Enforcement Decree of the Personal Information Protection Act

개인정보 보호법 시행령

Presidential Decree · 개인정보보호위원회 · English text effective 2025-03-13 · Korean current 2026-09-11

Articles

• CHAPTER I GENERAL PROVISIONS
• Article 1 Purpose
• Article 2 Scope of public institutions
• Article 3 Scope of visual data processing devices
• CHAPTER II PERSONAL INFORMATION PROTECTION COMMISSION
• Article 4 null
• Article 4-2 Prohibition on work for profit
• Article 5 Expert committees
• Article 5-2 Personal Information Protection Policy Council
• Article 5-3 City/Do inter-agency personal information protection council
• Article 6 Disclosure of proceedings
• Article 7 Dispatch of public officials
• Article 8 null
• Article 9 Allowances for attendance
• Article 9-2 Procedures for advising improvement of policies, systems, statutes, and regulations
• Article 9-3 Procedures for assessment of personal information breach incident factors
• Article 10 null
• CHAPTER III PROCEDURES TO ESTABLISH MASTER PLANS AND IMPLEMENTATION PLANS
• Article 11 Procedures to establish master plans
• Article 12 Procedures to establish implementation plans
• Article 13 Scope of materials requested and methods of request
• Article 13-2 Subject matters, standards, methods, and procedures for evaluation of level of personal information protection
• Article 14 Promotion and support of self-regulation
• CHAPTER IV PROCESSING OF PERSONAL INFORMATION
• Article 14-2 Standards on additional use and provision of personal information
• Article 15 Control of out-of-purpose use of personal information or provision thereof to third parties
• Article 15-2 Matters subject to notification, such as sources of personal information collected, and methods and procedures for notification
• Article 15-3 Notification of details of use and provision of personal information
• Article 16 Methods of destroying personal information
• Article 17 Methods of obtaining consent
• Article 17-2 Protection of children's personal information
• Article 18 Scope of sensitive information
• Article 19 Scope of personally identifiable information
• Article 20 null
• Article 21 Measures to ensure safety of personally identifiable information
• Article 21-2 Persons who must encrypt resident registration numbers
• Article 22 Exception to restriction on installation and operation of fixed visual data processing devices
• Article 23 Gathering opinions on installation of fixed visual data processing devices
• Article 24 Posting of notice on signboard
• Article 25 Policy on operation and management of fixed visual data processing devices
• Article 26 Entrustment of installation and operation of fixed visual data processing devices by public institutions
• Article 27 Exception to restriction on operation of mobile visual data processing devices
• Article 27-2 Indication of photographing with mobile visual data processing devices
• Article 27-3 Guidelines for installing and operating visual data processing devices
• Article 28 Measures to be taken when entrusting personal information processing
• Article 29 Notification of transfer of personal information following business transfer
• CHAPTER IV-2 SPECIAL CASES CONCERNING PROCESSING OF PSEUDONYMIZED INFORMATION
• Article 29-2 Designation and cancellation of designation of expert data combination agency
• Article 29-3 Combination and release of pseudonymized information processed by different personal information controllers
• Article 29-4 Management, and supervision of expert data combination agency
• Article 29-5 Measures to ensure safety of pseudonymized information
• Article 29-6 null
• CHAPTER IV-3 Cross-Border Transfer of Personal Information
• Article 29-7 Means of notifying data subjects in cases of cross-border entrusted processing or storage of personal information
• Article 29-8 Certification of cross-border transfer of personal information
• Article 29-9 Recognition of countries' personal information protection levels
• Article 29-10 Protective measures in cases of cross-border transfers of personal information
• Article 29-11 Standards for orders to suspend cross-border transfers
• Article 29-12 Filing objections to orders to suspend cross-border transfers
• CHAPTER V SAFEGUARD OF PERSONAL INFORMATION
• Article 30 Measures to ensure safety of personal information
• Article 30-2 Measures to ensure safety of personal information taken by institutions operating public systems
• Article 31 Details of privacy policy and methods for disclosure thereof
• Article 31-2 Those subject to, and procedures for, evaluation of privacy policy
• Article 32 Work of privacy officer and requirements for designation
• Article 32-2 Scope of business of council of privacy officers
• Article 32-3 Scope of persons subject to designation of domestic agents
• Article 33 Registered matters of personal information files
• Article 34 Registration and disclosure of personal information files
• Article 34-2 Criteria, method, and procedure for certification of personal information protection
• Article 34-3 Fees for certification of personal information protection
• Article 34-4 Revocation of certification
• Article 34-5 Follow-up management of certification
• Article 34-6 Institutions specializing in certifying personal information protection
• Article 34-7 Certification mark and promotion
• Article 34-8 Qualifications for certification examiners for personal information protection and grounds for disqualification
• Article 35 Object of privacy impact assessment
• Article 36 Designation of assessment institutions and revocation of designation
• Article 37 Consideration at the time of privacy impact assessment
• Article 38 Criteria for privacy impact assessment
• Article 39 Notification of divulgence of personal information
• Article 40 Reporting on divulgence of personal information
• Article 40-2 Institution requesting erasure and blocking of exposed personal information
• CHAPTER VI GUARANTEE OF RIGHTS OF DATA SUBJECTS
• Article 41 Procedures for access to personal information
• Article 42 Limitation to, and postponement and denial of, access to personal information
• Article 42-2 Standards for information transmitters
• Article 42-3 Standards for general recipients
• Article 42-4 Scope of information subject to request for transmission
• Article 42-5 Methods of requesting transmission
• Article 42-6 Deadline and methods of transmission of personal information
• Article 42-7 Provisions of statutes excluded from application at time of request for transmission
• Article 42-8 Rejection of request for transmission and suspension of transmission
• Article 42-9 Business affairs of institutions specializing in managing personal information
• Article 42-10 Application for designation of institution specializing in managing personal information
• Article 42-11 Detailed criteria for designation of institutions specializing in managing personal information
• Article 42-12 Designation of institutions specializing in managing personal information
• Article 42-13 Prohibited acts for institutions specializing in managing personal information
• Article 42-14 Revocation of designation of institutions specialized in managing personal information
• Article 42-15 Management and supervision of Protection Committee on requests for transmission of personal information
• Article 42-16 Establishment and operation of personal information transmission support platform
• Article 43 Correction, and erasure of personal information
• Article 44 Suspension of processing personal information
• Article 44-2 Methods and procedures for requesting refusal, and explanation of automated decisions
• Article 44-3 Measures following request for refusal, and explanation
• Article 44-4 Disclosure of standards and procedures for automated decisions
• Article 45 Scope of representative
• Article 46 Confirmation of data subjects or representatives
• Article 47 Amounts of fees
• Article 48 Establishing access request support system
• CHAPTER VI-2 Deleted.
• Article 48-2 null
• Article 48-3 null
• Article 48-4 null
• Article 48-5 null
• Article 48-6 null
• Article 48-7 Scope, and standards of the parties required to purchase an insurance for performance of damage compensation responsibilities
• Article 48-8 null
• Article 48-9 null
• Article 48-10 null
• Article 48-11 null
• Article 48-12 null
• Article 48-13 null
• CHAPTER VII PERSONAL INFORMATION DISPUTE MEDIATION
• Article 48-14 Ex officio members
• Article 49 Composition and operation of mediation panels
• Article 49-2 Specialized committee for dispute mediation
• Article 50 Secretariat
• Article 51 Operation of Dispute Mediation Committee
• Article 51-2 Notification of intention not to respond to mediation
• Article 51-3 Secretariat of, and investigation and inspection by, Dispute Mediation Committee
• Article 51-4 Notification of intention to reject proposal of mediation
• Article 52 Incidents eligible for collective dispute mediation
• Article 53 Commencement of collective dispute mediation proceedings
• Article 54 Applications for participation in collective dispute mediation proceedings
• Article 55 Collective dispute mediation proceedings
• Article 56 Allowances and travel expenses
• Article 57 Dispute mediation rule
• CHAPTER VIII SUPPLEMENTARY PROVISIONS AND PENALTY PROVISIONS
• Article 58 Recommendation for improvements and disciplinary action
• Article 59 Reporting on infringements
• Article 60 Requests for materials and inspections
• Article 60-2 Criteria for calculation of penalty surcharges
• Article 60-3 Imposition and payment of penalty surcharges
• Article 60-4 Extensions of payment deadline for penalty surcharges and payment by installment
• Article 60-5 Interest rate on additional refund
• Article 61 Publication of results
• Article 62 Entrustment of work
• Article 62-2 Processing of sensitive information and personally identifiable information
• Article 62-3 Re-examination of regulation
• Article 63 Criteria for imposition of administrative fines

Korean original on law.go.kr · Get this law as JSON via API