한국어
3.4.2

Measures When Retaining Personal Information After the Processing Purpose Is Achieved

Based on official sourcesISMS-PCheckpoints 4Evidence 3Cases 4

Certification criterion

When personal information is not destroyed but preserved in accordance with relevant laws even after the retention period has elapsed or the processing purpose has been achieved, it must be limited to the minimum items necessary for that purpose and must be stored/managed separately from other personal information.

Key checkpoints

  1. When personal information is not destroyed but preserved in accordance with relevant laws even after the retention period has elapsed or the processing purpose has been achieved, is it managed so that only the minimum information is preserved, limited to the minimum period prescribed by the relevant laws?
  2. When personal information is not destroyed but preserved in accordance with relevant laws even after the retention period has elapsed or the processing purpose has been achieved, are the relevant personal information or personal information files stored/managed separately from other personal information?
  3. Is the separately stored personal information managed so that it can be processed only within the scope of the purpose prescribed by law?
  4. For the separately stored personal information, is access authority limited to the minimum number of personnel?

Detailed explanation

When personal information is not destroyed but preserved in accordance with relevant laws even after the retention period has elapsed or the processing purpose has been achieved, it must be managed so that only the minimum information is preserved, limited to the minimum period prescribed by the relevant laws.

  • Limit the items of personal information to the minimum items appropriate for the retention purpose

  • Set the retention period to the minimum period prescribed by the relevant laws

    ※ Retention periods under other laws (examples)

    • Act on Consumer Protection in Electronic Commerce, etc. (1) Records on labeling/advertising : 6 months (2) Records on contracts or withdrawal of subscription, etc. : 5 years (3) Records on payment and supply of goods, etc. : 5 years (4) Records on consumer complaints or dispute handling : 3 years
    • Protection of Communications Secrets Act Log records of computer communications or the internet, and access location tracking data that can identify the location of information and communications devices : 3 months

When personal information is not destroyed but preserved in accordance with relevant laws even after the retention period has elapsed or the processing purpose has been achieved, the relevant personal information or personal information files must be stored/managed separately from other personal information.

  • Configure the separate database by physically or logically separating it

The separately stored personal information must be managed so that it can be processed only within the scope of the purpose prescribed by law.

  • Prohibit the use of separately stored personal information for other purposes such as marketing

For the separately stored personal information, access authority must be limited to the minimum number of personnel.

  • Minimize access authority, such as limiting the access authority to the separate database to the minimum number of personnel
  • Keep access records for the separate database and review them regularly, etc.

Related laws

  • Personal Information Protection Act Article 21 (Destruction of Personal Information)

Evidence (examples)

  • Regulations related to the retention period and destruction of personal information
  • Status of the separate database (table structure, etc.)
  • Status of access authority to the separate database

Nonconformity examples

  • A case where withdrawn members' information is not destroyed but retained for a certain period in accordance with the Electronic Commerce Act, yet only a flag value is changed and it is kept in the same table as other member information
  • A case where the legal requirements are misapplied for records on consumer complaints and dispute handling under the Electronic Commerce Act, so that they are set to be preserved for 5 years instead of 3 years
  • A case where a separate database is configured but access authority is not set separately, so that personnel who do not need business access can freely access the separate database
  • A case where withdrawn members' information is not destroyed but records on contracts or withdrawal of subscription, payment, and supply of goods are separated and preserved in accordance with the Electronic Commerce Act, yet even optional information that has no preservation obligation under the Electronic Commerce Act is excessively preserved

Source

Source: The certification criterion is based on [Annex 7] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2023.10.5); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2023.10.31); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7
Applies toISMS-P
Key checkpoints4
Evidence3
Cases4
Related lawsYes