Processing of Pseudonymized Information

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.2.5 Processing of Pseudonymized Information], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

When processing pseudonymized information, the organization must establish/implement procedures for appropriately processing pseudonymized information, such as purpose limitation, pseudonymization methods and criteria, adequacy review, prohibition of re-identification, and measures in the event of re-identification.

• "Pseudonymization" means processing personal information by methods such as deleting part of it or replacing part or all of it, so that a specific individual cannot be identified without additional information.

• "Pseudonymized information" means information that, as a result of pseudonymizing personal information, cannot identify a specific individual without the use/combination of additional information for restoration to the original state; it is included in the category of personal information.

• Under the special provisions on the processing of pseudonymized information, pseudonymized information may be processed, including used/provided, without the consent of the data subject for three purposes: compiling statistics, scientific research, and preservation of records for the public interest.

• Because pseudonymized information that may be processed without the consent of the data subject under the special provisions on the processing of pseudonymized information is limited to purposes such as compiling statistics, scientific research, and preservation of records for the public interest, retaining personal information by pseudonymizing it in a situation where no processing purpose has been set cannot be regarded as processing based on the special provisions on the processing of pseudonymized information.

• Establishment and implementation of pseudonymization procedures to guarantee an appropriate level of pseudonymization, taking into account the processing purpose, the use environment, and the characteristics of the data.

• Example of pseudonymization procedures (Guidelines on the Processing of Pseudonymized Information)

Step	Category	Description
1	Advance preparation such as setting the purpose	/ Set the purpose of processing pseudonymized information specifically and clearly among the three purposes prescribed by the Personal Information Protection Act (compiling statistics, scientific research, preservation of records for the public interest, etc.) / Select the objects of pseudonymization by clarifying the type and scope of information necessary to achieve the processing purpose / Review the suitability of the processing purpose / Implement safety measures for processing pseudonymized information (establishing an internal management plan on the processing of pseudonymized information, etc.) / Prepare necessary documents (preparing an entrustment contract when entrusting the processing of pseudonymized information, etc.)
2	Review of the risk of the object of processing	/ Select the personal information files and personal information items subject to pseudonymization / Review the risk of the data subject to pseudonymization 　(1) Risk of identification from the data itself: identifying information, potentially identifying information, unusual information, impact upon re-identification, etc. 　(2) Risk of identification in the processing environment: form of use (internal use, external provision, external combination, etc.), place of processing, method of processing
3	Pseudonymization	/ Based on the results of the identification risk review, set an item-by-item pseudonymization plan by determining the pseudonymization methods and levels necessary to achieve the purpose of using the pseudonymized information / Perform pseudonymization based on the item-by-item pseudonymization plan / Additional information generated during the pseudonymization process is, in principle, destroyed, and where necessary stored separately from the pseudonymized information
4	Adequacy review	/ Finally review the adequacy of the pseudonymization results / The adequacy review of pseudonymization may be conducted internally using in-house personnel or through external experts (however, it is recommended to form a review committee of at least three persons) / If the adequacy review determines that the result is inadequate, perform additional pseudonymization and then conduct the adequacy review again
5	Safe management	/ Fulfill the obligation of safety measures for pseudonymized information in accordance with the internal management plan established in the advance preparation step (separate storage or deletion of additional information, separation of access rights, etc.) / Prohibit re-identification and monitor the possibility of re-identification / If information that can identify a specific individual is generated during the processing of pseudonymized information, immediately stop processing that information and recover/destroy it without delay / Prepare and retain records related to the processing of pseudonymized information / Disclose matters concerning the processing of pseudonymized information in the privacy policy, etc.

• Where separate guidelines on the processing of pseudonymized information exist for the relevant field, the content of those guidelines is applied first.
  • Guidelines on the Use of Health and Medical Data (Ministry of Health and Welfare), Guidelines on the Processing of Pseudonymized/Anonymized Information in the Education Sector (Ministry of Education), Practical Guide to the Provision of Pseudonymized Information in the Public Sector (Ministry of the Interior and Safety), Guide to Pseudonymization/Anonymization in the Financial Sector (Financial Services Commission), etc.

When pseudonymizing personal information for use/provision, pseudonymization must be performed in an appropriate manner so that individuals cannot be identified without the use/combination of additional information.

• Personal identifying information is deleted, or where necessary for combination and similar purposes, replaced with a value that cannot identify a specific individual but allows distinction, through methods such as generating random values or hash values.

• Where potentially identifying personal information is not strictly necessary for the purpose of processing pseudonymized information, it is deleted; the remaining potentially identifying personal information is pseudonymized using an appropriate method and level, taking into account the processing purpose and the risk of identification.

  ※ Examples of pseudonymization/anonymization methods (Guidelines on the Processing of Pseudonymized Information)

  • (Deletion techniques) deletion, partial deletion, row/item deletion, local deletion, masking
  • (Statistical tools) aggregation, partial aggregation
  • (Generalization techniques) general rounding, random rounding, controlled rounding, top/bottom coding, local generalization, range methods, categorization of character data
  • (Encryption) two-way encryption, one-way encryption/cryptographic hash functions, order-preserving encryption, format-preserving encryption, homomorphic encryption, polymorphic encryption
  • (Randomization techniques) noise addition, permutation (substitution), tokenization, (pseudo) random number generators
  • (Other techniques) sampling, anatomization, synthetic data, homomorphic secret sharing, differential privacy, etc.

When combining pseudonymized information with another personal information controller, the combination must be performed through a specialized combination agency or a data specialized agency.

• Where pseudonymized information held by different personal information controllers is to be combined and used for purposes such as compiling statistics, scientific research, and preservation of records for the public interest, the combination is performed through a specialized combination agency designated by the Personal Information Protection Commission or the head of a relevant central administrative agency.
  • Status of specialized combination agencies: refer to the Comprehensive Support System for the Combination of Pseudonymized Information (link.privacy.go.kr)
  • When combining with a data set held by a financial company, the combination is performed through a data specialized agency under the Credit Information Use and Protection Act.
• Procedures for the combination of pseudonymized information (Guidelines on the Processing of Pseudonymized Information)

Step	Category	Description
1	Combination application	/ The combination applicant confirms the advance preparation matters necessary for the combination of pseudonymized information, such as consultation among applicants on matters required for the combination application and preparation of the combination application form, and applies to the specialized combination agency for the combination / Options such as mock combination, confirmation of the combination rate, and extraction of pseudonymized information may be selected
2	Combination and additional processing	/ The combination applicant providing the pseudonymized information receives the information used to generate the combination key (Salt value) from the combination key management agency, generates the combination key, and once the mock combination, confirmation of the combination rate, extraction of pseudonymized information, and other options selected at the time of application are completed, transmits the information necessary for combination to each agency
3	Export and use	/ When intending to export the combined information or analysis results, the applicant applies to the specialized combination agency for export
4	Safe management	/ The combination applicant using the combined information processes the exported combined information (hereinafter "exported information") in accordance with the purposes stated in the original combination application form and export application form, and complies with obligations such as safety measures

When processing pseudonymized information, the organization must delete additional information or store/manage it separately and must take the technical/administrative/physical measures necessary to secure safety, such as preparing/retaining related records.

• (Administrative protective measures) Establishing/implementing an internal management plan to safely manage pseudonymized information and additional information, managing/supervising trustees who process pseudonymized information, including clauses such as prohibition of re-identification in contracts when entrusting the processing of pseudonymized information and when providing it to third parties, establishing and disclosing a privacy policy related to the processing of pseudonymized information, and providing education on the protection of pseudonymized information.

  ※ Matters to be included in an entrustment contract for the processing of pseudonymized information (examples)

  1. Prohibition of processing beyond the purpose of performing the entrusted work
  2. Safety measures for pseudonymized information
  3. Purpose and scope of the entrusted work
  4. Restriction on re-entrustment
  5. Matters concerning management/supervision
  6. Matters concerning liability, such as damages, in the event the trustee violates the obligations it must comply with
  7. Prohibition of re-identification
  8. Notification in the event of a re-identification risk

• (Technical protective measures) Measures such as separate storage or deletion of additional information, separation of access rights to pseudonymized information and additional information, and preparation/retention of records related to the processing of pseudonymized information.

  • Matters to be included in records related to the processing of pseudonymized information (Article 29-5(2) of the Enforcement Decree of the Personal Information Protection Act)
    1. The purpose of processing the pseudonymized information
    2. The items of pseudonymized personal information
    3. The use history of the pseudonymized information
    4. The recipient in the case of provision to a third party
    5. The processing period of the pseudonymized information (limited to cases where the processing period is separately set under Article 28-4(2) of the Act)
    6. Other matters that the Protection Commission recognizes as necessary and publishes by notice in order to manage the details of processing of pseudonymized information ※ Records related to the processing of pseudonymized information are retained for at least three years from the date the pseudonymized information is destroyed.

• (Physical protective measures) Where pseudonymized information or additional information is stored in a computer room or data storage room, establishing/implementing procedures such as access control to protect it from access by unauthorized persons, etc.

• (Other protective measures) Since pseudonymized information also constitutes personal information, implementing the standards for measures to secure the safety of personal information under Article 29 of the Personal Information Protection Act, prohibiting pseudonymization for the purpose of identifying a specific individual, etc.

• (Re-identification monitoring, etc.) If information that can identify a specific individual is generated during the processing of pseudonymized information, immediately stopping the processing of that information and recovering/destroying it without delay, etc.

Considering the purpose of processing pseudonymized information and other factors, the organization must set the processing period of pseudonymized information as an appropriate period, and must destroy the information without delay once that period has elapsed.

• The processing period of pseudonymized information is set appropriately as the period necessary to achieve the purpose of processing the pseudonymized information.
• Once the processing period of pseudonymized information has elapsed, it is destroyed without delay.

When anonymizing personal information, anonymization must be performed at an appropriate level so that a specific individual can no longer be identified even by using other information, taking into account time/cost/technology and other factors on a reasonable basis.

• "Anonymized information" means information that can no longer identify an individual even by using other information, taking into account time/cost/technology and other factors on a reasonable basis.
  • [Reference] Article 58-2 of the Personal Information Protection Act (Exclusion from Application)
    • This Act does not apply to information that can no longer identify an individual even by using other information, taking into account time/cost/technology and other factors on a reasonable basis.
• When performing anonymization, personal identifying information must be deleted, and potentially identifying personal information must be anonymized at an appropriate level by using anonymization methods in combination.
• To guarantee the adequacy of anonymization, the organization may establish and implement procedures for reviewing the adequacy of anonymization, such as forming a review committee composed of internal/external experts.