SOUTH KOREA Trends and Developments Contributed by: Hwan Kyoung Ko, Tae Joo Kim, Jaeyoung Chang and Ji Hoon Kim, Lee & Ko
Establishing a robust incident response framework Cybersecurity incidents – particularly data breaches resulting from hacking – receive significant public and regulatory scrutiny in Korea, and regulatory investi - gations are highly likely in major cases. Companies should therefore establish comprehensive incident response frameworks, including detailed response manuals The full life cycle of incident management – encom - passing detection, investigation, internal assessment, regulatory reporting, data subject notification and post-incident remediation – should be documented in a formal standard operating procedure (SOP). Regu - lar simulation exercises and tabletop drills should be conducted to ensure organisational preparedness. Strengthening governance and board-level oversight In a regulatory environment where the representative or business owner is deemed ultimately responsible, it is essential to implement governance structures under which the board of directors and senior management regularly review data protection and cybersecurity risks and provide strategic oversight, budgetary sup - port and adequate organisational resources Companies should clearly define the roles and author - ity of the CISO and CPO, and appropriately leverage internal audit and risk committees, as well as exter - nal advisory and audit resources. These measures are essential not only for effective risk management but also to demonstrate fulfilment of the company’s “reasonable duty of care” in the event of regulatory scrutiny or litigation.
bears ultimate responsibility for data processing and protection. In addition, the Network Act expressly provides for extraterritorial application where over - seas conduct affects the Korean market or users. Although PIPA does not contain an explicit extrater - ritoriality provision, Korean courts and the PIPC have interpreted it as potentially applicable where Korean data subjects are affected. Accordingly, regardless of whether a company is incorporated in Korea, businesses that provide servic - es to Korean residents or utilise infrastructure located in Korea should carefully assess the potential applica - bility of laws such as PIPA and the Network Act and structure their operations accordingly. In particular, companies should clearly delineate the roles and responsibilities of data handlers and pro - cessors and evaluate whether the appointment of a domestic representative is required. Establishing security frameworks beyond minimum legal standards Where Korean law may apply, companies should establish a compliance framework aligned with Korea’s data protection and cybersecurity require - ments. Given current enforcement trends, businesses should treat statutory and regulatory standards – such as the Standards of Personal Information Security Measures, relevant data protection guidelines and electronic financial supervisory regulations – as baseline require - ments only. Security controls should be calibrated to exceed minimum standards where reasonably war - ranted by the company’s business model, threat land - scape and the sensitivity of the data processed In practice, this includes implementing and regularly conducting vulnerability assessments and penetration testing, red team exercises, layered security architec - tures, robust supply chain and vendor risk manage - ment, careful review of cloud and managed service provider (MSP) arrangements, and the integration of security into development and operational processes (“DevSecOps”).
324 CHAMBERS.COM
Powered by FlippingBook