South KoreaPersonal Information Protection Act, safety measures and access records
Act No. 10465 (as amended by Act No. 21445, 2026) Art. 29; Enforcement Decree (Presidential Decree No. 36671, 2026), Art. 30(1); Personal Information Protection Commission Notice No. 2025-9 (Standards for Personal Information Safety Measures), Art. 8
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- periodic
- Who audits it
- Self
As of .
What it requires
- Keep an access record for every person (other than the data subject) who accesses a system that processes the personal information of a person in Korea, showing the identifier, the date and time, the access location, the data subject information handled and the task performed, store it safely against forgery and alteration, and keep it for at least one year, or at least two years where the system holds the data of 50,000 or more data subjects, holds unique identification or sensitive information, or you are a registered or notified basic telecommunications business operator.
- Set in your internal management plan, and carry out, the cycle, method and follow-up procedure for checking access records and download activity.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
What the log must hold
Event time, Actor identity, Affected person reference, Access record, Integrity control
Log retention
Article 8(1) of the Notice sets one year as the minimum and two years where the system processes the personal information of 50,000 or more data subjects, processes unique identification information or sensitive information, or belongs to a registered or notified basic telecommunications business operator. One year is the shortest of the two.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 1
Logging duty
Article 29 of the Act has a personal information controller take the technical, managerial and physical measures the Presidential Decree sets, naming the keeping of access records (접속기록 보관, "keeping access records") among them. Article 30(1)5 of the Decree makes the storing, inspecting, confirming and supervising of access records, and their safe keeping against forgery and alteration, one of the required measures. Article 8 of the Commission's Notice sets the period and the check, and Article 2(3) of the Notice defines an access record. Article 5(3) of the Notice separately keeps the record of grants, changes and cancellations of access authority for at least three years; that is outside the sections this row cites. Article 29 has no scope clause, so no territorial hook is set.
- Kind
- Explicit
- As of
- Provision
- Act Article 29; Enforcement Decree Article 30(1)5; Notice Article 8
- Trigger
- personal_data_processing
What this law does
A personal information controller must take the technical, managerial and physical measures needed to keep personal information from being leaked, lost, stolen, forged, altered or damaged, including an internal management plan and the keeping of access records. The Enforcement Decree turns this into eight measures, one of which is to store, inspect, confirm and supervise the records of access to the personal information processing system, keep them safe, and prevent their forgery or alteration.
The Protection Commission's notice on safety measures defines an access record as the electronic record of the work a person did on the system, with the person's identifier, the date and time, the access location, the data subject information handled and the task performed.
The notice requires the controller to keep access records for at least one year, or at least two years where the system processes the personal information of 50,000 or more data subjects, processes unique identification or sensitive information, or the controller is a registered or notified basic telecommunications business operator.
The controller must also set in its internal management plan, and carry out, the cycle, method and follow-up procedure for checking access records and download activity.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.