South Korea PIPA

Personal Information Protection Act: technical safeguards, data inventory, access control.


Short name	PIPA
Region	Asia-Pacific
Country or scope	South Korea
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers PIPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for PIPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for PIPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`KR-PIPA-29` Duty to Ensure Safety	Controllers must take technical measures to ensure personal information is not lost, altered or damaged, supported by the ability to verify the integrity of processing software (PIPA Art. 29)	Scan
`KR-PIPA-29-INV` Knowledge of Processing Systems	Applying required safeguards presupposes that the controller knows what software components make up its processing systems (PIPA Art. 29 and Enforcement Decree safety measures)	Scan
`KR-PIPA-26` Outsourced Processing Oversight	Entrusting processing to third parties requires documented oversight of those parties, mapping to named suppliers for the software components in use (PIPA Art. 26)	Scan
`KR-PIPA-34` Breach Notification Readiness	Controllers must notify data subjects and authorities of breaches, which requires knowing the versions of affected software to assess scope and cause (PIPA Art. 34)	Scan
`KR-PIPA-33` Privacy Impact Assessment Inputs	Privacy impact assessments of processing systems require identifying the system's components and their known risk exposure (PIPA Art. 33)	Scan
`KR-PIPA-30` Processing Transparency	Controllers must publish a privacy policy describing their processing, supported by dated, identifiable documentation of the processing environment (PIPA Art. 30)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`PIPA-A15`	Obtain Consent for Collection and Use of Personal Information
`PIPA-A17`	Obtain Separate Consent for Third-Party Provision
`PIPA-A18`	Limit Use to Collected Purpose
`PIPA-A22`	Ensure Validity and Distinctness of Consents
`PIPA-A23`	Restrict Processing of Sensitive Information
`PIPA-A24`	Protect Resident Registration Numbers
`PIPA-A28`	Govern Personal Information Processing Entrustment
`PIPA-A29`	Implement Security Measures for Personal Information
`PIPA-A34`	Notify Data Subjects and PIPC of Breaches
`PIPA-RIGHTS`	Fulfil Data Subject Access and Correction Rights
`PIPA-XBORDER`	Disclose and Govern Cross-Border Transfers
`PIPA-DPO`	Appoint a Personal Information Protection Manager

Policy templates

Written for PIPA:

Consent and Sensitive Information Processing Policy (PIPA)
Personal Data Breach Notification Policy (PIPA)

And 22 from the standard set, adapted to PIPA.