What are Personal-Data Safeguard Measures and the Internal Management Plan?
Personal-data safeguard measures and the internal management plan, told as a story about a rulebook written just for the guest-info storeroom.
The guest-info storeroom gets treated like any other room.How tightly the storeroom is locked swings wildly depending on who's in charge.
When guest info leaks, every single guest is harmed.That's why the guest-info storeroom must be locked far more strictly than an ordinary room.
The internal management plan is a rulebook written just for the guest-info storeroom.The plan is more detailed and stricter than the castle's general rule scroll.
The internal management plan is a separate rulebook, apart from the castle's general rules.Its items are legal requirements set by the Personal Information Protection Act's enforcement decree and the safeguard-measures notice.
A rulebook with nothing behind it is worthless.A rulebook alone is just paper — real access logs prove it's followed. The inspector always checks the evidence first.
An internal management plan = a lockdown rulebook written just for the guest-info storeroom. It spells out items such as access rights, access logs, encryption, and physical security in detail.
Safeguard measures for personal data are the technical, managerial, and physical protection standards set by the enforcement decree of Korea's Personal Information Protection Act and its related notices. The internal management plan is the document that spells out how an organization actually meets those standards — covering access-rights management, access-log retention, encryption, antivirus, and physical security. Establishing and enforcing it is mandatory for personal-data handlers; only small businesses, individuals, and groups handling fewer than 10,000 people's data may skip it.
When grown-ups say it
- Internal management plan
- The storeroom's own rulebook document. A document an organization handling guest info must draw up (small businesses handling under 10,000 people may skip it).
- Safeguard-measures notice
- The detailed items set by law. A notice from Korea's Personal Information Protection Commission, setting technical, managerial, and physical measures.
- Access-rights management
- The list of who may enter. Decides and records who may enter, kept to the minimum.
- Access-log retention and review
- The log of who came in, and when. Kept at least one year (two if the system covers 50,000+ people or sensitive data, among other cases), with the review cycle set in the internal plan.
- Encrypting unique identifiers
- Mandatory for things like ID numbers. Locked again even after it's inside the castle. → the letter nobody can read without the key
- Chief Privacy Officer (CPO)
- The officer responsible for the storeroom. The person responsible for drawing up and enforcing the plan.
- Castle-wide security policy
- The castle-wide general security rules. The internal management plan is its guest-info-only version. → the castle rule scroll
- Compliance
- The inspector checks the evidence. A plan with no records behind it fails inspection. → the inspector from next door