Outsourcing of Personal Information Processing Tasks

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.3.2 Outsourcing of Personal Information Processing Tasks], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

When personal information processing tasks are outsourced to a third party (including re-outsourcing), the content of the outsourced tasks and the trustee must be kept current and continuously disclosed on the Internet homepage, etc., so that the data subject can easily verify them at any time.

• Matters to be notified to the data subject

  1. The content of the outsourced tasks
  2. The party that is entrusted with and processes the personal information processing tasks (trustee)
     • ※ The 'trustee' includes a third party (re-trustee) who is again entrusted with the tasks by the party that was entrusted with and processes the personal information processing tasks

• Methods of disclosing personal information processing outsourcing matters (Article 28(2) and (3) of the Enforcement Decree of the Personal Information Protection Act)

  • Continuously posting the content of the outsourced tasks and the trustee on the trustor's Internet homepage
  • Methods of disclosure when it cannot be posted on the Internet homepage (using one or more of the following methods)
    1. Posting it in a place easy to view, such as the trustor's place of business
    2. Publishing it in the official gazette (only where the trustor is a public institution) or in a general daily newspaper, general weekly newspaper, or Internet newspaper under Article 2, Subparagraph 1, Item (a)/Item (c) and Subparagraph 2 of the same Article of the "Act on the Promotion of Newspapers, etc." whose main distribution area covers a region at or above the level of the city/province where the trustor's place of business, etc. is located
    3. Continuously including it in a publication/newsletter/promotional material or bill, etc. that is issued at least twice a year under the same title and distributed to data subjects
    4. Including it in a contract, etc. prepared by the trustor and the data subject for the provision of goods or services and issuing it to the data subject

• Points of caution

  • Even if there are many trustees, all of the relevant trustee names must be listed and disclosed
  • Where re-outsourcing exists, matters regarding the re-outsourcing must also be disclosed
  • Where the content of the outsourced tasks or the trustee changes, the changed content must be reflected without delay and disclosed through the Internet homepage, etc.

When tasks for promoting goods or services or soliciting sales are outsourced, the content of the outsourced tasks and the trustee must be notified to the data subject by means such as written document, e-mail, or text message.

• Method of notification : Methods such as written document (written document, e-mail, fax, telephone, text message, or equivalent methods)
• Matters notified : The content of the outsourced tasks, the trustee

※ For matters regarding the outsourcing contract related to the outsourcing of personal information processing tasks, the trustor's consent upon re-outsourcing, and management/supervision of the trustee, refer to the certification criteria in the 2.3 (External Party Security) section.