한국어
3.3.4

Cross-Border Transfer of Personal Information

Based on official sourcesISMS-PCheckpoints 4Evidence 4Cases 3

Certification criterion

When personal information is transferred outside the country, appropriate protective measures such as consent to the cross-border transfer and disclosure of relevant matters must be established and implemented.

Key checkpoints

  1. When transferring personal information outside the country, does the organization inform the data subject of all the notification items concerning the cross-border transfer and obtain separate consent, or does it comply with lawful requirements such as certification or recognition?
  2. When informing the data subject about cross-border processing consignment/storage of personal information for the conclusion and performance of a contract with the data subject, does the organization inform them by an appropriate method including all necessary matters?
  3. Does the organization conclude a contract on the cross-border transfer that includes matters concerning compliance with personal information protection laws and the protection of personal information?
  4. When transferring personal information outside the country, does the organization take the measures necessary to protect personal information?

Detailed explanation

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.3.4 Cross-Border Transfer of Personal Information], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

When personal information is provided (including cases where it is accessed/queried), consigned for processing, or stored to a third party outside the country (hereinafter referred to as "transfer"), the organization must inform the data subject of all the notification items concerning the cross-border transfer and obtain separate consent, or must comply with lawful requirements such as certification or recognition.

  • Cases where cross-border transfer of personal information is permitted (Personal Information Protection Act Article 28-8(1))
No Category Description
1 Separate consent Where separate consent to the cross-border transfer has been obtained from the data subject
2 Grounds such as laws, treaties Where there are special provisions on the cross-border transfer of personal information in a law, a treaty to which the Republic of Korea is a party, or other international agreements
3 Disclosure in the privacy policy, etc. (processing consignment/storage) Where the consignment of processing/storage of personal information is necessary for the conclusion and performance of a contract with the data subject, and the relevant matters are disclosed in the privacy policy or communicated to the data subject by means such as email
4 Certification Where the recipient of the personal information has obtained certification designated and publicly notified by the Protection Commission, such as personal information protection certification (ISMS-P certification), and all of the following measures have been taken
a. Safety measures necessary for the protection of personal information and measures necessary to guarantee the rights of data subjects
b. Measures necessary to implement the certified matters in the country to which the personal information is transferred
5 Recognition of the destination country, etc. Where the Protection Commission recognizes that the personal information protection system, the scope of guarantee of data subject rights, the remedy procedures, etc. of the country or international organization to which the information is transferred are substantially equivalent to the level of personal information protection under this Act
  • When obtaining consent for the cross-border transfer of personal information, the organization must inform of all of the following five matters and obtain consent
    • Notification items when obtaining consent for the cross-border transfer of personal information (Personal Information Protection Act Article 28-8(2))
      1. The items of personal information to be transferred
      2. The country to which the personal information is transferred, and the timing and method of transfer
      3. The name of the recipient of the personal information (in the case of a corporation, its name and contact information)
      4. The purpose of use of personal information by the recipient and the retention/use period
      5. The method, procedure, and effect of refusing the transfer of personal information

When informing the data subject about cross-border processing consignment/storage of personal information for the conclusion and performance of a contract with the data subject, the organization must inform them by an appropriate method including all necessary matters.

  • Methods of informing the data subject

    1. Disclosure in the privacy policy
    2. Written or equivalent methods (in writing, by email, fax, telephone, text message, or an equivalent method)

  • Matters to be communicated to the data subject

    1. The items of personal information to be transferred
    2. The country to which the personal information is transferred, and the timing and method of transfer
    3. The name of the recipient of the personal information (in the case of a corporation, its name and contact information)
    4. The purpose of use of personal information by the recipient and the retention/use period
    5. The method, procedure, and effect of refusing the transfer of personal information

The organization must conclude a contract on the cross-border transfer that includes matters concerning compliance with personal information protection laws and the protection of personal information.

  • Consult in advance with the recipient regarding the following matters and reflect them in the contract content, etc.
    1. Measures to ensure safety for the protection of personal information under Article 30(1) of the Enforcement Decree of the Personal Information Protection Act
    2. Measures for handling grievances and resolving disputes concerning personal information infringement
    3. Other measures necessary to protect the personal information of data subjects

When transferring the personal information of a data subject outside the country, the organization must take the measures necessary to protect personal information.

  • Protective measures to be implemented for the cross-border transfer of personal information
    1. Compliance with the provisions of the Personal Information Protection Act concerning the cross-border transfer of personal information
    2. Compliance with the provisions of Articles 17 through 19 of the Personal Information Protection Act
    3. Compliance with the provisions of Chapter 5 (Guarantee of the Rights of Data Subjects) of the Personal Information Protection Act
    4. Measures to ensure safety for the protection of personal information under Article 30(1) of the Enforcement Decree of the Personal Information Protection Act
    5. Measures for handling grievances and resolving disputes concerning personal information infringement
    6. Other measures necessary to protect the personal information of data subjects

Related laws

  • Personal Information Protection Act Article 28-8 (Cross-border transfer of personal information), Article 28-9 (Order to suspend cross-border transfer of personal information), Article 28-10 (Reciprocity), Article 28-11 (Provisions applied mutatis mutandis)
  • Regulations on the Operation, etc. of Cross-border Transfer of Personal Information

Evidence (examples)

  • Consent form related to cross-border transfer of personal information
  • Contract related to cross-border transfer of personal information
  • Privacy policy
  • Notification or disclosure records related to cross-border processing consignment/storage of personal information

Nonconformity examples

  • Where, in the course of processing personal information, third-party provision of personal information to an overseas operator occurred, but separate consent to the cross-border transfer of personal information was not obtained even though the case did not fall under exceptions to consent such as certification or recognition of the destination country
  • Where, using an overseas cloud service (overseas region) to consign the processing and store personal information, relevant matters such as the country to which the information is transferred and the method of transfer were not disclosed in the privacy policy or communicated to the data subject
  • Where, when obtaining consent for the cross-border transfer of personal information, only the name of the recipient (company name) was notified, but the country to which the information is transferred, etc. was not communicated

Source

Source: The certification criterion is based on [Annex 7-3] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2024.7.24); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2024.7.24); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7-3
Applies toISMS-P
Key checkpoints4
Evidence4
Cases3
Related lawsYes
Annex 7 / 3.3.4Annex 7