South Korea's Personal Information Protection Commission will issue an advance legislative notice from Sept. 16 to Oct. 26 on a draft amendment to the enforcement decree of the Personal Information Protection Act to strengthen the effectiveness of the information security and personal information protection management system certification, or ISMS-P.

Under the amendment, the commission will revise rules to allow document reviews and on-site audits to be conducted in parallel to strengthen on-site verification of certification audits.

If a breach incident or personal information leak occurs during the certification validity period, qualified technical personnel will be allowed to conduct vulnerability checks, including vulnerability assessments and penetration tests, on site using inspection tools.

During annual follow-up reviews conducted after certification is obtained, document reviews and on-site audits will also be conducted in parallel and vulnerability checks will be allowed. The commission will also refine matters related to standards applied in ISMS-P certification audits. It will establish a basis to apply certification standards differently by taking into account the scale of personal information processing and social impact of those seeking certification.

The draft also adds a provision to defer, for 1 year, the imposition of administrative fines for violating the obligation to obtain certification when companies and other entities subject to the obligation receive a certification cancellation order. The commission said this is intended to give time to establish measures to prevent recurrence of the reason for cancellation and to grant a period to obtain new certification again. The commission plans to complete the amendment after collecting opinions from stakeholders and relevant ministries during the notice period and going through procedures including review by the Ministry of Government Legislation. It also plans to pursue revisions to related public notices within this year and continue work to strengthen the effectiveness of the certification system.