(1) "Matters prescribed by Presidential Decree" in Article 30 (1) 8 of the Act means the following: <Amended on Sep. 29, 2016; Aug. 4, 2020; Sep. 12, 2023; Mar. 12, 2024>
1. Particulars of personal information to be processed;
2. Where personal information is transferred to a foreign country pursuant to each subparagraph of Article 28-8 (1) of the Act, the grounds for transferring personal information to a foreign country and the matters referred to in each subparagraph of paragraph (2) of the same Article;
3. Matters regarding measures to ensure the safety of personal information under Article 30;
4. Where the personal information of a domestic data subject is directly collected and processed from a foreign country, the name of the country in which the personal information is processed.
(2) A personal information controller shall post continuously the Privacy Policy established or modified pursuant to Article 30 (2) of the Act on its website.
(3) Where it is impossible to post the Privacy Policy on the website as prescribed in paragraph (2), the personal information controller shall make public the established or modified Privacy Policy in at least one of the following manners: <Amended on Sep. 12, 2023>
1. Posting at easily noticeable location of the personal information controller’s workplace, etc.;
2. Publishing in the Official Gazette (only in cases the personal information controller is a public institution) or general daily newspaper, weekly newspaper, or online newspaper, as defined in subparagraphs 1 (a) and (c) and 2 of Article 2 of the Act on the Promotion of Newspapers circulating mainly over the City/Do where the personal information controller’s workplace, etc. is located;
3. Publishing at a periodical, newsletter, PR magazine, or invoice to be published under the same title at least twice a year and distributed to data subjects on a continual basis;
4. Stipulating in an agreement, etc. for the supply of goods or services executed between the personal information controller and the data subjects and providing a copy of the same to the data subject.