(1) The detailed standards for each requirement for the designation of an institution specializing in managing personal information under Article 35-3 (2) of the Act shall be as follows:
1. It shall have all of the following technological levels and expertise:a. A business plan for enhancing the rights, interests, etc. of data subjects and preventing conflicts of interest with data subjects shall be reasonable and sound;b. A personal information management plan for the services of an institution specializing in managing personal information shall be appropriate;c. It shall have facilities and technologies prescribed and publicly notified by the Protection Commission to effectively perform the services of an agency specializing managing personal information;
2. It shall meet all of the following levels in terms of measures to ensure safety:a. It shall meet the requirements for fulfilling the duty of safeguards under Article 29 of the Act;b. In order to safely operate an institution specializing in managing personal information, a protection system determined and publicly notified by the Protection Commission shall be in place appropriately;
3. It shall have all of the following financial capabilities (not applicable to public institutions falling under subparagraph 6 (a) of Article 2 of the Act):a. Its financial structure shall be sound and safe;b. It shall have capital according to the following classifications [in the case of a corporation, the paid-in capital (in the case of a non-profit corporation, the basic property), and in the case of an organization that is not a corporation, it means the value of the assets held by the relevant organization; hereafter in this item the same shall apply];1) A specialized relay agency: At least 1 billion won in capital;2) A general specialized agency or a special specialized agency: At least 100 million won in capital;c. It shall purchase an insurance policy or mutual aid or accumulate reserves for the performance of liability for damage compensation (not applicable to any person falling under any subparagraph of Article 39-7 (2) of the Act). The standards for the minimum amount of insurance policy or mutual aid or the minimum amount of reserves in such cases shall be as specified in Appendix 1-2.
(2) Notwithstanding paragraph (1), if any of the following agencies, corporations, or organizations intends to be designated as an institution specializing in managing personal information, it shall file a request therefor with the Protection Commission (excluding cases where the Protection Commission is the designating authority) and, after deliberation and resolution by the Protection Commission, may be treated as meeting the detailed criteria for designation under the subparagraphs of paragraph (1) without undergoing examination on some or all of the criteria; provided, the examination of all the requirements of the detailed criteria for designation under the subparagraphs of paragraph (1) may be omitted only in cases where the agency, corporation, or organization referred to in subparagraphs 1 and 2 intends to be designated as an institution specializing in managing personal information:
1. A medical institution under Article 3 of the Medical Service Act (limited to where health and medical services information subject to transmission is transmitted);
2. A central administrative agency or local government;
3. A public institution other than those referred to in subparagraph 2.[This Article Added on Feb. 25, 2025]