Statutes of the Republic of Korea

No. 35343
Promulgation Date 2025-02-25
Personal Information Protection Commission

ALL

CHAPTER I GENERAL PROVISIONS

Article 1 (Purpose)

Article 2 (Scope of public institutions)

Article 3 (Scope of visual data processing devices)

CHAPTER II PERSONAL INFORMATION PROTECTION COMMISSION

Article 4 Deleted.

Article 4-2 (Prohibition on work for profit)

Article 5 (Expert committees)

Article 5-2 (Personal Information Protection Policy Council)

Article 5-3 (City/Do inter-agency personal information protection council)

Article 6 (Disclosure of proceedings)

Article 7 (Dispatch of public officials)

Article 8 Deleted.

Article 9 (Allowances for attendance)

Article 9-2 (Procedures for advising improvement of policies, systems, statutes, and regulations)

Article 9-3 (Procedures for assessment of personal information breach incident factors)

Article 10 Deleted.

CHAPTER III PROCEDURES TO ESTABLISH MASTER PLANS AND IMPLEMENTATION PLANS

Article 11 (Procedures to establish master plans)

Article 12 (Procedures to establish implementation plans)

Article 13 (Scope of materials requested and methods of request)

Article 13-2 (Subject matters, standards, methods, and procedures for evaluation of level of personal information protection)

Article 14 (Promotion and support of self-regulation)

CHAPTER IV PROCESSING OF PERSONAL INFORMATION

Article 14-2 (Standards on additional use and provision of personal information)

Article 15 (Control of out-of-purpose use of personal information or provision thereof to third parties)

Article 15-2 (Matters subject to notification, such as sources of personal information collected, and methods and procedures for notification)

Article 15-3 (Notification of details of use and provision of personal information)

Article 16 (Methods of destroying personal information)

Article 17 (Methods of obtaining consent)

Article 17-2 (Protection of children's personal information)

Article 18 (Scope of sensitive information)

Article 19 (Scope of personally identifiable information)

Article 20 Deleted.

Article 21 (Measures to ensure safety of personally identifiable information)

Article 21-2 (Persons who must encrypt resident registration numbers)

Article 22 (Exception to restriction on installation and operation of fixed visual data processing devices)

Article 23 (Gathering opinions on installation of fixed visual data processing devices)

Article 24 (Posting of notice on signboard)

Article 25 (Policy on operation and management of fixed visual data processing devices)

Article 26 (Entrustment of installation and operation of fixed visual data processing devices by public institutions)

Article 27 (Exception to restriction on operation of mobile visual data processing devices)

Article 27-2 (Indication of photographing with mobile visual data processing devices)

Article 27-3 (Guidelines for installing and operating visual data processing devices)

Article 28 (Measures to be taken when entrusting personal information processing)

Article 29 (Notification of transfer of personal information following business transfer)

CHAPTER IV-2 SPECIAL CASES CONCERNING PROCESSING OF PSEUDONYMIZED INFORMATION

Article 29-2 (Designation and cancellation of designation of expert data combination agency)

Article 29-3 (Combination and release of pseudonymized information processed by different personal information controllers)

Article 29-4 (Management, and supervision of expert data combination agency)

Article 29-5 (Measures to ensure safety of pseudonymized information)

Article 29-6 Deleted.

CHAPTER IV-3 Cross-Border Transfer of Personal Information

Article 29-7 (Means of notifying data subjects in cases of cross-border entrusted processing or storage of personal information)

Article 29-8 (Certification of cross-border transfer of personal information)

Article 29-9 (Recognition of countries' personal information protection levels)

Article 29-10 (Protective measures in cases of cross-border transfers of personal information)

Article 29-11 (Standards for orders to suspend cross-border transfers)

Article 29-12 (Filing objections to orders to suspend cross-border transfers)

CHAPTER V SAFEGUARD OF PERSONAL INFORMATION

Article 30 (Measures to ensure safety of personal information)

Article 30-2 (Measures to ensure safety of personal information taken by institutions operating public systems)

Article 31 (Details of privacy policy and methods for disclosure thereof)

Article 31-2 (Those subject to, and procedures for, evaluation of privacy policy)

Article 32 (Work of privacy officer and requirements for designation)

Article 32-2 (Scope of business of council of privacy officers)

Article 32-3 (Scope of persons subject to designation of domestic agents)

Article 33 (Registered matters of personal information files)

Article 34 (Registration and disclosure of personal information files)

Article 34-2 (Criteria, method, and procedure for certification of personal information protection)

Article 34-3 (Fees for certification of personal information protection)

Article 34-4 (Revocation of certification)

Article 34-5 (Follow-up management of certification)

Article 34-6 (Institutions specializing in certifying personal information protection)

Article 34-7 (Certification mark and promotion)

Article 34-8 (Qualifications for certification examiners for personal information protection and grounds for disqualification)

Article 35 (Object of privacy impact assessment)

Article 36 (Designation of assessment institutions and revocation of designation)

Article 37 (Consideration at the time of privacy impact assessment)

Article 38 (Criteria for privacy impact assessment)

Article 39 (Notification of divulgence of personal information)

Article 40 (Reporting on divulgence of personal information)

Article 40-2 (Institution requesting erasure and blocking of exposed personal information)

CHAPTER VI GUARANTEE OF RIGHTS OF DATA SUBJECTS

Article 41 (Procedures for access to personal information)

Article 42 (Limitation to, and postponement and denial of, access to personal information)

Article 42-2 (Standards for information transmitters)

Article 42-3 (Standards for general recipients)

Article 42-4 (Scope of information subject to request for transmission)

Article 42-5 (Methods of requesting transmission)

Article 42-6 (Deadline and methods of transmission of personal information)

Article 42-7 (Provisions of statutes excluded from application at time of request for transmission)

Article 42-8 (Rejection of request for transmission and suspension of transmission)

Article 42-9 (Business affairs of institutions specializing in managing personal information)

Article 42-10 (Application for designation of institution specializing in managing personal information)

Article 42-11 (Detailed criteria for designation of institutions specializing in managing personal information)

Article 42-12 (Designation of institutions specializing in managing personal information)

Article 42-13 (Prohibited acts for institutions specializing in managing personal information)

Article 42-14 (Revocation of designation of institutions specialized in managing personal information)

Article 42-15 (Management and supervision of Protection Committee on requests for transmission of personal information)

Article 42-16 (Establishment and operation of personal information transmission support platform)

Article 43 (Correction, and erasure of personal information)

Article 44 (Suspension of processing personal information)

Article 44-2 (Methods and procedures for requesting refusal, and explanation of automated decisions)

Article 44-3 (Measures following request for refusal, and explanation)

Article 44-4 (Disclosure of standards and procedures for automated decisions)

Article 45 (Scope of representative)

Article 46 (Confirmation of data subjects or representatives)

Article 47 (Amounts of fees)

Article 48 (Establishing access request support system)

CHAPTER VI-2 Deleted.

Article 48-2 Deleted.

Article 48-3 Deleted.

Article 48-4 Deleted.

Article 48-5 Deleted.

Article 48-6 Deleted.

Article 48-7 (Scope, and standards of the parties required to purchase an insurance for performance of damage compensation responsibilities)

Article 48-8 Deleted.

Article 48-9 Deleted.

Article 48-10 Deleted.

Article 48-11 Deleted.

Article 48-12 Deleted.

Article 48-13 Deleted.

CHAPTER VII PERSONAL INFORMATION DISPUTE MEDIATION

Article 48-14 (Ex officio members)

Article 49 (Composition and operation of mediation panels)

Article 49-2 (Specialized committee for dispute mediation)

Article 50 (Secretariat)

Article 51 (Operation of Dispute Mediation Committee)

Article 51-2 (Notification of intention not to respond to mediation)

Article 51-3 (Secretariat of, and investigation and inspection by, Dispute Mediation Committee)

Article 51-4 (Notification of intention to reject proposal of mediation)

Article 52 (Incidents eligible for collective dispute mediation)

Article 53 (Commencement of collective dispute mediation proceedings)

Article 54 (Applications for participation in collective dispute mediation proceedings)

Article 55 (Collective dispute mediation proceedings)

Article 56 (Allowances and travel expenses)

Article 57 (Dispute mediation rule)

CHAPTER VIII SUPPLEMENTARY PROVISIONS AND PENALTY PROVISIONS

Article 58 (Recommendation for improvements and disciplinary action)

Article 59 (Reporting on infringements)

Article 60 (Requests for materials and inspections)

Article 60-2 (Criteria for calculation of penalty surcharges)

Article 60-3 (Imposition and payment of penalty surcharges)

Article 60-4 (Extensions of payment deadline for penalty surcharges and payment by installment)

Article 60-5 (Interest rate on additional refund)

Article 61 (Publication of results)

Article 62 (Entrustment of work)

Article 62-2 (Processing of sensitive information and personally identifiable information)

Article 62-3 (Re-examination of regulation)

Article 63 (Criteria for imposition of administrative fines)

ADDENDA <Presidential Decree No. 23169, Sep. 29, 2011>

ADDENDA <Presidential Decree No. 24425, Mar. 23, 2013>

ADDENDUM <Presidential Decree No. 25531, Aug. 6, 2014>

ADDENDA <Presidential Decree No. 25751, Nov. 19, 2014>

ADDENDA <Presidential Decree No. 25840, Dec. 9, 2014>

ADDENDA <Presidential Decree No. 26140, Mar. 11, 2015>

ADDENDUM <Presidential Decree No. 26728, Dec. 22, 2015>

ADDENDUM <Presidential Decree No. 26776, Dec. 30, 2015>

ADDENDA <Presidential Decree No. 27370, Jul. 22, 2016>

ADDENDUM <Presidential Decree No. 27522, Sep. 29, 2016>

ADDENDA <Presidential Decree No. 28074, May 29, 2017>

ADDENDUM <Presidential Decree No. 28150, Jun. 27, 2017>

ADDENDA <Presidential Decree No. 28211, Jul. 26, 2017>

ADDENDA <Presidential Decree No. 28355, Oct. 17, 2017>

ADDENDUM <Presidential Decree No. 29421, Dec. 24, 2018>

ADDENDUM <Presidential Decree No. 30509, Mar. 3, 2020>

ADDENDUM <Presidential Decree No. 30833, Jul. 14, 2020>

ADDENDA <Presidential Decree No. 30892, Aug. 4, 2020. >

ADDENDUM <Presidential Decree No. 31429, Feb. 2, 2021>

ADDENDUM <Presidential Decree No. 32528, Mar. 8, 2022>

ADDENDA <Presidential Decree No. 32813, Jul. 19, 2022>

ADDENDA <Presidential Decree No. 33723, Sep. 12, 2023>

ADDENDA <Presidential Decree No. 34309, Mar. 12, 2024>

ADDENDA <Presidential Decree No. 35343, Feb. 25, 2025>