Ensuring Personal Information Quality
Certification criterion
Management procedures shall be provided to the data subject so that the accuracy, completeness, and up-to-dateness of the collected personal information are ensured within the scope necessary for the processing purpose.
Key checkpoints
- Are procedures and measures established and implemented to keep personal information accurate and up to date?
- Is a method provided for the data subject to maintain the accuracy, completeness, and up-to-dateness of their own personal information?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.2.2 Ensuring Personal Information Quality], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
Procedures and measures to keep personal information accurate and up to date shall be established and implemented.
- Applying safeguards to prevent forgery, alteration, or damage of personal information
- Establishing and implementing systems such as backup/recovery so that the accuracy/completeness of personal information can be ensured even when unlawful changes or damage to personal information occur due to external hacking, misuse/abuse of privileges by insiders, disasters/calamities, etc.
- Applying administrative/technical measures to prevent errors such as incorrect entry when personal information is changed by a personal information handler
- Establishing and implementing procedures to update the data subject's personal information accordingly when the data subject changes their name or resident registration number due to a name change or a resident registration number leak, etc.
A method shall be provided for the data subject to maintain the accuracy, completeness, and up-to-dateness of their own personal information.
- Posting notices so that personal information is corrected/updated periodically through the website
- Providing various methods (online, offline, etc.) so that the data subject can easily view and change the registration status of their own personal information
- Establishing and implementing a secure identity verification procedure when personal information is changed
- Posting the changes to and revision history of the privacy policy so that the data subject can easily recognize the status of the personal information being collected and processed
Related laws
- Personal Information Protection Act Article 3 (Principles for Protecting Personal Information)
Evidence (examples)
- Data subject personal information correction/change forms (online, offline)
- Procedures for maintaining the up-to-dateness of personal information
Nonconformity examples
- The case where an identity verification procedure is applied when changing member information through the internet website, but the identity verification procedure is inadequate when changing member information through a call with a customer center agent, making unlawful changes to member information possible
- The case where a method to change personal information is provided for online members, but no method to change personal information is provided for offline members