(1) Where a personal information controller intends to give notification of the matters specified in the subparagraphs of Article 39-2(2) pursuant to Article 34(2) of the Act, it shall give such notification in writing or by other means within 72 hours from the relevant time specified in the subparagraphs of paragraph (1) of that Article; provided, where it is difficult to give notification within the period due to a natural disaster or any other unavoidable cause, it shall give notification immediately after such cause ceases to exist.
(2) Where a personal information controller confirms, within the period under paragraph (1), that personal information has actually been divulged, etc., it shall give notification under Article 34(1) of the Act in lieu of notification under paragraph (2) of that Article.
(3) A personal information controller that has given notification under Article 34(2) of the Act shall, upon confirming that personal information has not actually been divulged, etc., immediately notify the data subject of such fact.
(4) Where there is a justifiable reason, such as where a personal information controller does not know the contact information of a data subject to whom notification is required under Article 34(2) of the Act or paragraph (3) of this Article, it may, in lieu of such notification, post on its internet website for at least 30 days the possibility of divulgence, etc. of personal information (including the matters specified in the subparagraphs of Article 39-2(2)) or the fact that personal information has not actually been divulged, etc., in a manner readily accessible to the data subject; provided, where the personal information controller does not operate an internet website, it may, in lieu of notification under Article 34(2) of the Act or paragraph (3) of this Article, post such information for at least 30 days at a conspicuous place in its place of business, etc.[This Article Added on Sep. 10, 2026]