[Privacy] PIPC Releases 2025 Revised Guidelines on Drafting Privacy Policies

In March 2025, following the amendment of the Personal Information Protection Act, the right to demand personal-data transmission took effect, centered on the healthcare, telecommunications, and energy sectors. Medical institutions have an obligation to securely transmit sensitive information such as patients' medical records and health-examination data, and they are required to strengthen their personal-data management and security systems as a matter of necessity. We examine the implications identified by attorney Lee Seo-hyung, a specialist in Personal Information Protection Act legislative consulting and data-processing regulation.

The breach of SKT subscribers' USIM information following a hacking attack is showing signs of escalating into a class action. As large-scale personal data breaches occur frequently, companies can no longer claim to have fulfilled their legal obligations merely by nominally appointing a Chief Privacy Officer (CPO). Personal data protection has shifted from a question of "who" to a question of "how." Recent amendments have strengthened the experience requirements and independence of the CPO, making it essential for companies to build substantive management systems. To prepare for surcharges, litigation, and even reputational risk, advance consulting from a specialized attorney and the establishment of a systematic response strategy are more important than anything else.

In preparation for the 2025 implementation of its privacy policy evaluation, the Personal Information Protection Commission has released a proposed amendment to the "Guidelines for Drafting Privacy Policies." Aimed at guaranteeing the rights of data subjects and easing the compliance burden on companies, this amendment clearly distinguishes between mandatory and recommended items and systematizes the items to be drafted. It also emphasizes substantive accountability by distinguishing consent requirements, expanding flexibility in listing items, specifying grievance-handling channels, taking the mobile environment into account, detailing procedures for exercising rights, and strengthening guidance on personalized advertising. Companies need to closely review these guidelines to prepare for the evaluation.