Answer a client's privacy audit request with evidence for each article

If your company processes personal data for a client in Korea, the client will often send a privacy audit request (점검 요청서), typically at year-end. It comes from the client's legal duty to supervise you. Reply item by item, citing the relevant article of the Korean safety rules and attaching evidence.

The audit request comes from a legal duty

Under Article 26(4) of the Personal Information Protection Act (개인정보 보호법, "the Act"), a company that outsources the processing of personal data (위탁자, "the client") must train the company that processes it (수탁자, "the processor"). The client must also supervise whether the processor handles the data safely, including by inspecting how it is processed, as set by Presidential Decree. Article 28(6) of the Enforcement Decree of the Act (시행령) names two things to supervise: what a personal information controller must comply with under the Act and the Decree, and what the outsourcing document says.

So the checklist is not a courtesy survey. The client must keep a record that it supervised, and the processor supplies the evidence for that record. Neither the Act nor the Decree sets a number for how often to inspect. The outsourcing contract and the client's internal standards set the cycle, so the reply deadline is the date written in the request.

The processor carries the same duties. Article 26(8) applies key articles to processors, including Article 29 (the duty to take safety measures), and reads "personal information controller" as "processor". That is why the checklist items look almost the same as the client's own standards.

Start with the outsourcing contract

Read the outsourcing contract before you answer. Article 28(1) of the Enforcement Decree lists five items the outsourcing document must contain, and the checklist usually asks about them again:

• the purpose and scope of the outsourced work
• restrictions on re-outsourcing
• safety measures, such as restricting access to personal data
• supervision, such as inspecting how the personal data held for the outsourced work is managed
• liability, such as compensation for damage, if the processor breaches its duties

Article 26(1) of the Act adds two more: no processing beyond the purpose of the outsourced work, and technical and managerial protective measures. If the checklist asks about something that is not in the contract, it is safer to confirm the contract scope before you reply.

Re-outsourcing (재위탁) is checked too. Under Article 26(6), a processor needs the client's consent before passing the processing work to a third party. If you use cloud, mailing or customer-service subcontractors, attach the consent documents.

Evidence to attach for each article of the Notice

The current Standards for Measures to Ensure the Safety of Personal Information (개인정보의 안전성 확보조치 기준) are Notice No. 2026-9 of the Personal Information Protection Commission (개인정보보호위원회), in force from July 1, 2026. Most managerial, technical and physical items on a checklist map to an article of this Notice.

For the destruction record itself, see Personal data destruction record.

Three requirements with numbers

Checklists most often go wrong on items with a number in them.

Access-rights records: 3 years. Article 5(3) requires you to record each grant, change and removal of access rights and to keep those records for at least 3 years. Removing a departed employee's account is not evidence if there is no record of the removal.

Access logs: 1 year, or 2 years. Article 8(1) sets a base of at least 1 year and raises it to at least 2 years in three cases:

• systems that process personal data on 50,000 or more data subjects
• systems that process unique identifying information (고유식별정보) or sensitive information (민감정보)
• facilities-based telecommunications operators (기간통신사업자) under the Telecommunications Business Act (전기통신사업법)

Review cycle: set by your own plan. The current Article 8(2) requires you to set, in the internal management plan, the cycle, method and follow-up procedure for checking access logs and downloads, and then to follow it. If a checklist asks whether you check "once a month", that differs from the current wording. Answer with the cycle in your internal management plan and the records showing you followed it. Implementation of the whole internal management plan is checked at least once a year under Article 4(4).

How to reply

1. Confirm the reply deadline and the submission method in the request (in writing, online or on-site).
2. Match each checklist item to an article of the Notice in the table above.
3. Name the evidence files and bundle them in order of article number.
4. For items not yet in place, reply with a remediation plan and an expected completion date.

Some articles of the Notice relax a requirement, for example when you have no separate server room or use only office computers. Quote the proviso of the article next to those answers, or the client may read them as "not implemented".

What happens if you put the audit off

Administrative fines (과태료) are set in Article 75 of the Act:

• Breaching the duty to take safety measures in Article 29: up to ₩30 million. This covers processors too, through Article 26(8).
• Re-outsourcing without the client's consent: up to ₩20 million.
• On the client's side, outsourcing without a document that contains the required items, or not disclosing the outsourced work and the processor: up to ₩10 million each.

Civil liability does not stay with the processor alone. Under Article 26(7), if a processor breaks the Act in the outsourced work, it is treated as an employee of the personal information controller for liability for the resulting damage. That is why clients inspect carefully, and why processors should keep their evidence in order. If personal data does leak, see Personal data breach: 72-hour notice and report.

Checklist

Before you reply, confirm that:

• every checklist item cites its legal article
• the purpose and scope in the outsourcing contract match the scope of the audit
• the list of re-outsourced vendors and the client's consent documents are attached
• the latest internal management plan keeps its revision history
• training records exist for each year
• access-rights change records cover 3 years
• access-log retention meets the 1-year or 2-year standard
• destruction records exist for each period
• every "not applicable" item has one line explaining why