Destroying personal data: methods set by law and a five-field record

This guide is for companies in Korea that hold personal data, and for their HR, IT and compliance staff. When personal data is no longer needed, the law requires you to destroy it without delay, using methods the law sets. No official form is required, but you need a record that proves the destruction, and five fields are enough.

Why keep a destruction record

The most common problem is destruction without a record. Article 21 of the Personal Information Protection Act (개인정보 보호법) sets the duty to destroy, but it does not require a form for a destruction record. Yet in an audit by a client that outsources data processing to you (위탁사 점검), or in an investigation by a supervisory authority, you have to prove that you destroyed the data. Without proof, it is treated as if you did not. The reason to keep a record is proof. No legal form requires it.

When to destroy

Article 21(1) says that when personal data becomes unnecessary, for example because the retention period (보유기간) has passed, the purpose of processing has been achieved, or the processing period for pseudonymized information (가명정보) has passed, you must destroy it without delay. The proviso makes an exception where another law requires you to keep the data.

Even under that exception, you cannot simply leave the data where it is. Article 21(3) requires you to store and manage that data, or that personal data file (개인정보파일), separately from other personal data. Examples are documents you must keep under the Labor Standards Act (근로기준법), tax evidence under the tax laws (세법), and transaction records under the E-Commerce Act (전자상거래법). If you leave them mixed into your live database, you breach the separate storage (분리보관) duty.

Destruction methods set by law

Article 21(2) requires measures so that the data cannot be recovered or reproduced. Article 16(1) of the Enforcement Decree sets the methods:

Moving files to the trash, renaming them or hiding a folder is not permanent deletion. If a backup copy remains, the data can still be restored after you delete the original, so it is hard to call that destruction. This is why you also need to check the version history feature and the trash retention period of your cloud storage.

Paragraph (2) of the same Decree article leaves the details of safe destruction to a public notice (고시) issued by the Personal Information Protection Commission (개인정보 보호위원회). For the exact technical standards, check that notice.

The five fields

• Date of destruction.
• File name, or details that identify the personal data file.
• Reason for destruction (retention period over, purpose achieved, consent withdrawn and so on).
• Method (permanent deletion, shredding or incineration).
• Person who carried out the destruction.

With more than five fields, the record tends not to get filled in. A workable routine is to collect each month's destruction on one sheet at month-end and file the sheets by year.

Set retention periods first

Companies where destruction never starts have one thing in common: no retention periods. The triggers in Article 21(1) are the retention period passing, the purpose being achieved, and the processing period for pseudonymized information passing. The first two only take effect when someone makes a decision. Without that decision, the duty to destroy exists only on paper and the data keeps piling up.

Start by listing your personal data files one by one and writing a retention period and a destruction trigger for each. Write the conditions in concrete terms, such as a set number of days after a member leaves, months after a contract ends, or days after a rejected job applicant is notified. Then the month-end destruction run becomes routine.

Attach the legal retention exceptions file by file as well. If you note which article of which law requires you to keep the data, and for how many years, the data that needs separate storage is identified automatically, and the end of that period becomes the next destruction trigger. With this table, much of what a client asks for in an audit is already covered. For the audit itself, see answering a client's personal data audit.

Checklist: gaps that audits find

• Every personal data file has a retention period.
• Someone decides when the purpose has been achieved, so destruction actually starts.
• Backups, logs and snapshots are deleted, not only the live database.
• Copies of live data in development and staging environments are deleted.
• Extracts in staff download folders are deleted.
• Lists pasted into messengers and issue trackers are deleted.
• Name lists exchanged as email attachments do not stay in mailboxes.
• Printouts do not go out with ordinary rubbish.
• Shredding is recorded.
• Data you must keep under other laws is stored separately, not next to the originals.
• Separately stored data does not keep its old access rights.
• You confirm whether data handed to processors has been destroyed.
• When an outsourcing contract ends, the return-or-destroy clause is carried out.
• Each destruction record carries the signature of the person who did it.
• Records are not kept only in one staff member's personal folder.

The last three items are the points that audits actually flag. If you only look after internal destruction and do not confirm destruction on the processor's (수탁자) side, the data stays outside your company, however clean your own records are.

Manage the processor side by contract. If the outsourcing contract sets when and how personal data is returned or destroyed, and obliges the processor to submit proof of destruction, you have grounds to demand it when the contract ends. Without such a clause, you can ask for cooperation but have no way to enforce it. If a leak does happen, see the 72-hour breach notice and report.