Policy Establishment

The top-level information security and personal information protection policy, which includes the basis for all information security and personal information protection activities performed by the organization, shall be established to include the following contents.

• The will and direction of management, including the chief executive officer, regarding the organization's information security and personal information protection
• The roles/responsibilities and targets/scope for the organization's information security and personal information protection
• The basis for the managerial/technical/physical information security and personal information protection activities performed by the organization

Lower-level implementation documents such as guidelines, procedures, manuals, and guides that stipulate the detailed methods, procedures, cycles, performing entities, etc. necessary to specifically implement the information security and personal information protection matters specified in the information security and personal information protection policy shall be established in accordance with the organization's characteristics.

• Lower-level implementation documents shall be able to specifically present the basis for all information security and personal information protection activities performed by the organization, and shall be established in accordance with the organization's characteristics from various perspectives, such as the protection-target perspective or the performing-entity perspective.

  • ※ Lower-level implementation documents (examples)

  Protection-target perspective	Performing-entity perspective
  Server security guideline Network security guideline Database security guideline Application security guideline Web service security guideline Cloud security guideline	Employee security guideline Developer security guideline Operator security guideline, etc.

• The policies and implementing documents (guidelines, procedures, etc.) shall reflect the legal requirements related to personal information protection (statutes, enforcement decrees, enforcement rules, subordinate public notices, guides, etc.) relevant to the services, business, etc. provided by the organization.

• When personal information is processed, an internal management plan pursuant to the Personal Information Protection Act shall be established, including all matters required by the relevant laws and regulations.

  • Matters that must be included in the internal management plan pursuant to the Personal Information Protection Act
    1. Matters concerning the composition and operation of the personal information protection organization
    2. Matters concerning the qualification requirements for and the designation of the Chief Privacy Officer
    3. Matters concerning the roles and responsibilities of the Chief Privacy Officer and personal information handlers
    4. Matters concerning the management/supervision and training of personal information handlers
    5. Matters concerning the management of access rights
    6. Matters concerning access control
    7. Matters concerning encryption measures for personal information
    8. Matters concerning the retention and inspection of access records
    9. Matters concerning the prevention of malicious programs, etc.
    10. Matters concerning vulnerability assessment to prevent the leakage, theft, etc. of personal information
    11. Matters concerning physical safeguards
    12. Matters concerning the establishment/implementation of a personal information leakage incident response plan
    13. Matters concerning risk analysis and management
    14. Matters concerning the management and supervision of trustees when personal information processing tasks are entrusted
    15. Matters concerning the establishment, modification, and approval of the personal information internal management plan
    16. Other matters necessary for personal information protection
    • ※ However, for small business owners/individuals/organizations that process personal information concerning fewer than 10,000 data subjects, this may be omitted.

Upon the establishment/amendment of the information security and personal information protection policy/implementing documents, approval shall be obtained from the chief executive officer or a person delegated with authority by the chief executive officer.

• When establishing/amending the policy and implementing documents, the relevant contents shall be sufficiently consulted/reviewed with stakeholders.
• The impact on the organization's operations and services and legal compliance, etc. arising from changes to the policy and implementing documents shall be considered.
• Records of reviewed matters, such as meeting minutes, shall be kept and the relevant matters shall be reflected in the policy/guidelines, etc.
• The reviewed policy and implementing documents shall be reported to and approved by management.

Upon the establishment/amendment of the information security and personal information protection policy/implementing documents, the latest version shall be provided to relevant employees in an easily understandable form.

• It shall be provided in a form that employees and external parties can easily refer to (electronic bulletin board, booklet, training materials, manuals, etc.).
• When establishment/amendment matters arise for the policy and implementing documents, they shall be announced immediately and the latest version shall be maintained.