The law firm Cheongchul (Responsible Attorney: Attorney Shin Jun-seon) provided legal advice on drafting and reviewing personal information processing policies and personal information collection and usage consent forms reflecting the latest revised Personal Information Protection Act (2024) and guidelines from relevant ministries in relation to startup business operations starting in January 2025.

The revised Personal Information Protection Act introduced significant institutional changes to reflect the new personal information processing environment due to advancements in AI technology and the acceleration of digital transformation, including (1) ensuring the rights of data subjects regarding automated decision-making, (2) introducing the right to request the transfer of personal information, (3) establishing regulations on mobile video information processing devices, and (4) expanding the requirements for the overseas transfer of personal information.

In particular, the Personal Information Protection Commission published the ‘Integrated Guide on Personal Information Processing (Draft)’ in December 2024, presenting specific standards for the practical application of the revised law. Therefore, both existing personal information handlers such as various companies and organizations and startups beginning new businesses must establish personal information protection systems that comply with the standards outlined in relevant laws and guidelines, including forms for personal information processing policies and consent regarding the collection and use of personal information.

Our law firm received a request for consultation from a client who is developing a health management (app) service that is scheduled to open in the first half of 2025. We conducted legal advice by meticulously analyzing and reviewing the latest revised Personal Information Protection Act and the guidelines published by the Personal Information Protection Commission on December 31, 2024, and established a personal information protection system that complies with those standards.

Our law firm primarily focused on the following matters while providing consultation:

• Redesigning the consent system in accordance with the principle of minimizing necessary agreements

  • Reviewing the application of the basis for contract fulfillment under Article 15, Paragraph 1, Item 4 of the Personal Information Protection Act.

  • Separately distinguishing consent for the processing of sensitive information essential for providing health management services.

  • Separating choice consent for the collection and use of personal information for marketing purposes and behavioral information collection.

• Improving the personal information processing policy to enhance transparency

  • Specifying the purpose of processing personal information, items, and retention period.

  • Reflecting the guarantee of rights of data subjects regarding automated decision-making.

  • Clarifying the status of personal information processing outsourcing and matters regarding overseas transfer.

  • Detailing the collection and use of behavioral information and methods of refusal.

• Customized legal advice considering the characteristics of startups

  • Establishing a tailored expert formulation of personal information processing policies considering the business field and status.

  • Presenting measures to ensure the legality of processing sensitive information such as health information.

  • Establishing standards for outsourcing personal information processing when providing services through external partners.

• Reviewing measures to ensure the legality of providing customized advertisements using behavioral information.

• Providing a format for consent (notification) regarding the collection and use of personal information and disclosure to third parties.

• Reviewing compliance with the obligations of personal information handlers under the Personal Information Protection Act.

Through this consultation, the client has established a personal information protection system that complies with the new legal standards required by the latest revised Personal Information Protection Act and related guidelines. In particular, considering the client's business characteristics, it was possible to create a balanced personal information processing system that effectively guarantees the rights of data subjects while enabling the provision of innovative services.

This has allowed the client to proactively respond to changes in personal information protection legislation, minimize compliance risks related to personal information, and lay the foundation for the stable expansion of their startup business.

This law firm has experience in legal consulting in the IT/startup field, including the Personal Information Protection Act, and provides customized legal services that fit the growth stage of companies and their business characteristics. Particularly for companies that need to establish a personal information protection compliance system, we offer practical and specific solutions as demonstrated in this consultation case; therefore, please contact the law firm Cheongchul if you need related legal advice.