fixed visual data processing devices pursuant to Article 25 (1) of the Act (hereinafter referred to as "fixed visual data processing device operator") shall post the matters referred to in the subparagraphs of Article 25 (4) of the Act on a signboard so that data subjects may easily recognize that such devices have been installed and in operation; provided, a signboard, indicating the operation of fixed visual data processing devices in the pertinent facilities and whole area, may be posted at the entry and other easily noticeable place where several fixed visual data processing devices are installed in a building: <Amended on Sep. 29, 2016; Sep. 12, 2023>

1. Deleted; <Sep. 29, 2016>

2. Deleted; <Sep. 29, 2016>

3. Deleted. <Sep. 29, 2016>

(2) Notwithstanding paragraph (1), where any of the following applies to a fixed visual data processing device installed and operated by a fixed visual data processing device operator, the operator may post the matters referred to in the subparagraphs of Article 25 (4) of the Act on its website, in lieu of posting them on the signboard: <Amended on Sep. 29, 2016; Sep. 12, 2023>

1. Where the fixed visual data processing device is installed by a public institution for such purposes as long range photographing, over-speed and traffic signal violation enforcement service, or traffic flow survey, while the possibility of a personal information breach is significantly low;

2. Where a signboard cannot be posted because of the characteristics of the location or is not easily noticeable by data subjects even if posted, e.g., a fixed visual data processing device installed for surveillance of mountain fire.

(3) If the matters referred to in the subparagraphs of Article 25 (4) of the Act cannot be posted on a website under paragraph (2), a fixed visual data processing device operator shall make public the said matters in one or more of the following methods: <Amended on Sep. 29, 2016; Aug. 2020; Sep. 12, 2023>

1. Posting at easily noticeable places of the fixed visual data processing device operator’s workplace, business premise, office, shop, etc. (hereinafter referred to as "workplace, etc.");

2. Publishing them in the Official Gazette (only where the fixed visual data processing device operator is a public institution) or a general daily newspaper, weekly newspaper or online newspaper, as defined in subparagraph 1 (a) and (c), or 2 of Article 2 of the Act on the Promotion of Newspapers circulating mainly over the Special Metropolitan City, Metropolitan City, Do, or Special Self-Governing Province (hereinafter referred to as "City/ Do") where the fixed visual data processing device operator’s workplace is located.

(4) "Facilities prescribed by Presidential Decree" in the proviso, with the exception of the subparagraphs, of Article 25 (4) of the Act means the national security facilities provided for in Article 32 of the Regulations on Security Work. <Amended on Sep. 29, 2016>

Article 28(Measures to be taken when entrusting personal information processing) #

(1) "Matters prescribed by Presidential Decree" in Article 26 (1) 3 of the Act means the following:

1. The purpose and scope of entrusted work;

2. Matters concerning limitation to re-entrustment;

3. Matters concerning measures to ensure safety, including limitation to access to personal information;

4. Matters concerning supervision and inspection of the status of management of personal information retained in relation to entrusted work;

5. Matters concerning liability, such as compensation for damages caused by a breach of contractual obligations on the part of a person entrusted under Article 26 (2) of the Act (hereinafter referred to as "person entrusted").

(2) "Manner prescribed by Presidential Decree" in Article 26 (2) of the Act means the method wherein a personal information controller that has entrusted personal information processing (hereinafter referred to as "person entrusting") continuously posts details of the entrusted work and the person entrusted on its website.

(3) Where it is impossible to post on the website as prescribed in paragraph (2), the entrusted work and the person entrusted shall make public in one or more of the following manners: <Amended on Sep. 12, 2023>

1. Posting at easily noticeable places such as workplace of a person entrusting;

2. Publishing in the Official Gazette (only where the person entrusting is a public institution) or a general daily newspaper, weekly newspaper, or online newspaper, as defined in subparagraphs 1 (a) and (c) and 2 of Article 2 of the Act on the Promotion of Newspapers which mainly covers the City/Do where the person entrusting’s workplace, etc. is located;

3. Publishing at a periodical, newsletter, PR magazine, or invoice to be published under the same title at least twice a year and distributed to data subjects on a continual basis;

4. Stipulating in an agreement, etc. for the supply of goods and services executed between the person entrusting and the data subjects and providing a copy of the same to the data subjects.

(4) "Manners prescribed by Presidential Decree" in the former part of Article 26 (3) of the Act means in writing, etc. <Amended on Sep. 12, 2023>

(5) Where a person entrusting is unable to inform the data subjects of the entrusted work and the person entrusted in the manner stated in paragraph (4) without its negligence, the person entrusting shall post the relevant matters on its website for at least 30 days; provided, a person entrusting who has no website shall post them at easily noticeable places of its workplace, etc. for at least 30 days.

(6) Where a person entrusted processes personal information, the person entrusting shall supervise whether the person entrusting complies with the obligations of a personal information controller provided for in the Act and this Decree and the matters referred to in Article 26 (1) of the Act, pursuant to Article 26 (4) of the Act.

Article 29-2(Designation and cancellation of designation of expert data combination agency) #

(1) The standards for the designation of an expert agency (hereinafter referred to as "Expert Data Combination Agency") pursuant to Article 28-3 (1) of the Act shall be as follows: <Amended on Feb. 25, 2025>

1. The agency shall have formed an organization responsible for the combination and release of pseudonymized information and employed at least three full-time personnel with qualifications or experience relating to personal information protection, as determined and publicly notified by the Protection Commission;

2. The agency shall have set up space, facilities and equipment necessary to combine pseudonymized information safely and prepared policies and procedures relating to the combination and release of pseudonymized information, as determined and publicly notified by the Protection Commission;

3. The agency shall have financial capabilities in compliance with the standards determined and publicly notified by the Protection Commission;

4. The relevant agency shall not have been subject to public announcement pursuant to Article 66 (1) of the Act nor been ordered to make a public announcement under Article 66 (2) within the last 3 years;

5. The agency shall not have failed to obtain re-designation after applying for an extension of the effective period under paragraph (4) and shall not have had its designation revoked pursuant to paragraph (5) within the last 1 year.

(2) Any corporation, organization, or institution intending to be designated as an Expert Data Combination Agency pursuant to Article 28-3 (1) of the Act shall submit to the head of the Protection Commission or the related central administrative agency an application for the Designation of Expert Data Combination Agency determined and publicly notified by the Protection Commission with the following documents attached (including electronic documents; the same shall apply hereinafter):

1. Articles of incorporation or bylaws;

2. Documents prescribed and notified by the Protection Commission supporting that the agency satisfies the designation standards under paragraph (1).

(3) The head of the Protection Commission or related central administrative agency may designate the corporation, organization, or institution which submitted the application for the Designation of Expert Data Combination Agency under paragraph (2) as an Expert Data Combination Agency if it satisfies the designation standards under paragraph (1).

(4) Designation as an Expert Data Combination Agency shall be effective for 3 years from the date of designation, and if the Expert Data Combination Agency requests extension of the effective period, the head of the Protection Commission or the relevant central administrative agency may re-designate it as an Expert Data Combination Agency after reviewing the following matters: <Amended on Feb. 25, 2025>

1. Whether it meets the standards for designation under paragraph (1);

2. Whether the future business performance plan is suitable for achieving the purpose of designation;

3. Whether it has properly performed its business affairs according to the purpose of designation;

4. Whether it has unduly restricted data combinations, such as by charging excessive fees under Article 29(3) 5.

(5) If the Expert Data Combination Agency falls under any of the following, the head of the Protection Commission or related central administrative agency may cancel the designation of the Expert Data Combination Agency; provided, in the cases of subparagraph 1 or 2, designation shall be canceled:

1. If the agency has received the designation by fraud or improper means;

2. If the agency voluntarily requests cancellation of its designation or discontinues its business;

3. If the agency becomes non-compliant with the standards for designation of an Expert Data Combination Agency under paragraph (1);

4. If a personal information breach incident, including divulgence of information, occurs in connection with data combination, release, etc.;

5. If the agency otherwise violates any obligation under the Act or this Decree.

(6) The head of the Protection Commission or related central administrative agency shall hold a hearing when seeking to cancel the designation of an Expert Data Combination Agency in accordance with paragraph (5).

(7) The head of the Protection Commission or related central administrative agency shall publicly announce any designation, re-designation or cancellation of designation of an Expert Data Combination Agency in the Official Gazette or the websites of the Protection Commission or related central administrative agency. In such cases, if the head of the related central administrative agency designated, re-designated, or canceled the designation of any Expert Data Combination Agency, the head of the central administrative agency shall notify the Protection Commission of the same.

(8) Except as provided in paragraphs (1) through (7), matters necessary in connection with the designation, re-designation and cancellation of designation of an Expert Data Combination Agency shall be determined and publicly notified by the Protection Commission.

[This Article Added on Aug. 4, 2020]

Article 29-3(Combination and release of pseudonymized information processed by different personal information controllers) #

(1) Any personal information controller intending to request an Expert Data Combination Agency to combine pseudonymized information (hereinafter referred to as "Applicant") shall submit the data combination request in the form determined and publicly notified by the Protection Commission, together with the following documents, to the relevant Expert Data Combination Agency:

1. Documents related to the Applicant such as business registration certificate, certified copy of register of corporation, etc.;

2. Documents related to the pseudonymized information for combination;

3. Documents proving the purpose of combination;

4. Other documents determined and publicly notified by the Protection Commission’s notification as necessary for combining and releasing pseudonymized information.

(2) Any Expert Data Combination Agency intending to combine pseudonymized information under Article 28-3 (1) of the Act shall make sure that the combined information does not identify a particular individual. In such cases, the Protection Commission may make the Korea Internet and Security Agency or other agencies designated and publicly notified by the Protection Commission assist with relevant work necessary to make a particular individual unidentifiable.

(3) The Applicant that intends to take the information which was combined by the Expert Data Combination Agency pursuant to Article 28-3 (2) of the Act out of the Expert Data Combination Agency shall pseudonymize or otherwise process the information combined pursuant to paragraph (2) as the information under Article 58-2 of the Act at a place which was established within the Expert Data Combination Agency and underwent the necessary technical, managerial and physical measures required to ensure safety and receive permission therefor from the Expert Data Combination Agency.

(4) The Expert Data Combination Agency shall permit the release pursuant to Article 28-3 (2), if each of the following standards are met. In such cases, the Expert Data Combination Agency shall form a Release Review Committee to grant permission for release of combined information:

1. There is a relationship between the purpose of combination and the released information;

2. It is not possible to identify any particular individual using such information;

3. A security plan is established with regard to the released information.

(5) The Expert Data Combination Agency may charge the Applicant for the costs necessary for the combination, release, etc. of information.

(6) Except as provided in paragraphs (1) through (5), the procedures and methods of combining pseudonymized information, release of combined information and permission therefor, shall be determined and publicly notified by the Protection Commission.

[This Article Added on Aug. 4, 2020]

Article 29-9(Recognition of countries' personal information protection levels) #

(1) If the Protection Commission intends to recognize that a country or an international organization (hereinafter referred to as "recipient country, etc.") where personal information is provided (including inquired), processed under entrustment, or stored (hereafter in this Chapter referred to as "transfer") under Article 28-8 (1) 5 of the Act has a personal information protection system, the scope of guarantee of the rights of data subjects, the procedures for damage relief, etc. at a level substantially equal to the level of personal information protection under this Act, it shall comprehensively take into account the following matters:

1. Whether the personal information protection system of the recipient country, etc., including its statutes, regulations, and rules, is in conformity with the principles of information protection under Article 3 of the Act and guarantees the rights of data subjects under Article 4 of the Act;

2. Whether the recipient country, etc. has an independent supervisory authority responsible for guaranteeing and implementing the personal information protection system;

3. Whether the public institutions (including institutions that conduct business affairs similar to those of public institutions) of the recipient country, etc. process personal information under statutes and whether means to protect data subjects, such as the procedures for damage relief, exist and are effectively guaranteed;

4. Whether the recipient country, etc. has the procedures for damage relief that are easily available to data subjects and whether such procedures effectively protect data subjects;

5. Whether the supervisory authority of the recipient country, etc. is able to facilitate mutual cooperation with the Protection Commission in protecting the rights of data subjects;

6. Other matters determined and publicly notified by the Protection Commission as necessary to recognize the personal information protection level of the recipient country, etc., such as the personal information protection system, the scope of guarantee of the rights of data subjects, the procedures for damage relief.

(2) If the Protection Commission intends to grant recognition under paragraph (1), it shall follow the following procedures:

1. Evaluation by an expert committee for cross-border transfer;

2. Consultation with the Policy Council.

(3) If necessary for the protection of the rights of data subjects, etc., the Protection Commission may, when granting recognition under paragraph (1), determine the scope of the personal information to be transferred to a recipient country, etc., the scope of the personal information controllers to which personal information is transferred, the recognition period, the conditions of cross-border transfer, and other relevant matters differently for each recipient country, etc.

(4) Upon granting recognition under paragraph (1), the Protection Commission shall examine whether a recipient country, etc. maintains its personal information protection level that is substantially equal to the level under this Act.

(5) Where any change is made to the personal information system, the scope of guarantee of the rights of data subjects, the procedures for damage relief, etc. of a recipient country, etc. that are recognized under paragraph (1), the Protection Commission may revoke the recognition of the recipient country, etc. or change the details of the recognition, after hearing its opinions.

(6) Where the Protection Commission grants recognition under paragraph (1) or revokes such recognition or changes the details thereof under paragraph (5), it shall give public notice of such fact in the Official Gazette and publish it on its website.

(7) Except as provided in paragraphs (1) through (6), matters necessary for the recognition of a recipient country, etc. shall be determined and publicly notified by the Protection Commission.

[This Article Added on Sep. 12, 2023]

Article 29-11(Standards for orders to suspend cross-border transfers) #

(1) Where the Protection Commission orders the suspension of cross-border transfers of personal information under Article 28-9 (1) of the Act, it shall comprehensively consider the following matters:

1. The type and scale of personal information, the cross-border transfer of which has been made or any further cross-border transfer of which is expected;

2. The severity of a violation of Article 28-8 (1), (4), or (5) of the Act;

3. Whether any damage that occurs or is likely to occur to data subjects is material or irrecoverable;

4. Whether ordering the suspension of cross-border transfers obviously brings more benefits to data subjects than not doing so;

5. Whether it is possible to protect personal information and to prevent personal information breach with the measures taken under the subparagraphs of Article 64 (1) of the Act;

6. Whether the recipient of personal information or the recipient country, etc. to which personal information is transferred has effective means of relieving damage suffered by data subjects;

7. Whether there is any reason to deem that it is difficult to adequately protect personal information, such as that the recipient of personal information or the recipient country, etc. to which personal information is transferred suffers a serious personal information breach.

(2) If the Protection Commission orders the suspension of cross-border transfers of personal information under Article 28-9 (1) of the Act, it shall undergo the evaluation by the expert committee for cross-border transfer.

(3) When the Protection Commission orders the suspension of cross-border transfers of personal information pursuant to Article 28-9 (1) of the Act, it shall notify in writing the relevant personal information controller of the details of and the grounds for such order, the procedures and methods for filing objections, and other necessary matters.

(4) Except as provided in paragraphs (1) through (3), matters necessary for the standards, etc. for orders to suspend cross-border transfers of personal information shall be determined and publicly notified by the Protection Commission.

[This Article Added on Sep. 12, 2023]

Article 30(Measures to ensure safety of personal information) #

(1) Each personal information controller shall take the following measures to ensure safety pursuant to Article 29 of the Act: <Amended on Sep. 12, 2023>

1. Formulating, implementing, and examining an internal management plan that includes the following to safely process personal information:

(a) Matters regarding the management, supervision, and education of a personal information handler under Article 28 (1) of the Act (hereinafter referred to as "personal information handler");

(b) Matters regarding the composition and operation of an organization responsible for protecting personal information, including the designation of privacy officers, under Article 31 of the Act;

2. The following measures to restrict access authority to personal information:

(a) Establishing and implementing the standards for granting, changing, or canceling access authority to a system systematically designed to process personal information including a database system (hereinafter referred to as "personal information processing system");

(b) Establishing and operating the standards for applying authentication means necessary to verify whether access is made by a person with legitimate authority;

3. The following measures to control access to personal information:

(a) Measures necessary to detect and block intrusions into a personal information processing system;

(b) Blocking Internet access to and from computers satisfying the standards determined and publicly notified by the Protection Commission, such as the computers of personal information handlers accessing a personal information processing system; provided, this shall apply only to a personal information controller with an average of at least one million daily users defined in Article 2 (1) 4 of the Act on Promotion of Information and Communications Network Utilization and Information Protection whose personal information is stored and managed for the immediately preceding three months as of the end of the previous year;

4. The following measures necessary to safely store and transmit personal information:

(a) Storing encrypted authentication information, including the storage of one-way encrypted passwords, or other measures equivalent thereto;

(b) Encrypting information determined and publicly notified by the Protection Commission for storage, including resident registration numbers, or other measures equivalent thereto;

(c) Where the personal information or authentication information of data subjects is transmitted or received through the information and communications network defined in Article 2 (1) 1 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, encrypting the relevant information or other measures equivalent thereto;

(d) Other measures to ensure security using encryption or other technologies equivalent thereto;

5. The following measures to retain the records of access and prevent such records from being forged or altered in case of a personal information breach incident:

(a) Storing, inspecting, confirming, and supervising the records of access, such as the date and time when persons access a personal information processing system, and the details of processing personal information;

(b) Safely storing the records of access to a personal information processing system;

6. Installing, operating, and periodically updating and inspecting programs that can detect at all times whether any malicious program, such as a computer virus, spyware, and ransomware, intrudes into a personal information processing system and an information technology equipment used by personal information handlers for processing personal information and that can delete such malicious program;

7. Preparing storage facilities and installing locking devices to safely store personal information, or taking other physical measures;

8. Other measures necessary to ensure safety of personal information.

(2) The Protection Commission may provide necessary assistance, such as building a system with which personal information controllers can take the measures to ensure safety pursuant to paragraph (1). <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Aug. 4. 2020>

(3) Detailed standards for the measures to ensure safety under paragraph (1) shall be determined and publicly notified by the Protection Commission. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Aug. 4, 2020>

Article 30-2(Measures to ensure safety of personal information taken by institutions operating public systems) #

(1) Pursuant to Article 29 of the Act, a public institution that operates a personal information processing system that meets the standards publicly notified by the Protection Commission (hereinafter referred to as "public system operating institution"), such as the scale of personal information processing and the number of persons handling personal information with access authority, shall additionally take the following measures in addition to measures to ensure safety under Article 30 of this Decree: <Amended on Mar. 12, 2024>

1. Including measures to ensure safety prepared for each public system in an internal management plan under Article 30 (1) 1;

2. Measures necessary to safely manage access authority, such as allowing an institution that accesses a public system to process personal information (hereafter in this Article referred to as "institution using public systems") to grant access authority to a personal information handler with legitimate authority and to change and cancel such authority;

3. Measures such as storage, analysis, inspection, and management of the records of access to public systems to prevent illegal access to personal information and personal information breach incidents.

(2) Where an institution operating public systems or an institution using public systems finds out access to personal information without authority or beyond authorized access thereto, it shall without delay notify data subjects of the relevant fact and matters necessary for the prevention of any damage, etc.; in such cases, notification shall be deemed given in any of the following cases:

1. Where data subjects are notified of loss, theft, or divulgence of personal information under Article 34 (1) of the Act;

2. Where data subjects are notified of access to their personal information and matters necessary for the prevention of any damage, etc. pursuant to other statutes or regulations.

(3) An institution operating public systems (where there is a separate public institution that develops and distributes a public system, such public institution shall be included; hereafter in this Article, the same shall apply) shall designate and operate a department dedicated to work related to the safe management of personal information or shall assign personnel dedicated to such work, taking into account the size and characteristics of the relevant public system, the number of institutions using the relevant public system, and other relevant factors.

(4) An institution operating public systems shall designate the head of a department responsible for the general management of the relevant public system as a manager for each public system; provided, where there is no such department, it shall designate a manager from among the heads of relevant departments in consideration of work-relatedness, work capabilities, and other relevant factors.

(5) An institution operating public systems shall establish and operate a public system operation council comprised of the following institutions for each public system to consult on matters related to examining the implementation of measures to ensure the safety of public systems and improving such systems; provided, where one public institution operates at least two public systems, an integrated public system operation council may be established and operated:

1. The institution operating public systems;

2. Where the operation of public systems is entrusted, the person entrusted;

3. An institution using public systems deemed necessary by the institution operating public systems.

(6) The Protection Commission may provide institutions operating public systems with support necessary to implement measures to ensure the safety of personal information.

(7) Except as provided in paragraphs (1) through (6), matters necessary for the measures to ensure the safety of personal information taken by institutions operating public systems, etc. shall be determined and publicly notified by the Protection Commission.

[This Article Added on Sep. 12, 2023]

Article 31(Details of privacy policy and methods for disclosure thereof) #

(1) "Matters prescribed by Presidential Decree" in Article 30 (1) 8 of the Act means the following: <Amended on Sep. 29, 2016; Aug. 4, 2020; Sep. 12, 2023; Mar. 12, 2024>

1. Particulars of personal information to be processed;

2. Where personal information is transferred to a foreign country pursuant to each subparagraph of Article 28-8 (1) of the Act, the grounds for transferring personal information to a foreign country and the matters referred to in each subparagraph of paragraph (2) of the same Article;

3. Matters regarding measures to ensure the safety of personal information under Article 30;

4. Where the personal information of a domestic data subject is directly collected and processed from a foreign country, the name of the country in which the personal information is processed.

(2) A personal information controller shall post continuously the Privacy Policy established or modified pursuant to Article 30 (2) of the Act on its website.

(3) Where it is impossible to post the Privacy Policy on the website as prescribed in paragraph (2), the personal information controller shall make public the established or modified Privacy Policy in at least one of the following manners: <Amended on Sep. 12, 2023>

1. Posting at easily noticeable location of the personal information controller’s workplace, etc.;

2. Publishing in the Official Gazette (only in cases the personal information controller is a public institution) or general daily newspaper, weekly newspaper, or online newspaper, as defined in subparagraphs 1 (a) and (c) and 2 of Article 2 of the Act on the Promotion of Newspapers circulating mainly over the City/Do where the personal information controller’s workplace, etc. is located;

3. Publishing at a periodical, newsletter, PR magazine, or invoice to be published under the same title at least twice a year and distributed to data subjects on a continual basis;

4. Stipulating in an agreement, etc. for the supply of goods or services executed between the personal information controller and the data subjects and providing a copy of the same to the data subject.

Article 32(Work of privacy officer and requirements for designation) #

(1) "Personal information controller whose number of employees, turnover, etc. meet the criteria prescribed by Presidential Decree" in terms of the number of employees, sales, etc. in the proviso of Article 31 (1) of the Act means a personal information controller who is a micro enterprise defined in Article 2 (1) of the Framework Act on Micro Enterprises. <Added on Mar. 12, 2024>

(2) "Work prescribed by Presidential Decree" in Article 31 (3) 7 of the Act shall be as follows: <Amended on Mar. 12, 2024>

1. To establish, modify, and implement the Privacy Policy pursuant to Article 30 of the Act;

2. Management of human and physical resources and information related to personal information processing;

3. To destroy personal information whose purpose of processing is attained or retention period expires.

(3) Where a personal information controller intends to designate a person in charge of personal information protection pursuant to Article 31 (1) of the Act, he or she shall designate the person according to the following classifications: <Amended on Jul. 22, 2016; Mar. 12, 2024>

1. Public institutions: Public officials, etc. who satisfy the below standards:

(a) The administrative bodies of the National Assembly, the Court, the Constitutional Court, and the National Election Commission; and central administrative agencies: A member of the Senior Executive Service (hereinafter referred to as "senior executive") or equivalent public official;

(b) Other national agencies than item (a), headed by a public official in political service: A public official of Grade III or higher (including a senior executive) or equivalent thereto;

(c) Other national agencies than items (a) and (b), headed by a senior executive, a Grade III or higher public official, or an equivalent public official: A public official of Grade IV or higher or equivalent thereto;

(d) Other national agencies than items (a) through (c) (including their affiliated bodies): The head of a department in charge of the work related to personal information processing in the relevant agency;

(e) City/Do, City/Do Offices of Education: A public official of Grade III or higher or equivalent thereto;

(f) Si/Gun/autonomous Gu: A public official of Grade IV or higher or a public official equivalent thereto;

(g) Schools of various levels under subparagraph 5 of Article 2: A person who exercises overall control over the administrative affairs of the relevant school; provided, in cases falling under paragraph (4) 2, it means teachers and staff;

(h) Other public institutions than items (a) through (g): The head of a department in charge of the work related to personal information processing in the relevant institution; provided,, where the heads of at least two departments are in charge of the work related to personal information processing, the head of the relevant institution shall designate the privacy officer from among them;

2. An institution other than public institutions: Any of the following persons:

(a) The business owner or representative;

(b) An executive officer (or the head of a department in charge of the work related to personal information processing, if no executive officer exists).

(4) Any of the following personal information controllers (limited to cases falling under subparagraphs 2 through 5 of Article 2 in cases of public institutions) shall designate a person who meets the requirements prescribed in Appendix 1, from among persons classified in the subparagraphs of paragraph (3), as a person in charge of protecting personal information: <Amended on Mar. 12, 2024>

1. Any of the following persons (excluding schools of various levels defined in subparagraph 5 of Article 2 and medical institutions defined in Article 3 of the Medical Service Act) whose annual sales, etc. are at least 150 billion won:

(a) A person who processes sensitive information or personally identifiable information concerning at least 50,000 data subjects;

(b) A person who processes personal information of at least one million data subjects;

2. The School under Article 2 of the Higher Education Act, the number of enrolled students (including the number of enrolled students at a graduate school) of which is at least 20,000 as of Dec. 31 of the immediately preceding year;

3. High-tier general care hospitals under Article 3-4 of the Medical Service Act;

4. Institutions operating public systems.

(5) The Protection Commission may provide support, such as the establishment and operation of educational courses for persons in charge of personal information protection so that the person in charge of personal information protection can smoothly perform the duties prescribed in Article 31 (3) of the Act. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Aug. 4, 2020; Mar. 12, 2024>

(6) A personal information controller (excluding where a business owner or representative becomes a person in charge of protection of personal information pursuant to Article 31 (2) of the Act) shall comply with the following to ensure the independence of the person in charge of personal information protection under Article 31 (6) of the Act: <Added on Mar. 12, 2024>

1. Protecting personal information protection officer's access to information related to personal information processing;

2. Establishment of a system in which a person in charge of personal information protection may regularly report the establishment and implementation of a personal information protection plan and the results thereof to the representative or the board of directors on a regular basis;

3. Preparation of an organizational system suitable for persons in charge of personal information protection to perform their duties and provision of human and material resources.

Article 34-2(Criteria, method, and procedure for certification of personal information protection) #

(1) The Protection Commission shall determine and publicly notify the criteria for certification referred to in Article 32-2 (1) of the Act, including the establishment of managerial, technical, and physical safeguards to protect personal information, taking into account the matters provided in the subparagraphs of Article 30 (1). <Amended on Jul. 26, 2017; Aug. 4, 2020; Sep. 12, 2023>

(2) A person who intends to obtain certification of personal information protection pursuant to Article 32-2 (1) of the Act (hereafter in this Article and Article 34-3, referred to as "applicant"), shall submit an application (including an electronic application) for certification of personal information protection which includes the following matters to an institution specializing in the certification of personal information protection referred to in Article 34-6 (hereinafter referred to as "certification institution"): <Amended on Mar. 12, 2024>

1. A list of personal information processing systems subject to certification;

2. Methods and procedures for establishing and operating the personal information management system;

3. A list of documents related to the personal information management system and the implementation of safeguards.

(3) Upon receipt of an application for certification pursuant to paragraph (2), a certification institution shall consult with the applicant regarding the scope, time schedule, etc. of certification.

(4) An examination to certify personal information protection under Article 32-2 (1) of the Act shall be either a paper-based examination or an on-site examination conducted by the certification examiners for personal information protection subject to Article 34-8.

(5) Each certification institution shall establish and operate a certification committee comprised of members with extensive knowledge and experience in information protection to deliberate on the results of examinations for certification conducted pursuant to paragraph (4).

(6) Except as provided in paragraphs (1) through (5), detailed matters necessary for certification of personal information protection, including filing an application for certification, examination for certification, establishment and operation of the certification committee, and issuance of certificates, shall be determined and publicly notified by the Protection Commission. <Amended on Jul. 26, 2017; Aug. 4, 2020>

[This Article Added on Jul. 22, 2016]

Article 36(Designation of assessment institutions and revocation of designation) #

(1) The Protection Commission may designate a corporation that satisfies all of the following requirements as a privacy impact assessment institution (hereinafter referred to as "assessment institution") pursuant to Article 33 (2) of the Act: <Amended on Mar. 23, 2013; Nov. 19, 2014; Dec. 22, 2015; Jul. 26, 2017; Aug. 4, 2020; Sep. 12, 2023>

1. A corporation whose total revenue derived from any of the following work is 200 million won or more during the last five years:

(a) Privacy impact assessments or work similar thereto;

(b) Data protection consulting (which means the analysis and assessment of information systems and the provision of corresponding countermeasures against electronic infringement incidents; hereinafter the same shall apply) among the work related to establishing information systems, as defined in subparagraph 13 of Article 2 of the Electronic Government Act (including the information protection system);

(c) Data protection consulting among the work related to monitoring information systems, as defined in subparagraph 14 of Article 2 of the Electronic Government Act;

(d) Data protection consulting among the work related to the information security industry defined in Article 2 (1) 2 of the Act on the Promotion of the Information Security Industry;

(e) Work prescribed in Article 23 (1) 1 and 2 of the Act on the Promotion of the Information Security Industry;

2. A corporation that employs at least 10 full-time experts who meet the qualification requirements determined and publicly notified by the Protection Commission, including work experience in the field related to privacy impact assessment;

3. A corporation with the following offices and facilities:

(a) An office with facilities for identification and access control;

(b) Facilities for the safe management of records and materials.

(2) A person who intends to be designated as an assessment institution shall file an application for designation as an assessment institution, in the form determined and publicly notified by the Protection Commission, with the Protection Commission, along with the following documents (including electronic documents; hereinafter the same shall apply): <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Oct. 17, 2017; Aug. 4, 2020>

1. The articles of incorporation;

2. The representative’s name;

3. Documents verifying the qualifications of the experts referred to in paragraph (1) 2;

4. Other documents determined and publicly notified by the Protection Commission.

(3) Upon receipt of an application for designation as an assessment institution filed under paragraph (2), the Protection Commission shall verify the following documents through administrative data matching pursuant to Article 36 (1) of the Electronic Government Act; provided, where the applicant does not give consent to the verification of subparagraph 2, the Protection Commission shall require the applicant to submit the relevant document: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Aug. 4, 2020>

1. The corporation registration certificate;

2. The certificate of alien registration issued under Article 88 (2) of the Immigration Act (applicable only to aliens).

(4) Upon designating an assessment institution pursuant to paragraph (1), the Protection Commission shall, without delay, issue a written designation to the relevant applicant, and make a public notice thereof in the Official Gazette. The same shall also apply to any modification of the matters publicly notified: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Aug. 4, 2020>

1. The name, address, and telephone number of the assessment institution, and the name of its representative;

2. Terms and conditions attached to the designation, if any.

(5) "Cases that fall under any ground prescribed by Presidential Decree" in Article 33 (7) 5 of the Act means any of the following cases: <Amended on Sep. 12, 2023>

1. Where an assessment institution fails to comply with the obligation to submit a report under paragraph (6);

2. Where an assessment institution has no records of privacy impact assessment for two consecutive years from the date of obtaining designation without good cause;

3. Where an assessment institution divulges any information that it has obtained in the course of conducting privacy impact assessments, such as a privacy impact assessment report under the provisions, with the exception of the subparagraphs, of Article 38 (2);

4. Other cases where an assessment institution breaches the duties under the Act or this Decree.

(6) An assessment institution designated under paragraph (1) shall, upon occurrence of any of the following events after designation, submit a report to the Protection Commission, as determined and publicly notified by the Protection Commission, within 14 days from the date of occurrence; provided, it shall submit a report to the Protection Commission within 60 days from the date of occurrence in cases falling under subparagraph 3: <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Oct. 17, 2017; Aug. 4, 2020>

1. Where any matter referred to in paragraph (1) is changed;

2. Where any matter referred to in paragraph (4) 1 is changed;

3. Where the transfer, acquisition, or merger of the assessment institution, or similar event occurs.

(7) Deleted. <Sep. 12, 2023>

[Moved from Article 37; previous Article 36 moved to Article 37 <Sep. 12, 2023>]

Article 38(Criteria for privacy impact assessment) #

(1) The criteria for privacy impact assessments (hereinafter referred to as "assessment criteria") under Article 33 (9) of the Act shall be as follows: <Amended on Jul. 22, 2016; Sep. 12, 2023>

1. The type and nature of personal information contained in the relevant personal information files, the number of data subjects, and the possibility of subsequent personal information breach;

2. The level of measures to ensure safety taken under Articles 23 (2), 24 (3), 24-2 (2), 25 (6) (including cases applied mutatis mutandis in Article 25-2 (4)), and 29 of the Act, and the subsequent possibility of personal information breach;

3. Countermeasures against risk factors of personal information breach, if any;

4. Other necessary measures subject to the Act or this Decree, or any factor affecting breach of duties.

(2) An assessment institution requested to conduct a privacy impact assessment under Article 33 (2) of the Act shall, in accordance with the assessment criteria, analyze and assess the risk factors of personal information breaches that result from the operation of personal information files, and shall prepare a privacy impact assessment report based on the results of the evaluation that includes the following and send such report to the head of the relevant public institution, who shall submit the report to the Protection Commission before operating and changing personal information files falling under the subparagraphs of Article 35: <Amended on Sep. 12, 2023>

1. Those subject to the privacy impact assessment and the scope thereof;

2. Fields and items of the evaluation;

3. Analysis and assessment of the risk factors of personal information breaches in accordance with the assessment criteria;

4. The details of measures taken based on the results of the analysis and evaluation under subparagraph 3 and a plan for improvement;

5. The results of the privacy impact assessment;

6. A summary of the matters prescribed in subparagraphs 1 through 5.

(3) The Protection Commission or the head of a public institution may disclose the details of a summary of a privacy impact assessment report prescribed in paragraph (2) 6. <Added on Sep. 12, 2023>

(4) Except as provided in the Act and this Decree, the Protection Commission may determine and publicly notify the detailed standards for designating assessment institutions, procedures for privacy impact assessments, etc. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Aug. 4, 2020; Sep. 12, 2023>

Article 39(Notification of divulgence of personal information) #

(1) When a personal information controller becomes aware of loss, theft, or divulgence (hereafter in this Article and Article 40 referred to as "divulgence, etc.") of personal information, the personal information controller shall notify data subjects of the matters specified in the subparagraphs of Article 34 (1) of the Act in writing, etc. within 72 hours; provided, notification may be given to data subjects without delay after the relevant cause ceases to exist in any of the following cases:

1. Where urgent measures need to be taken to prevent widespread divulgence, etc. of personal information and any further divulgence, etc., such as blocking access routes, inspecting and addressing vulnerabilities, and recovering and deleting the relevant personal information;

2. Where it is impracticable to give notification within 72 hours due to a natural disaster or any other unavoidable cause.

(2) Notwithstanding paragraph (1), where a personal information controller intends to give notification under paragraph (1) but fails to confirm the specific details of the matters prescribed in Article 34 (1) 1 or 2 of the Act, the personal information controller shall first give notification of the divulgence, etc. of personal information, the details that have already been confirmed, and the matters specified in Article 34 (1) 3 through 5 of the Act in writing, etc., and shall notify the details further confirmed immediately upon confirmation. <Amended on Mar. 12, 2024>

(3) Notwithstanding paragraphs (1) and (2), where the contact information of a data subject is unknown or any other good cause exists, a personal information controller shall post the matters provided in the subparagraphs of Article 34 (1) of the Act on its website for at least 30 days to ensure that the data subject can easily recognize such matters, in lieu of giving notification under paragraphs (1) and (2), pursuant to the proviso, with the exception of the subparagraphs, of Article 34 (1) of the Act; provided, in the case of a personal information controller that does not operate its website, the matters specified in the subparagraphs of Article 34 (1) of the Act may be posted at a conspicuous place of the workplace, etc. for at least 30 days in lieu of giving notification under paragraphs (1) and (2).

[This Article Wholly Amended on Sep. 12, 2023]

[Moved from Article 40; previous Article 39 moved to Article 40 <Sep. 12, 2023>]

Article 40(Reporting on divulgence of personal information) #

(1) When a personal information controller becomes aware of divulgence, etc. of personal information in any of the following cases, the personal information controller shall, in writing, etc., file a report with the Protection Commission or a specialized institution prescribed in the former part of Article 34 (3) of the Act with regard to the matters provided in the subparagraphs of Article 34 (1) of the Act within 72 hours; provided, where it is impracticable to file a report within 72 hours due to a natural disaster or any other unavoidable cause, a report may be filed without delay after the relevant cause ceases to exist; and where the possibility of infringing on the rights and interests of data subjects is substantially reduced after the path of divulgence, etc. of personal information is confirmed and measures are taken such as the recovery and deletion of the relevant personal information, the personal information controller need not file a report thereon:

1. Where divulgence, etc. of personal information of at least 1,000 data subjects occurs;

2. Where divulgence, etc. of sensitive information or personally identifiable information occur;

3. Where divulgence, etc. of personal information occurs due to illegal external access to personal information processing systems or information technology equipment used by personal information handlers for processing personal information.

(2) Notwithstanding paragraph (1), where a personal information controller intends to file a report pursuant to paragraph (1) but fails to confirm the specific details of the matters provided in Article 34 (1) 1 or 2 of the Act, the personal information controller shall first file a report on divulgence, etc. of personal information, the details that have already been confirmed, and the matters specified in Article 34 (1) 3 through 5 of the Act in writing, etc., and shall notify the details further confirmed immediately upon confirmation.

(3) "Specialized institution designated by Presidential Decree" in the former and latter parts of Article 34 (3) of the Act means the Korea Internet and Security Agency.

[This Article Wholly Amended on Sep. 12, 2023]

[Moved from Article 39; previous Article 40 moved to Article 39 <Sep. 12, 2023>]

Article 41(Procedures for access to personal information) #

(1) A data subject who intends to request access to his or her own personal information processed by a personal information controller pursuant to Article 35 (1) of the Act shall submit a request, stating the information that he or she intends to access among the following information, in the manner and following the procedure determined by the personal information controller; <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Oct. 17, 2017>

1. Particulars and substance of personal information;

2. The purpose of collecting and using personal information;

3. The period for retaining and using personal information;

4. Status of personal information provided to a third party;

5. The fact that the data subject has given consent to the processing of his or her personal information and the content thereof.

(2) To determine the manner and procedure for requesting access under paragraph (1), a personal information controller shall comply with the following to ensure that such manner and procedure are not more difficult than the manner and procedure that the personal information controller uses to collect the relevant personal information: <Added on Oct. 17, 2017>

1. To provide the requested personal information in a data subject-friendly manner, such as in writing, by telephone or electronic mail, or via the Internet;

2. To allow data subjects to request access to their own personal information at least through the same window or in the same manner that the personal information controller uses to collect such personal information, unless good cause exists, such as difficulty in continuously operating such window;

3. To post on a website the manner and procedure for requesting access if the personal information controller operates the website.

(3) A data subject who intends to request access to his or her own personal information via the Protection Commission pursuant to Article 35 (2) of the Act shall submit to the Protection Commission a Personal Information Access Request specifying the information to access among the information referred to in paragraph (1), as determined and publicly notified by the Protection Commission. In such cases, the Protection Commission shall forward the Personal Information Access Request to the relevant public institution without delay. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Oct. 17, 2017; Aug. 4, 2020>

(4) "Period prescribed by Presidential Decree" in the former part of Article 35 (3) of the Act means 10 days. <Amended on Oct. 17, 2017>

(5) Where a personal information controller allows a data subject to access the relevant personal information within 10 days from the receipt of the Personal Information Access Request under paragraph (1) or (3), or limits access to the relevant person information under Article 42 (1), the personal information controller shall serve the data subject with the Access Notice, stating the accessible personal information, date and time, venue, etc. for access (in the case of partial access pursuant to Article 42 (1), the ground therefor and how to appeal shall be included), in the form determined and publicly notified by the Protection Commission; provided, where he or she allows immediate access, the Access Notice may be omitted. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Oct. 17, 2017; Aug. 4, 2020>

Article 42-2(Standards for information transmitters) #

“Personal information controller satisfying the criteria prescribed by Presidential Decree” in the provisions, with the exception of the subparagraphs, of Article 35-2 (1) and (2) of the Act means any of the following persons (hereinafter referred to as "information transmitter"), respectively:

1. Any of the following persons among agencies, corporations, and organizations related to health and medical services (hereinafter referred to as "transmitter of health and medical services information"):

a. The Korea Disease Control and Prevention Agency;

b. The National Health Insurance Service under Article 13 of the National Health Insurance Act and the Health Insurance Review and Assessment Service under Article 62 of that Act;

c. A tertiary care hospital under Article 3-4 of the Medical Service Act;

d. Other persons publicly notified by the Protection Commission in consultation with the Minister of Health and Welfare, taking into consideration the technical and financial capacity to transmit personal information, the number of data subjects whose personal information is stored and managed, etc. among public health and medical institutions defined in subparagraph 4 of Article 3 of the Framework Act on Health and Medical Services;

2. Any of the following persons (hereinafter referred to as "transmitter of communications information") among agencies, corporations, or organizations related to communications:

a. A person who provides mobile communications services after being assigned radio frequencies pursuant to Article 10 of the Radio Waves Act and who has entered into a contract for the use of mobile communications services with a data subject;

b. Other persons determined and publicly notified jointly by the Protection Commission and the Minister of Science and ICT, taking into consideration the technical and financial capability to transmit personal information, the number of data subjects whose personal information is stored and managed, etc. among persons who manage the facilities-based telecommunications business under Article 5 (2) of the Telecommunications Business Act;

3. Any of the following persons (hereinafter referred to as "transmitter of energy information") among energy-related agencies, corporations, and organizations:

a. An electric sales business entity defined in subparagraph 10 of Article 2 of the Electric Utility Act;

b. A person who falls under any of the following and is jointly determined and publicly notified by the Protection Commission and the Minister of Trade, Industry and Energy, taking into consideration the technical and financial capabilities to transmit personal information and the number of data subjects whose personal information is stored and managed, etc.:

1) Urban gas business entities defined in subparagraph 2 of Article 2 of the Urban Gas Business Act;

2) Other agencies, corporations, and organizations related to urban gas business under subparagraph 1-2 of Article 2 of the Urban Gas Business Act.

[This Article Added on Feb. 25, 2025]

[Enforcement Date: Jun. 1, 2026]

Article 42-4(Scope of information subject to request for transmission) #

(1) Pursuant to Article 35-2 (1) or (2) of the Act, a data subject may request an information transmitter to transmit the following information to himself or herself, a specialized personal information management agency designated pursuant to Article 35-3 (1) of the Act (hereinafter referred to as "institution specializing in managing personal information"), or a general recipient according to the following classifications:

1. A transmitter of health and medical services information: Information (hereinafter referred to as "health and medical services information subject to transmission") held by the relevant transmitter of health and medical services information, among the following information related to health and medical services, which is publicly notified by the Protection Commission after consultation with the Minister of Health and Welfare, in consideration of the interests of the data subject, the time and cost necessary for transmission, the technically reasonable scope of transmission, etc.:

a. Information generated in relation to medical treatment, such as medical records under Articles 22 and 23 of the Medical Service Act;

b. Information generated in relation to dispensing, such as records of dispensing under Article 30 of the Pharmaceutical Affairs Act;

c. Information generated or collected through medical devices under Article 2 (1) of the Medical Devices Act;

d. Other information related to health and medical services similar to those referred to in items (a) through (c);

2. A transmitter of communications information: Information held by the relevant transmitter of communications information, which is jointly determined and publicly notified by the Protection Commission and the Minister of Science and ICT (hereinafter referred to as “communications transmission information subject to transmission”), taking into account the interests of the data subject, the time and cost necessary for transmission, and the technically reasonable scope of transmission, among information generated by providing facilities-based telecommunications services defined in subparagraph 11 of Article 2 of the Telecommunications Business Act, such as information on subscription, information on use, information on claims for use charges, information on payment of use charges, information on payment, etc.;

3. A transmitter of energy information: Information held by the relevant transmitter of energy information, as jointly determined and publicly notified by the Protection Commission and the Minister of Trade, Industry and Energy (hereinafter referred to as "energy information subject to transmission"), in consideration of the interests of the data subject, the time and expenses necessary for the transmission, and the technically reasonable scope of transmission, among the following energy-related information:

a. Information, such as information on energy consumption generated by the supply of electricity under Article 14 of the Electricity Business Act, information on billing and payment of electricity charges, etc.;

b. Information, such as information on energy consumption generated by the supply of urban gas under Article 19 of the Urban Gas Business Act, information on billing and payment of urban gas charges, etc.;

c. Other energy-related information similar to those referred to in items a and b.

(2) In addition to the information referred to in paragraph (1), a data subject may request that the information transmitter transmit to him or her any information which the information transmitter has voluntarily determined it can transmit to the data subject in consideration of time, cost, technology, and other factors (hereinafter referred to as "information subject to voluntary transmission"), from among the information it holds under Article 35-2 (1) of the Act.

(3) Notwithstanding paragraph (1), where a data subject requests that an information transmitter transmit health and medical services information subject to transmission, communications information subject to transmission, or energy information subject to transmission to an institution specializing in managing personal information or a general recipient pursuant to Article 35-2 (2) of the Act, he or she may not request the transmission of information determined and publicly notified by the Protection Commission, depending on the recipient of information.

(4) If the information referred to in the subparagraphs of paragraph (1) corresponds to information on the data subject himself or herself, which is retained by an administrative agency, etc. under Article 43-2 (1) of the Electronic Government Act, the Protection Commission (including the heads of the relevant central administrative agencies jointly determined and publicly notified by the Protection Commission pursuant to paragraph (1) 2 and 3) shall have a prior consultation with the Minister of the Interior and Safety about the information subject to a request for transmission and the method of transmission before making a public notice under paragraph (1).

[This Article Added on Feb. 25, 2025]

[Enforcement Date: Jun. 1, 2026]

Article 42-5(Methods of requesting transmission) #

(1) If a data subject makes a request for transmission under Article 35-2 (1) of the Act (hereinafter referred to as "data subject access request"), the data subject shall specify the purpose of the request for transmission and the personal information requested for transmission.

(2) If a data subject makes a third-party transmission request, he or she shall specify the following matters:

1. Purpose of the request for transmission;

2. The person to whom the request for transmission is made;

3. The person to whom personal information is transmitted;

4. Personal information requested to be transmitted;

5. Whether regular transmission is required and, if so, the frequency thereof [limited to cases where a request for transmission to a third-party is made to the information transmitter to transmit data to a general specialized agency under Article 42-9 (1) 2 (hereinafter referred to as “general specialized agency”) and a special specialized agency under subparagraph 3 of that paragraph (hereinafter referred to as “special specialized agency”);

6. The time when the request for transmission expires;

7. Period for retaining and using personal information requested for transmission.

(3) A data subject may submit a third-party transmission request to an information transmitter through either an agency specializing in personal information or a general recipient. In such cases, the institution specializing in managing personal information or a general recipient shall notify the data subject in advance, ensuring that the data subject clearly understands the details of the matters referred to in the subparagraphs of paragraph (2) before making the request.

(4) When a data subject requests a third-party transmission with regard to a general specialized agency or a special specialized agency, the data subject may request the information transmitter to transmit personal information of the same details on a regular basis.

(5) A data subject may change or withdraw a request for transmission under paragraphs (1) through (4). In such cases, an information transmitter, an institution specializing in managing personal information, and a general recipient shall ensure that the methods and procedures for changing and withdrawing the request for transmission are not more difficult than the methods and procedures as at the time of the request for transmission.

[This Article Added on Feb. 25, 2025]

Article 42-6(Deadline and methods of transmission of personal information) #

(1) An information transmitter in receipt of a request for transmission pursuant to Article 35-2 (1) and (2) of the Act shall transmit personal information without delay unless there is a reason for delay or inability to transmit due to an information system failure or other issues. In such cases, if there is a legitimate reason why transmission cannot be done without delay, the information transmitter may postpone transmission after notifying the data subject of the reason and, if the reason ceases to exist, the personal information shall be transmitted without delay.

(2) When an information transmitter transmits personal information, he or she shall maintain the accuracy, completeness, and up-to-datedness of personal information.

(3) An information transmitter shall transmit personal information by the following means (in cases of a data subject access request, limited to subparagraph 1) so as to ensure the safety and reliability of transmission:

1. A method of encrypting and transmitting information using a safe encryption algorithm when transmitting information;

2. The method determined by prior consultation between the information transmitter and the institution specializing in managing personal information or the general recipient;

3. A method for mutual identification and authentication between the information transmitter and the institution specializing in managing personal information or the general recipient;

4. A method of mutual verification between the information transmitter and the agency specializing in personal information management or the general recipient.

(4) If an information transmitter transmits personal information at a third-party transmission request, he or she shall transmit such information through a specialized relay agency. In such cases, the information transmitter shall transmit health and medical services information subject to transmission only to a special specialized agency through a specialized relay agency.

(5) An information transmitter shall post the method of requesting the transmission of personal information, the current status of transmission, and the method of verifying the details of transmission on its website, etc. so that information subjects can request the transmission of personal information and verify the details of transmission, etc. pursuant to Article 35-2 (1) of the Act; provided, in cases of the transmitter of health and medical services information and the transmitter of energy information, a specialized relay agency may do so on behalf of such information transmitter.

(6) When a general recipient receives personal information according to a request for third-party transmission, he or she shall endeavor not to infringe on the interests of data subjects or impede the transmission processing system by any of the following acts:

1. Requesting to transmit personal information not related to the purpose of requesting transmission, in violation of Article 16 (1) of the Act;

2. Receiving consent to the third-party provision of transmitted information at the same time as the request for transmission, even if it is not essential for the operation of the service pursuant to Article 16 (3) of the Act;

3. Coercing or unduly inducing a request for transmission pursuant to Article 35 (2) 1 and (2) of the Act or the exercise of rights under Article 38(1) of the Act by proxy;

4. Performing the business affairs prescribed in the subparagraphs of Article 35-3 (1) of the Act without being designated as an agency specialized in managing personal information under Article 35-3 (1) of the Act;

5. Requesting personal information by changing the details of the request for transmission under Article 42-5 (2) without the consent of the data subject;

6. Infringing on the interests of a specific data subject for his or her own or a third party's interests;

7. Continuously or repeatedly accessing the electronic computer system of a personal information controller by reasons of a request for transmission by a data subject, thereby failures;

8. Other acts similar to those referred to in subparagraphs 1 through 7, which infringe on the interests of data subjects or impede the transmission processing system.

(7) No general specialized agency, special specialized agency, or general recipient shall collect health and medical services information subject to transmission, communications information subject to transmission, and energy information subject to transmission by using or storing the means of access by a data subject under subparagraph 1 in the manner prescribed in subparagraph 2:

1. The following means of access by a data subject:

a. Digital signature creation information under subparagraph 3 of Article 2 of the Digital Signature Act and certificates under subparagraph 6 of that Article;

b. The identifier or authenticated information of a data subject registered with the information transmitter for a third-party transmission request;

c. Biometric information of a data subject;

2. Perusal in the name of a data subject by the following methods:

a. Directly storing the means of access referred to in subparagraph 1;

b. Securing authority to accessing the means of access referred to in subparagraph 1;

c. Effectively securing the control, the right to use, or the right to accessing the means of access referred to in subparagraph 1.

(8) An institution specializing in managing personal information and the general recipient shall keep the information processed as an institution specializing in managing personal information and the general recipient separately from the information processed as another personal information controller; provided, where a special specialized agency (limited to a medical institution under Article 3 of the Medical Service Act) receives health and medical services information subject to transmission for the purpose of medical treatment through an electronic medical record system under Article 23-2 (1) of that Act and where electronic medical records are safely managed and retained pursuant to Article 23 (2), storage need not be separated.

(9) An information transmitter, an institution specializing in managing personal information, and a general recipient shall keep the details of transmission of the following health and medical services information subject to transmission, communications information subject to transmission, energy information subject to transmission, and information subject to voluntary transmission (hereinafter referred to as "information subject to transmission request") for 3 years: provided, in cases of an information transmitter, an specialized relay agency may keep such details in lieu of the information transmitter:

1. Matters referred to in the subparagraphs of Article 42-5 (2);

2. Records of sending and receiving information in response to a data subject's request for transmission;

3. Details of and reasons for the withdrawal or rejection of a request for transmission and the suspension of transmission.

(10) A general specialized agency or a special specialized agency shall notify the data subject of the details of transmission of information subject to request for transmission under paragraph (9) at least once a year by any means falling under any subparagraph of Article 15-3 (4); provided, such notification may be omitted if the data subject has expressed a desire not to receive it.

(11) The Protection Commission and the head of a relevant central administrative agency may provide subsidies to cover expenses incurred by an information transmitter in complying with requests for transmission, such as expenses incurred in establishing and operating facilities and technologies necessary for transmitting personal information, within the budget.

[This Article Added on Feb. 25, 2025]

Article 42-8(Rejection of request for transmission and suspension of transmission) #

(1) "Cases prescribed by Presidential Decree, such as where it is impossible to verify whether a data subject is the person in question" in Article 35-2 (6) of the Act means any of the following cases:

1. Where it is impossible to verify whether the consent of the legal representative under Article 22-2 (1) of the Act is not verified;

2. Where the grounds for restricting or refusing access arise under Article 35 (4) of the Act;

3. Where the transmission of information subject to a request for transmission under Article 35-2 (1) and (2) of the Act infringes on the rights or legitimate interests of a third party;

4. Where it is impossible to verify whether the applicant is the representative under Article 38 (1) of the Act;

5. Where the matters subject to the request for transmission under Article 42-5 (1) and (2) are not specified;

6. Where the identity of the data subject is not verified;

7. Where it is found that the request for transmission is made by improper means, such as stealing authentication information of the data subject;

8. Where the request for transmission is to a person other than the data subject, a general specialized agency, a special specialized agency, or a general recipient

9. Where Personal Information is used by improper means, such as being abused for a crime, thereby clearly infringing on the interests of a data subject;

10. Where the data subject requests excessive and repeated transmission of the same personal information without good cause, causing disruption to the business affairs;

11. Where there are reasonable grounds to reject a request for transmission or to suspend the transmission, such as it is confirmed that circumstances suggesting that the data subject has made a request for transmission due to deception or intimidation of a third party.

(2) If an information transmitter rejects a data subject's request for transmission or suspends transmission due to a cause falling under any of the subparagraphs of paragraph (1), he or she shall notify the data subject of such fact and the reasons therefor without delay; provided, if the data subject makes a request for transmission through an institution specializing in managing personal information or a general recipient, he or she may notify it through the relevant institution specializing in managing personal information or the general recipient.

[This Article Added on Feb. 25, 2025]

Article 42-10(Application for designation of institution specializing in managing personal information) #

(1) A person who intends to be designated as an institution specializing in managing personal information pursuant to Article 35-3 (1) of the Act shall file an application for designation to the designating authority under paragraph (2) by submitting the following documents; in such cases, a person who intends to be designated as an institution specializing in managing personal information may submit it through the personal information transmission support platform:

1. Application for designation;

2. Articles of incorporation or bylaws (not applicable to public institutions falling under subparagraph 6 (a) of Article 2 of the Act);

3. A business plan;

4. A personal information management plan;

5. Financial statements for the last 3 years (not applicable to public institutions falling under subparagraph 6 (a) of Article 2 of the Act);

6. Documents proving that the requirements for designation under Article 35-3 (2) of the Act are satisfied.

(2) A person who may designate an institution specializing in managing personal information pursuant to Article 35-3 (1) of the Act (hereinafter referred to as "designating authority") shall be as follows:

1. A specialized relay agency: The head of a relevant central administrative agency related to the information that the Protection Commission or specialized relay agency intends to receive; provided, the Minister of Health and Welfare shall be the specialized relay agency in the case of an agency specializing in relaying health and medical services information subject to transmission;

2. A general specialized agency: The head of a relevant central administrative agency related to the information to be transmitted to the Protection Commission or a general specialized agency;

3. A special specialized agency: The Minister of Health and Welfare.

(3) Upon receipt of an application for designation under paragraph (1), the designating authority shall verify the corporation registration certificate (limited to where a person who intends to be designated as an institution specializing in managing personal information is a corporation) through administrative data matching under Article 36 (1) of the Electronic Government Act.

(4) A person who intends to be designated as an institution specializing in managing personal information may apply for a preliminary examination to the designating authority before filing an application for designation under paragraph (1) to determine whether the detailed criteria for designation under Article 42-11 are satisfied.

[This Article Added on Feb. 25, 2025]

Article 42-11(Detailed criteria for designation of institutions specializing in managing personal information) #

(1) The detailed standards for each requirement for the designation of an institution specializing in managing personal information under Article 35-3 (2) of the Act shall be as follows:

1. It shall have all of the following technological levels and expertise:

a. A business plan for enhancing the rights, interests, etc. of data subjects and preventing conflicts of interest with data subjects shall be reasonable and sound;

b. A personal information management plan for the services of an institution specializing in managing personal information shall be appropriate;

c. It shall have facilities and technologies prescribed and publicly notified by the Protection Commission to effectively perform the services of an agency specializing managing personal information;

2. It shall meet all of the following levels in terms of measures to ensure safety:

a. It shall meet the requirements for fulfilling the duty of safeguards under Article 29 of the Act;

b. In order to safely operate an institution specializing in managing personal information, a protection system determined and publicly notified by the Protection Commission shall be in place appropriately;

3. It shall have all of the following financial capabilities (not applicable to public institutions falling under subparagraph 6 (a) of Article 2 of the Act):

a. Its financial structure shall be sound and safe;

b. It shall have capital according to the following classifications [in the case of a corporation, the paid-in capital (in the case of a non-profit corporation, the basic property), and in the case of an organization that is not a corporation, it means the value of the assets held by the relevant organization; hereafter in this item the same shall apply];

1) A specialized relay agency: At least 1 billion won in capital;

2) A general specialized agency or a special specialized agency: At least 100 million won in capital;

c. It shall purchase an insurance policy or mutual aid or accumulate reserves for the performance of liability for damage compensation (not applicable to any person falling under any subparagraph of Article 39-7 (2) of the Act). The standards for the minimum amount of insurance policy or mutual aid or the minimum amount of reserves in such cases shall be as specified in Appendix 1-2.

(2) Notwithstanding paragraph (1), if any of the following agencies, corporations, or organizations intends to be designated as an institution specializing in managing personal information, it shall file a request therefor with the Protection Commission (excluding cases where the Protection Commission is the designating authority) and, after deliberation and resolution by the Protection Commission, may be treated as meeting the detailed criteria for designation under the subparagraphs of paragraph (1) without undergoing examination on some or all of the criteria; provided, the examination of all the requirements of the detailed criteria for designation under the subparagraphs of paragraph (1) may be omitted only in cases where the agency, corporation, or organization referred to in subparagraphs 1 and 2 intends to be designated as an institution specializing in managing personal information:

1. A medical institution under Article 3 of the Medical Service Act (limited to where health and medical services information subject to transmission is transmitted);

2. A central administrative agency or local government;

3. A public institution other than those referred to in subparagraph 2.

[This Article Added on Feb. 25, 2025]

Article 42-12(Designation of institutions specializing in managing personal information) #

(1) If a person who has filed an application for designation pursuant to Article 42-10 (1) is deemed to meet the detailed criteria for designation under Article 42-11, the designating authority may designate such person as an institution specializing in managing personal information. In such cases, if a person who has filed an application for designation pursuant to Article 42-10 (1) fails to meet some of the detailed criteria for designation, the designating authority may grant the designation on the condition that he or she shall meet such criteria within a specified period and verify whether such conditions are fulfilled after designation.

(2) If an institution specializing in managing personal information intends to change any of the following matters (excluding minor matters determined and publicly notified by the Protection Commission), it shall obtain prior approval from the designating authority:

1. A business plan (including adding or changing the information to be transmitted);

2. A personal information management plan;

(3) The effective period of the designation of an institution specializing in managing personal information shall be 3 years.

(4) If an institution specializing in managing personal information applies for an extension of the effective period of designation under paragraph (3), the designating authority may re-designate it as an institution specializing in managing personal information if it deems that the institution meets the detailed criteria for designation under Article 42-11.

(5) When a designating authority (excluding the Protection Commission) intends to make the following decisions, it shall have a prior consultation with the Protection Commission:

1. Designation under paragraph (1) and re-designation under paragraph (4) (limited to specialized relay agencies);

2. Approval for modification under paragraph (2) (in cases of a general specialized agency or special specialized agency, limited to cases related to information subject to request for transmission).

(6) If a designating authority (excluding the Protection Commission in cases falling under subparagraph 1) grants designation under paragraph (1), approval for modification under paragraph (2), or re-designation under paragraph (4), it shall take the following measures:

1. Notification to the Protection Commission;

2. Public announcement in the Official Gazette or posting it on the website of the designating authority (excluding approval for modification).

(7) If a specialized relay agency intends to suspend or discontinue part or all of its relay services, it shall notify the designating authority thereof not later than 6 months prior to the scheduled date of suspension or discontinuance. In such cases, the designating authority may order the relevant specialized relay agency to take any of the following measures:

1. Destruction of personal information held by the relevant specialized relay agency (excluding cases where it is required to preserve personal information pursuant to other statutes or regulations);

2. Transfer of services being performed to another specialized relay agency;

3. Notifying any of the following persons of the planned suspension or discontinuation of services:

a. Data subjects of personal information held by the relevant specialized relay agency;

b. An information transmitter who transmits information to the relevant specialized relay agency;

c. A general specialized agency, a special specialized agency, or a general recipient to which information is transmitted by the relevant specialized relay agency.

(8) If a general specialized institution or special specialized institution intends to suspend or discontinue part or all of its services related to the transmission of personal information, it shall provide prior notification of such fact to a specialized relay institution and register it on the personal information transmission support platform.

[This Article Added on Feb. 25, 2025]

Article 43(Correction, and erasure of personal information) #

(1) A data subject who intends to request a personal information controller to correct or erasure his or her own personal information pursuant to Article 36 (1) of the Act shall submit a request in the manner and following the procedure determined by the personal information controller. In such cases, Article 41 (2) shall apply mutatis mutandis where the personal information controller determines the manner and procedure for requesting the correction or erasure of personal information; and "access" shall be construed as "correction or erasure". <Amended on Oct. 17, 2017>

(2) Upon receipt of a request to correct or erasure personal information pursuant to Article 36 (1) of the Act, a personal information controller who processes personal information files provided by other personal information controller shall correct or erase the relevant personal information as requested; or shall, without delay, notify the personal information controller who has provided the relevant personal information of the request to correct or erasure the personal information, and take necessary measures based on the result of such processing. <Amended on Oct. 17, 2017>

(3) A personal information controller shall inform the relevant data subject of the fact that he or she has duly corrected or erased the relevant personal information pursuant to Article 36 (2) of the Act within 10 days from the receipt of a request to correct or erasure personal information under paragraph (1) or (2); otherwise, if the erasure of personal information is denied because it falls under the proviso of Article 36 (1) of the Act, the personal information controller shall serve the data subject with the Personal Information Correction or erasure Outcome Notice, stating the fact and grounds for the denial and how to appeal, in the form determined and publicly notified by determined and publicly notified by the Protection Commission. <Amended on Mar. 23, 2013; Nov. 19, 2014; Jul. 26, 2017; Oct. 17, 2017; Aug. 4, 2020>

Article 44-3(Measures following request for refusal, and explanation) #

(1) Where a data subject refuses to make an automated decision pursuant to Article 44-2 (1), a personal information controller shall take any of the following measures and notify the data subject of the results thereof, unless there is a compelling reason not to do so:

1. Measures not to apply automated decisions;

2. Reprocessing by personal intervention.

(2) Where a data subject requests an explanation under Article 44-2 (2) for an automated decision pursuant to Article 44-2 (2), the personal information controller shall provide the data subject with a concise and meaningful explanation, including the following matters, unless there is good cause; provided, where the relevant automated determination does not significantly affect the rights or obligations of the data subject, the personal information controller may notify the data subject of the matters referred to in Article 44-4 (1) 2 and 3:

1. The result of the relevant automated decision;

2. The types of major personal information used for the relevant automated decision;

3. Major criteria for automated decisions, such as the impact of the types of personal information under subparagraph 2 on automated decisions;

4. Procedures in which automated decisions are made, such as the process of major personal information used for the relevant automated decisions.

(3) Where a data subject requests a review under Article 44-2 (2) 2 pursuant to Article 44-2 (2), a personal information controller shall review whether the opinions submitted by the data subject are reflected and notify the data subject of whether the opinions are reflected and the results of reflection, unless there is a compelling reason not to do so.

(4) Where a personal information controller refuses a request for refusal or explanation, etc. pursuant to Article 38 (5) of the Act due to justifiable grounds, such as likelihood of unfairly infringing on the life, body, property, and other interests of other persons, the personal information controller shall notify the data subject of the grounds therefor in writing, etc. without delay.

(5) Where a personal information controller takes measures in accordance with a request for refusal or explanation by a data subject pursuant to paragraphs (1) through (3), he or she shall take such measures in writing, etc. within 30 days from the date he or she receives a request for refusal or explanation by the data subject; provided, where there exist any justifiable grounds that make it impracticable to process within 30 days, the personal information controller may extend the period by up to 30 days only twice after notifying the data subject of the grounds therefor.

(6) Detailed matters concerning measures taken in response to a request for refusal or explanation by a data subject under paragraphs (1) through (5) shall be determined and publicly notified by the Protection Commission.

[This Article Added on Mar. 12, 2024]

Article 47(Amounts of fees) #

(1) The amounts of fees and postage provided for in Article 38 (3) of the Act shall be determined by the relevant personal information controller within the actual expenses necessary for the processing of the request for access, etc.; provided, if a personal information controller is a local government, they shall be prescribed by ordinance of the relevant local government , and the fees under the proviso of Article 38 (3) of the Act shall be calculated in accordance with the standards determined and publicly notified by the Protection Commission in consideration of the characteristics of information subject to request for transmission, expenses incurred in establishing and operating necessary facilities, etc. <Amended on Feb. 25, 2025>

(2) A personal information controller shall not demand any fee or postage if the cause for submitting the request for access, etc. lies with the personal information controller.

(3) Any fee and postage provided in Article 38 (3) of the Act shall be paid as follows; provided, a personal information controller, which is the National Assembly, the Court, the Constitutional Court, the National Election Commission, a central administrative agency, or its affiliated body (hereafter in this Article referred to as "national agency") or a local government, may claim such fee and postage by the electronic payment means defined in subparagraph 11 of Article 2 of the Electronic Financial Transactions Act, or telecommunications billing services defined in Article 2 (1) 10 of the Act on Promotion of Information and Communications Network Utilization and Information Protection: <Amended on Sep. 12, 2023>

1. Where the fee or postage is paid to a personal information controller that is a national agency: Revenue stamp;

2. Where the fee or postage is paid to a personal information controller that is a local government: Revenue certificate;

3. Where the fee and postage is paid to other personal information controller than a national agency or local government: In the manner determined by the relevant personal information controller.

(4) If a general specialized agency, special specialized agency, or general recipient requests third-party transmission on behalf of a data subject pursuant to the former part of Article 42-5 (3), the information transmitter may charge the general specialized agency, special specialized agency, or general recipient with a fee under the proviso of Article 38 (3) of the Act. <Added on Feb. 25, 2025>

Article 48-7(Scope, and standards of the parties required to purchase an insurance for performance of damage compensation responsibilities) #

(1) "Person who meets the standards prescribed by Presidential Decree" in Article 39-7 (1) of the Act means a person who meets all of the following requirements (hereinafter referred to as "subscribed personal information controller"): <Amended on Mar. 12, 2024>

1. The same sales, etc. of the previous year (in cases of a corporation, referring to the immediately preceding business year) shall be at least one billion won;

2. The number of data subjects (excluding data subjects falling under Article 15-3 (2) 2; hereafter the same shall apply in this Article) whose personal information has been stored and managed for three months immediately preceding the end of the previous year shall be at least 10,000 per day average daily; provided, where personal information has been transferred due to acquisition of all or part of business, division, merger, etc. in the relevant year, the number of data subjects shall be at least 10,000 persons as of the time of transfer.

(2) "Public institutions, non-profit corporations, and organizations prescribed by Presidential Decree" in Article 39-7 (2) 1 of the Act means the following institutions: <Added on Mar. 12, 2024>

1. Public Institutions; provided, this shall not apply to public institutions falling under subparagraphs 2 through 5 of Article 2, which fall under the subparagraphs of Article 32 (4);

2. Public interest corporations under Article 2 of the Act on the Establishment and Operation of Public Interest Corporations;

3. Associations registered under Article 4 of the Assistance for Non-Profit, Non-Governmental Organizations Act.

(3) "Person prescribed by Presidential Decree" in Article 39-7 (2) 2 of the Act means a person who meets all of the following requirements: <Amended on Mar. 12, 2024>

1. A person entrusted with the storage and management of personal information by a micro enterprise under Article 2 (1) of the Framework Act on Micro Enterprises to prevent personal information from being lost, stolen, divulged, divulged, forged, altered, or damaged;

2. A person who takes necessary measures, such as purchasing an insurance policy or joining a mutual aid agreement or accumulating reserves to guarantee the fulfillment of liability for damage compensation under Articles 39 and 39-2 of the Act with respect to affairs entrusted pursuant to subparagraph 1.

(4) The standards for the minimum subscription amount (referring to the minimum reserve amount in cases of accumulating reserves; hereafter the same shall apply in this Article) where a subscribed personal information controller subscribes to insurance or mutual aid or accumulates reserves shall be as specified in Appendix 1-4; provided, where a personal information controller subject to enrollment subscribes to insurance or mutual aid or accumulates reserves simultaneously, the aggregate of the amount of insurance or mutual aid and reserves shall be at least the standards for the minimum subscription amount prescribed in Appendix 1-4. <Amended on Sep. 12, 2023; Mar. 12, 2024>

[This Article Added on Aug. 4, 2020]

Article 51-3(Secretariat of, and investigation and inspection by, Dispute Mediation Committee) #

(1) "Secretariat prescribed by Presidential Decree" in the former part of Article 45 (2) of the Act means the secretariat of the Protection Commission, which is in charge of conducting administrative affairs necessary for dispute mediation pursuant to Article 50 (1).

(2) Where the Dispute Mediation Committee intends to conduct an investigation or inspection pursuant to Article 45 (2) of the Act, it shall notify a person subject to such investigation or inspection of the following matters in writing no later than seven days before the investigation or inspection; provided, where the purpose of the investigation or inspection is likely to be compromised, prior notification need not be given:

1. The purpose of the investigation and inspection;

2. The period and place of the investigation and inspection;

3. The position and name of a person who conducts the investigation or inspection;

4. The scope and details of the investigation and inspection;

5. The fact that the person may refuse the investigation or inspection, where there is good cause;

6. The details of disadvantageous measures, where the person refuses, obstructs, or evades the investigation or inspection without good cause;

7. Other matters necessary for the investigation or inspection for dispute mediation.

(3) When the Dispute Mediation Committee conducts an investigation or inspection pursuant to Article 45 (2) of the Act, it may request disputing parties or persons designated by the disputing parties to be present during the investigation or inspection or to present their opinions.

(4) To hear the opinions of disputing parties or relevant witnesses pursuant to Article 45 (5) of the Act, the Dispute Mediation Committee shall determine the date, time, and place of a meeting and notify the disputing parties or relevant witnesses thereof no later than 15 days before the meeting is held.

[This Article Added on Sep. 12, 2023]

Article 60-2(Criteria for calculation of penalty surcharges) #

(1) The total sales under the main clause, with the exception of the subparagraphs, of Article 64-2 (1) of the Act shall be the average annual sales of the relevant personal information controller for three business years immediately preceding the business year in which any violation is committed (hereafter in this Article referred to as the "relevant business year"); provided, where three years have not elapsed since the date of commencement of business as of the first day of the relevant business year, the total sales shall be the amount calculated by converting the sales from the date of commencement of business to the end of the immediately preceding business year into the average annual sales; and where business commences in the relevant business year, the total sales shall be the amount calculated by converting the sales from the date of commencement of business to the date a violation is committed into the average annual sales.

(2) "Cases prescribed by Presidential Decree" in the proviso, with the exception of the subparagraphs, of Article 64-2 (1) of the Act means any of the following cases:

1. Where there is no sales records due to any of the following reasons:

(a) No commencement of business;

(b) Suspension of business;

(c) Any other reason equivalent to those specified in items (a) and (b), such as no engagement in profit-making business;

2. Where it is impracticable to objectively calculate the sales because sales calculation data are lost or damaged due to a disaster, etc.

(3) Sales unrelated to a violation under Article 64-2 (2) of the Act shall be any of the following amounts of the total sales specified in paragraph (1):

1. Sales of goods or services which are unrelated to personal information processing;

2. Sales recognized by the Protection Commission as not the sales of goods or services directly or indirectly affected by a violation, based on the data, etc. submitted pursuant to paragraph (4).

(4) Where the Protection Commission needs financial statements or other data for the calculation of sales, etc. under paragraphs (1) through (3), it may request the relevant personal information controller to submit the relevant data within a specified period not exceeding 20 days.

(5) "Ground prescribed by Presidential Decree" in Article 64-2 (5) 4 of the Act means where the relevant personal information controller rectifies a violation and meets the criteria determined and publicly notified by the Protection Commission.

(6) The criteria and procedures for calculating penalty surcharges under Article 64-2 (6) of the Act shall be as specified in Appendix 1-5.

[This Article Added on Sep. 12, 2023]

Article 62(Entrustment of work) #

(1) Deleted. <Dec. 30, 2015>

(2) The Protection Commission may entrust the work to support the provision of alternative sign-up tool subject to Article 24-2 (4) of the Act to the following institutions under Article 68 (1) of the Act: <Amended on Mar. 23, 2013; Nov. 19, 2014; Dec. 30, 2015; Jul. 26, 2017; Aug. 4, 2020; Jul. 19, 2022>

1. The Korea Local Information Research and Development Institute established under Article 72 (1) of the Electronic Government Act;

2. The Korea Internet and Security Agency;

3. A corporation, institution, or organization determined and publicly notified by the Protection Commission after being recognized as having technical and financial capacity and facilities to develop, provide, and manage the alternative sign-up tool safely.

(3) The Protection Commission (including a designating authority other than the Protection Commission in cases falling under subparagraph 10; hereafter the same shall apply in the provisions, with the exception of the subparagraphs, of paragraph (4) and paragraph (5)) may entrust the following business affairs to an institution provided in paragraph (4), under Article 68 (1) of the Act: <Amended on Mar. 23, 2013; Nov. 19, 2014; Dec. 30, 2015; Jul. 26, 2017; Aug. 4, 2020; Jul. 19, 2022; Sep. 12, 2023; Feb. 25, 2025>

1. Exchange and cooperation with international organizations and foreign personal information protection agencies for the protection of personal information under subparagraph 5 of Article 7-8 of the Act;

2. Surveys and research on statutes and regulations, policies, systems, actual conditions, etc. related to the protection of personal information under subparagraph 6 of Article 7-8 of the Act;

3. Support for and dissemination of technology development for the protection of personal information under subparagraph 7 of Article 7-8 of the Act;

4. Education and public relations regarding the protection of personal information under subparagraph 1 of Article 13 of the Act;

5. Promotion of and support for agencies and organizations related to the protection of personal information under subparagraph 2 of Article 13 of the Act;

6. Training of relevant specialists and development of criteria for privacy impact assessments under Article 33 (6) of the Act;

7. Receipt and processing of access requests under Article 35 (2) of the Act;

8. Requests for materials and inspections under Article 63 of the Act that are related to the following matters:

(a) Technical assistance for reporting under the former part of Article 34 (3) of the Act;

(b) Receipt and processing of, and counseling on, reports received by the Privacy Call Center pursuant to Article 62 of the Act;

9. Receipt of applications for designating an assessment institution under Article 36 (2) and receipt of reports under paragraph (6) of that Article.

10. The following matters regarding the designation of an institution specializing in managing personal information under Article 35-3 of the Act:

a. Receipt of an application for designation as an institution specializing in managing personal information under Article 42-10 (1) and verification of the details of such application;

b. Preliminary examination on the designation of an institution specializing in managing personal information under Article 42-10 (4);

c. Verification as to whether the conditions for designation under the latter part of Article 42-12 (1) are fulfilled;

11. Operation of a personal information transmission support platform under Article 35-4 (2) of the Act.

(4) The institutions to which the Protection Commission may entrust its work regarding the matters specified in the subparagraphs of paragraph (3) shall be as follows: <Added on Jul. 19, 2022>

1. The Korea Internet and Security Agency;

2. A corporation, institution, or organization determined and publicly notified by the Protection Commission as having expertise in the field of personal information protection.

(5) Where the Protection Commission entrusts its work pursuant to paragraphs (2) through (4), it shall publicly announce the institutions to be entrusted with the affairs and details of the entrusted affairs in the Official Gazette or on its website. <Amended on Jul. 19, 2022>

[Title Amended on Jul. 19, 2022]

Article 62-2(Processing of sensitive information and personally identifiable information) #

(1) The Protection Commission (including persons entrusted with the authority of the Protection Commission under Article 62 (3)) may process sensitive information and data that contain resident registration numbers, passport numbers, driver’s license numbers, or alien registration numbers referred to in Article 19, if inevitable to perform the following business affairs: <Amended on Aug. 4, 2020; Sep. 12, 2023>

1. Business affairs regarding deliberation and resolution on any matter under Article 7-9 (1) 4 through 6 of the Act;

2. Business affairs regarding preparing for and supporting the establishment of systems providing alternative sign-up tools under Article 24-2 (4) of the Act;

3. Deleted; <Sep. 12, 2023>

4. Business affairs regarding work of the Privacy Call Center established pursuant to Article 62 (3) of the Act;

5. Business affairs regarding submission of materials and inspections under Articles 63 (1) and (2);

6. Business affairs regarding preliminary fact-finding inspections conducted under Article 63-2 of the Act;

7. Business affairs regarding imposing and collecting penalty surcharges under Article 64-2 of the Act.

(2) The Dispute Mediation Committee may process sensitive information and data that contain resident registration numbers, passport numbers, driver’s license numbers, or alien registration numbers referred to in Article 19, if inevitable to perform the business affairs related to personal information dispute mediation under Articles 45, 47, and 49 of the Act. <Amended on Aug. 4, 2020; Sep. 12, 2023>

(3) Where it is unavoidable for the information transmitter or the specialized relay agency to perform the business affairs related to the request for transmission of personal information under Article 35-2 of the Act, it may process data containing a resident registration number, passport number, driver's license number, or alien registration number (limited to the resident registration number held by him or her in the case of an information transmitter) under Article 19 (limited to the case of verifying the identity of the person). <Added on Feb. 25, 2025>

[This Article Added on Aug. 6, 2014]

[Title Amended on Aug. 4, 2020]

Article 62-3(Re-examination of regulation) #

(1) The Protection Commission shall examine the appropriateness of the following matters every 3 years, counting from each base date specified in the following (referring to the period that ends on the day before the base date of every 3rd year) and shall take measures, such as making improvements. <Added on Aug. 4, 2020; Mar. 8, 2022; Sep. 12, 2023; Mar. 12, 2024; Feb. 25, 2025>

1. Deleted; <Feb. 25, 2025>

2. Scope of the persons required to be notified of the details of the use and provision of personal information, the types of information required to be notified, and the frequency and method of notification under Article 15-3: September 15, 2023;

3. Scope and standards of the parties required to purchase an insurance, etc. for performance of damage compensation responsibilities under Article 48-7: August 5, 2020.

4. Combination of pseudonymized information between personal information controllers under Article 29-3: Jan. 1, 2024.

5. Matters regarding information transmitters and information transmitted under Articles 42-2 through 42-4: January 1, 2025;

6. Matters regarding requests for and methods of transmitting personal information under Articles 42-5 through 42-8: January 1, 2025;

7. Matters regarding institutions specializing in managing personal information under Articles 42-9 through 42-16: January 1, 2025;

8. Matters regarding the designation, etc. of an Expert Data Combination Agency under Article 29-2: January 1, 2026;

9. Matters regarding the management, supervision, etc. of an Expert Data Combination Agency under Article 29-4: January 1, 2025.

(2) The Protection Commission shall examine the appropriateness of the following matters every 2 years, counting from each base date specified in the following (referring to the period that ends on the day before January 1 of every 2nd year) and shall take measures, such as making improvements. <Amended on Mar. 12, 2024; Feb. 25, 2025>

1. Deleted; <Feb. 25, 2025>

2. The qualification requirements for persons in charge of personal information protection under Article 32 (4) and (6) and Appendix 1 and matters to be observed by personal information controllers to guarantee the independence of persons in charge of personal information protection: Jan. 1, 2025;

3. Procedures and Methods for Requesting Rejection of Automated Decisions or Requesting Explanation, Measures Following Requests for Rejection of Automated Decisions or Requests for Explanation, etc., Standards and Procedures for Automated Decisions, etc. under Articles 44-2 through 44-4: Jan. 1, 2025.

(3) Deleted. <Mar. 8, 2022>

[This Article Wholly Amended on Dec. 9, 2014]

ENFORCEMENT DECREE OF THE PERSONAL INFORMATION PROTECTION ACT

Article 1(Purpose) #

Article 2(Scope of public institutions) #

Article 3(Scope of visual data processing devices) #

Article 4 #

Article 4-2(Prohibition on work for profit) #

Article 5(Expert committees) #

Article 5-2(Personal Information Protection Policy Council) #

Article 5-3(City/Do inter-agency personal information protection council) #

Article 6(Disclosure of proceedings) #

Article 7(Dispatch of public officials) #

Article 8 #

Article 9(Allowances for attendance) #

Article 9-2(Procedures for advising improvement of policies, systems, statutes, and regulations) #

Article 9-3(Procedures for assessment of personal information breach incident factors) #

Article 10 #

Article 11(Procedures to establish master plans) #

Article 12(Procedures to establish implementation plans) #

Article 13(Scope of materials requested and methods of request) #

Article 13-2(Subject matters, standards, methods, and procedures for evaluation of level of personal information protection) #

Article 14(Promotion and support of self-regulation) #

Article 14-2(Standards on additional use and provision of personal information) #

Article 15(Control of out-of-purpose use of personal information or provision thereof to third parties) #

Article 15-2(Matters subject to notification, such as sources of personal information collected, and methods and procedures for notification) #

Article 15-3(Notification of details of use and provision of personal information) #

Article 16(Methods of destroying personal information) #

Article 17(Methods of obtaining consent) #

Article 17-2(Protection of children's personal information) #

Article 18(Scope of sensitive information) #

Article 19(Scope of personally identifiable information) #

Article 20 #

Article 21(Measures to ensure safety of personally identifiable information) #

Article 21-2(Persons who must encrypt resident registration numbers) #

Article 22(Exception to restriction on installation and operation of fixed visual data processing devices) #

Article 23(Gathering opinions on installation of fixed visual data processing devices) #

Article 24(Posting of notice on signboard) #

Article 25(Policy on operation and management of fixed visual data processing devices) #

Article 26(Entrustment of installation and operation of fixed visual data processing devices by public institutions) #

Article 27(Exception to restriction on operation of mobile visual data processing devices) #

Article 27-2(Indication of photographing with mobile visual data processing devices) #

Article 27-3(Guidelines for installing and operating visual data processing devices) #

Article 28(Measures to be taken when entrusting personal information processing) #

Article 29(Notification of transfer of personal information following business transfer) #

Article 29-2(Designation and cancellation of designation of expert data combination agency) #

Article 29-3(Combination and release of pseudonymized information processed by different personal information controllers) #

Article 29-4(Management, and supervision of expert data combination agency) #

Article 29-5(Measures to ensure safety of pseudonymized information) #

Article 29-6 #

Article 29-7(Means of notifying data subjects in cases of cross-border entrusted processing or storage of personal information) #

Article 29-8(Certification of cross-border transfer of personal information) #

Article 29-9(Recognition of countries' personal information protection levels) #

Article 29-10(Protective measures in cases of cross-border transfers of personal information) #

Article 29-11(Standards for orders to suspend cross-border transfers) #

Article 29-12(Filing objections to orders to suspend cross-border transfers) #

Article 30(Measures to ensure safety of personal information) #

Article 30-2(Measures to ensure safety of personal information taken by institutions operating public systems) #

Article 31(Details of privacy policy and methods for disclosure thereof) #

Article 31-2(Those subject to, and procedures for, evaluation of privacy policy) #

Article 32(Work of privacy officer and requirements for designation) #

Article 32-2(Scope of business of council of privacy officers) #

Article 32-3(Scope of persons subject to designation of domestic agents) #

Article 33(Registered matters of personal information files) #

Article 34(Registration and disclosure of personal information files) #

Article 34-2(Criteria, method, and procedure for certification of personal information protection) #

Article 34-3(Fees for certification of personal information protection) #

Article 34-4(Revocation of certification) #

Article 34-5(Follow-up management of certification) #

Article 34-6(Institutions specializing in certifying personal information protection) #

Article 34-7(Certification mark and promotion) #

Article 34-8(Qualifications for certification examiners for personal information protection and grounds for disqualification) #

Article 35(Object of privacy impact assessment) #

Article 36(Designation of assessment institutions and revocation of designation) #

Article 37(Consideration at the time of privacy impact assessment) #

Article 38(Criteria for privacy impact assessment) #

Article 39(Notification of divulgence of personal information) #

Article 40(Reporting on divulgence of personal information) #

Article 40-2(Institution requesting erasure and blocking of exposed personal information) #

Article 41(Procedures for access to personal information) #

Article 42(Limitation to, and postponement and denial of, access to personal information) #

Article 42-2(Standards for information transmitters) #