Personal Information Status Management

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.2.1 Personal Information Status Management], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

The status of collected/held personal information, including the items, quantity held, purpose and method of processing, and retention period, shall be managed on a regular basis.

• The personal information controller (information and communications service provider) shall identify the items of collected/held personal information, the quantity held, the basis for processing (consent, statutes, etc.), the purpose and method of processing, and the retention period, and shall record/manage them through a personal information status table, a personal information flow table, a personal information flow diagram, etc.
• In addition, the personal information status shall be reviewed on a regular basis and the related documents shall be kept up to date.

When a public institution operates or changes a personal information file, the related matters shall be registered with the head of the relevant agency designated by law, and where there is a change to the registered matters, that content shall also be registered.

• Upon receiving an application to register or change a personal information file, the Chief Privacy Officer reviews the registration/change matters and determines their appropriateness, then registers them with the Personal Information Protection Commission within 60 days.
• Institutions affiliated with central administrative agencies and local governments, and other public institutions, request the higher-level supervising agency to review and determine the appropriateness of the relevant matters (registration/change of personal information files), and after receiving confirmation from the higher-level supervising agency, register them with the Personal Information Protection Commission within 60 days.
• The registration and disclosure of personal information files of the National Assembly, the courts, the Constitutional Court, and the National Election Commission (including their affiliated agencies) shall follow the National Assembly Rules, the Supreme Court Rules, the Constitutional Court Rules, and the National Election Commission Rules.
• However, personal information files falling under Article 32(2) of the Personal Information Protection Act need not be registered with the Personal Information Protection Commission.

Personal information files exempt from registration with the Personal Information Protection Commission (public institutions)

1. Personal information files recording matters concerning national security, diplomatic secrets, or other significant national interests
2. Personal information files recording matters concerning criminal investigation, the institution and maintenance of prosecution, the execution of sentences and custody, correctional dispositions, protective dispositions, security surveillance dispositions, and immigration control
3. Personal information files recording matters concerning the investigation of offenses under the Punishment of Tax Evaders Act and the investigation of offenses under the Customs Act
4. Personal information files prescribed by Presidential Decree as being of low necessity for continuous management, such as files operated on a one-time basis
   • Personal information files operated for the performance of simple tasks such as payment of allowances for meeting attendance, sending of materials/goods, and settlement of money, for which the necessity of continuous management is low
   • Personal information files processed temporarily in cases urgently required for public safety and welfare, such as public health
   • Other personal information files collected only for one-time task processing that are not stored or recorded
5. Personal information files classified as secret under other statutes
6. Personal information files collected or requested to be provided for the purpose of analyzing information related to national security
7. Personal image information files processed through video information processing devices
8. Personal information files held by financial institutions under the Act on Real Name Financial Transactions and Confidentiality for the handling of financial business

Public institutions shall disclose the retention status of personal information files in their privacy policy.

• The Chief Privacy Officer of a public institution periodically investigates the retention/destruction status of personal information files and discloses the results in the privacy policy of the relevant public institution (Article 61 of the Standard Personal Information Protection Guidelines).
• The Personal Information Protection Commission discloses the registration status of personal information files on the internet so that anyone can easily view it (Personal Information Portal, www.privacy.go.kr).