한국어
1.4.1

Review of Compliance with Legal Requirements

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 6Cases 7

Certification criterion

The organization shall periodically identify the legal requirements related to information security and personal information protection that it must comply with, reflect them in its regulations, and continuously review compliance.

Key checkpoints

  1. Does the organization identify the legal requirements related to information security and personal information protection that it must comply with and keep them up to date?
  2. Is compliance with the legal requirements reviewed regularly, at least once a year?

Detailed explanation

The organization shall identify the legal requirements related to information security and personal information protection that it must comply with and keep them up to date.

  • Identify the laws and regulations related to information security and personal information protection that the organization must comply with

    ※ Laws related to information security and personal information protection (examples)

    • Act on Promotion of Information and Communications Network Utilization and Information Security (Network Act)
    • Personal Information Protection Act
    • Credit Information Use and Protection Act
    • Act on the Protection and Use of Location Information
    • Electronic Financial Transactions Act
    • Act on Consumer Protection in Electronic Commerce
    • Copyright Act
    • Act on the Protection of Information and Communications Infrastructure
    • Digital Signature Act
    • Act on Prevention of Divulgence and Protection of Industrial Technology
    • Unfair Competition Prevention and Trade Secret Protection Act
    • Act on the Promotion of the Information Security Industry
    • Act on the Development of Cloud Computing and Protection of Its Users
    • Electronic Government Act
    • Software Promotion Act
    • Protection of Communications Secrets Act
    • Telecommunications Business Act
    • Act on Reporting and Using Specified Financial Transaction Information
    • Act on the Protection of Virtual Asset Users, and others

  • Continuously monitor the enactment/amendment status of the relevant laws and regulations, analyze the impact on the organization when enactment/amendment occurs, and reflect it as necessary in internal policies/guidelines and checklists to keep them up to date

  • [Reference] Information Security Disclosure System

    • Basis: Article 13 (Information Security Disclosure) of the Information Security Industry Act and Article 8 of its Enforcement Decree

    • Disclosure contents: ▲Status of information security investment, ▲Status of information security personnel, ▲Matters concerning information security certification/evaluation/inspection, ▲Information security activities, prepared in the information security status form

    • Disclosure deadline: Submission of the information security status by June 30 each year (voluntary/mandatory disclosure)

    • Criteria for entities subject to mandatory information security disclosure (however, public institutions, small enterprises, financial companies, and some electronic financial business operators are exempt)

      Field Target Basis
      Business area Common telecommunications business operators (ISPs) holding line facilities ※ Article 6(1) of the Telecommunications Business Act
      Business area Integrated information and communications facility operators (IDCs) ※ Article 46 of the Network Act
      Business area Higher-level general hospitals ※ Article 3-4 of the Medical Service Act
      Business area Cloud computing service providers ※ Article 3, Subparagraph 1 of the Enforcement Decree of the Cloud Computing Act
      Revenue Listed corporations that have designated/reported a Chief Information Security Officer with revenue of KRW 300 billion or more
      Number of users Daily average of 1 million or more users of information and communications services (over the three months immediately preceding the end of the previous year)

Compliance with the legal requirements shall be reviewed regularly, at least once a year.

  • Establish and implement procedures for regularly reviewing compliance with the legal requirements (review cycle, targets, persons in charge, methods, etc.)
  • Promptly take corrective action on problems discovered as a result of the review of compliance with legal requirements

Related laws

  • Personal Information Protection Act Article 29 (Duty of Safety Measures)
  • Standards for Measures to Ensure the Safety of Personal Information Article 4 (Establishment/Implementation and Inspection of the Internal Management Plan)

Evidence (examples)

  • Records of the review of legal compliance
  • Review and revision history of information security and personal information protection policies/guidelines
  • Old/new comparison table of policies/guidelines
  • Materials for internal sharing of legal amendments
  • Evidence proving the guarantee of liability for personal information damages (cyber insurance agreement, etc.)
  • Records of information security disclosure

Nonconformity examples

  • The Network Act and the Personal Information Protection Act were recently amended, but the impact of the amendments on the organization was not reviewed, and the relevant content was not reflected in policy documents/implementation documents and the legal compliance checklist, so that the contents of the policy documents/implementation documents and the legal compliance checklist do not match the contents of the laws
  • A law that the organization must comply with was amended, but the review of compliance with that law was not performed for a long period
  • The review of legal compliance was not carried out appropriately, so that numerous violations of laws such as the Personal Information Protection Act were found
  • The organization became subject to the personal information damage liability guarantee system under the Personal Information Protection Act, but failed to recognize this and did not purchase insurance or set aside reserves; or purchased insurance but failed to comply with the minimum coverage amount criteria based on the number of users and revenue
  • The organization is a business operator subject to mandatory information security disclosure, but the information security disclosure was not carried out within the time prescribed by law
  • The organization receives users' personal location information from a location information provider through a mobile app and uses it in its service, but did not file a report for the location-based service business
  • Being a personal information controller without an address or place of business in Korea, and having a daily average of 1 million or more domestic data subjects whose personal information is stored/managed over the three months immediately preceding the end of the previous year, the organization was subject to the obligation to designate a domestic agent, yet did not designate a domestic agent in writing

Source

Source: The certification criterion is based on [Annex 7] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2023.10.5); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2023.10.31); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7
Applies toISMS / ISMS-P
Key checkpoints2
Evidence6
Cases7
Related lawsYes