Article 30 (Establishment and Disclosure of Personal Information Processing Policy)

A personal information controller shall establish a personal information processing policy (hereinafter referred to as the "Personal Information Processing Policy") that includes the matters prescribed in the following subparagraphs. In this case, a public institution shall establish a Personal Information Processing Policy for personal information files subject to registration under Article 32. <Amended by Act No. 13179, Mar. 29, 2016, Act No. 17145, Feb. 4, 2020, Act No. 19224, Mar. 14, 2023> 1. Purpose of processing personal information 2. Period of processing and retention of personal information 3. Matters concerning the provision of personal information to third parties (shall be established only if applicable) 3의2. Procedures and methods for destroying personal information (If personal information is to be preserved under the proviso to Article 21 (1), it shall include the grounds for preservation and the items of personal information to be preserved) 3의3. Possibility of disclosure of sensitive information under Article 23 (3) and methods of choosing non-disclosure (shall be established only if applicable) 4. Matters concerning the consignment of personal information processing (shall be established only if applicable) 4의2. Matters concerning the processing of pseudonymized information under Articles 28의2 and 28의3 (shall be established only if applicable) 5. Matters concerning the rights and duties of data subjects and their legal representatives, and methods of exercising them 6. Name of the personal information protection officer or the department responsible for personal information protection and handling related grievances, and contact information such as telephone number, etc., under Article 31 7. Matters concerning the installation, operation, and refusal of devices that automatically collect personal information, such as Internet access information files (shall be established only if applicable) 8. Other matters relating to the processing of personal information prescribed by Presidential Decree

If there is a discrepancy between the contents of the Personal Information Processing Policy and the contents of the contract concluded between the personal information controller and the data subject, the more favorable one to the data subject shall apply.