Disclosure of the Privacy Policy

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.5.1 Disclosure of the Privacy Policy], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

The privacy policy must be written specifically and clearly in easy-to-understand terms, including all matters required by law.

• Mandatory matters to be included in the privacy policy (refer to Article 30 of the Personal Information Protection Act and Article 31 of its Enforcement Decree)

  1. The purposes of processing personal information
  2. The processing and retention periods of personal information
  3. Matters concerning the provision of personal information to third parties (specified only where applicable.)
  4. The procedures and methods for destroying personal information (where personal information must be retained pursuant to the proviso of Article 21(1) of the Act, this includes the grounds for retention and the personal information items retained.)
  5. The possibility of disclosure of sensitive information under Article 23(3) of the Act and the method of choosing non-disclosure (specified only where applicable.)
  6. Matters concerning the outsourcing of personal information processing (specified only where applicable.)
  7. Matters concerning the processing of pseudonymized information under Articles 28-2 and 28-3 of the Act (specified only where applicable.)
  8. Matters concerning the rights/obligations of data subjects and legal representatives and how to exercise them
  9. The name of the Chief Privacy Officer under Article 31, or the name, telephone number, and other contact details of the department that handles personal information protection tasks and related grievances
  10. Matters concerning the installation/operation of devices that automatically collect personal information, such as internet access information files, and how to refuse them (specified only where applicable.)
  11. The items of personal information processed
  12. Matters concerning measures to ensure the safety of personal information under Article 30 of the Enforcement Decree

• Other matters to be included in the privacy policy (Article 19 of the Standard Personal Information Protection Guidelines)

  1. Where cross-border transfer is necessary in order to outsource the processing/storage of personal information pursuant to Article 28-8(1)3 of the Act, the matters set out in each subparagraph of Article 28-8(2) of the Act (specified only where applicable)
  2. Matters concerning changes to the privacy policy
  3. Where a domestic representative is designated pursuant to Article 31-2(1) of the Act, the name, address, telephone number, and email address of the domestic representative (specified only where applicable)
  4. Matters concerning the rights/obligations of data subjects and legal representatives and how to exercise them, such as the right to request access to, correction/deletion of, and suspension of processing of personal information
  5. The department that receives/handles requests for access to personal information
  6. Remedies for infringement of data subjects' rights and interests

• For personal information that may be processed without the consent of the data subject, disclose in the privacy policy the items and the legal basis for processing them, distinguishing them from personal information processed with the consent of the data subject

• The contents of the privacy policy, such as the purposes of processing personal information, the items of personal information processed, and matters concerning provision to third parties, must match the actual status of personal information processing, and must be written specifically and clearly in easy-to-understand terms reflecting the characteristics of the service and the data subjects

  1. Establish specifically and appropriately the matters that the Act requires to be included in the privacy policy, such as the grounds for processing personal information and the guarantee of data subjects' rights
  2. Establish the privacy policy in clear and easy-to-understand language so that data subjects can readily understand it

• Where an exception under the Personal Information Protection Act applies, the privacy policy need not be established

  ※ Personal information files exempt from the requirement to establish a privacy policy (public institutions)

  1. Personal information files recording matters concerning national security, diplomatic secrets, or other significant national interests
  2. Personal information files recording matters concerning criminal investigation, the institution and maintenance of public prosecution, the execution of punishment and custody, correctional dispositions, protective dispositions, security surveillance dispositions, and immigration control
  3. Personal information files recording matters concerning the investigation of offenses under the "Punishment of Tax Evaders Act" and the investigation of offenses under the "Customs Act"
  4. Personal information files that are recognized as having a low need for continuous management, such as files operated on a one-off basis, as prescribed by Presidential Decree
     • Personal information files operated for the performance of simple tasks, such as paying attendance allowances for meetings, sending materials/goods, or settling money, that have a low need for continuous management
     • Personal information files processed temporarily where urgently necessary for public safety and welfare, such as public health
     • Other personal information files collected solely for the one-off handling of tasks that are not stored or recorded
  5. Personal information files classified as confidential under other statutes

Accessibility must be ensured so that data subjects can easily check the privacy policy, and it must be disclosed on the internet website, etc., in a manner kept continuously up to date.

• Use the standardized designation "privacy policy"

• Where it is disclosed on the front page of the internet website, display it using font size, color, etc., to distinguish it from other notices so that data subjects can easily check it

• Where an internet website is not operated, the privacy policy may be disclosed through other methods prescribed by law

  ※ Methods of disclosing the privacy policy where it cannot be posted on an internet website (Article 31(3) of the Enforcement Decree)

  • Posting it in a conspicuous place at the business site, etc., of the personal information controller
  • Publishing it in the official gazette (only where the personal information controller is a public institution) or in a general daily newspaper, general weekly newspaper, or internet newspaper under Article 2, Subparagraph 1, Item (a)/Item (c) and Subparagraph 2 of the same Article of the "Act on the Promotion of Newspapers, etc." whose main distribution area is a region at or above the level of the city/province where the personal information controller's business site, etc., is located
  • Continuously publishing it in a publication/newsletter/promotional material issued at least twice a year under the same title and distributed to data subjects, or in bills, etc.
  • Publishing it in a contract, etc., prepared by the personal information controller and the data subject for the provision of goods or services and issuing it to the data subject

When the privacy policy is changed, the reasons and the details of the change must be announced without delay, and measures must be taken so that data subjects can easily identify the changes at any time.

• Disclose the changes by comparing the before and after so that data subjects can easily check the changes at any time

  ※ Methods of announcing the reasons for and details of changes to the privacy policy (examples)

  • Announcing them through the notices section on the front page of the internet website or through a separate window
  • Announcing them to data subjects in writing/by fax/by email or by a similar method
  • Writing them on a notice or placing them in a conspicuous place within the store/office