Notification to Data Subjects
Certification criterion
The matters that must be notified to the data subject, such as the details of use/provision of personal information, shall be identified and such details shall be notified periodically.
Key checkpoints
- Where subject to a legal obligation, is the data subject periodically notified of the details of use/provision of personal information, or of the method to access the information system through which such details can be verified?
- Do the items notified regarding the details of use/provision of personal information include all legally required items?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.5.3 Notification to Data Subjects], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
Where subject to a legal obligation, the data subject shall be periodically notified of the details of use/provision of personal information, or of the method to access the information system through which such details can be verified.
- Legal requirements related to notification of the details of use/provision of personal information
| Field | Value |
|---|---|
| Parties subject to the notification obligation | 1. A party that processes sensitive information or unique identifying information concerning 50,000 or more data subjects 2. A party that processes personal information concerning 1,000,000 or more data subjects ※ The number of data subjects is calculated based on the daily average over the immediately preceding 3 months as of the end of the previous year (however, effective from January 1, 2024) |
| Notification method | 1. A method by which the data subject can easily verify the notified content, such as in writing/email/telephone/text message 2. A method of notifying via a notification window so that the data subject can easily become aware of it in the course of providing goods and services (limited to cases where the method to access the information system through which the details of use/provision of personal information under Article 20-2(1) of the Act can be verified is notified) |
| Notification cycle | At least once a year |
| Notification exceptions | 1. A data subject who has expressed an intention to refuse the notification 2. Where a personal information controller has processed the personal information of its own executives and employees for the performance of its duties, the data subject concerned 3. Where a personal information controller has processed personal information such as the contact details of executives, employees, or individuals of another public institution, corporation, or organization for the performance of its duties, the data subject concerned 4. The data subject of personal information used/provided where there is a special provision in a law or in order to comply with an obligation under statutes 5. The data subject of personal information used/provided by a public institution for the performance of duties under its jurisdiction as prescribed by statutes, etc. ※ Where personal information that can be used to notify the data subject, such as contact details, has not been collected/retained |
The items notified regarding the details of use/provision of personal information shall include all legally required items.
- Items notified regarding the details of use/provision of personal information
- The purpose of collection/use of personal information and the items of personal information collected
- The party to whom personal information was provided, the purpose of such provision, and the items of personal information provided (however, information provided pursuant to Articles 13, 13-2, and 13-4 of the "Protection of Communications Secrets Act" and Article 83(3) of the "Telecommunications Business Act" is excluded)
Related laws
- Personal Information Protection Act Article 20-2 (Notification of the Details of Use/Provision of Personal Information)
Evidence (examples)
- Records of notification of the details of use/provision of personal information
- Forms and wording for notification of the details of use/provision of personal information
Nonconformity examples
- Where a party stores/manages personal information concerning 1,000,000 or more persons on a daily average over the immediately preceding 3 months as of the end of the previous year, and thus is subject to the obligation to notify the details of use/provision of personal information, yet did not notify the details of use/provision of personal information in the current year
- Where, instead of directly notifying the details of use/provision of personal information to individual data subjects, a party merely provided guidance through a simple pop-up window or a separate notice on its website