Frameworks / South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics / KISO-4.1 South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics
KISO Code Chapter 4: User Protection and Participation
South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics KISO-4.1: User data protection Internet operators shall protect user personal information and data privacy
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 193 controls across 82 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CH-FADP-19 Transparency and proactive information CH-FADP-21 Data protection impact assessments FADP-16 FDPIC Independence and Functions FADP-7 Data Protection Impact Assessment (Articles 9-10) FADP-9 Data Protection Advisor (Articles 14-15) NDPA-1 Applicability, Scope, and Carve-Outs NDPA-4 Sensitive Data Processing Consent and Childrens Protections NDPA-7 Data Protection Assessments and Processor Contracts NDPA-8 Nebraska Attorney General Enforcement, Permanent 30-Day Cure, and Penalties NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission NG-NDPA-4 Data Subject Rights and Automated Decision-Making NG-NDPA-7 Cross-Border Data Transfers and International Cooperation NG-NDPA-8 Enforcement, Penalties, Data Controllers of Major Importance (DCMI), and Compliance AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction AT-DSG-12 Section 62 - Administrative penalties AT-DSG-7 Section 18 - Establishment of the Data Protection Authority ISO27799-03 Minimum necessary standard enforcement ISO27799-04 Patient data de-identification procedures ISO27799-05 Audit trail for ePHI access 27011-5.2 Information Security Roles in Telecoms 27011-6.3 Awareness and Training 27011-8.6 Data protection and backup NISTPF-4 Communicate-P - Privacy Notice, Transparency, and Individual Awareness NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P) NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) TRINIDAD-1 Scope, Definitions, Commission TRINIDAD-4 Security, Accuracy TRINIDAD-5 Enforcement and Sanctions UGA-3 Accountability Principle UGA-6 Personal Data Protection Office UGA-7 Data Protection Officer AZ-DPA-15 Article 17 - Dispute resolution AZ-DPA-6 Article 6 - State regulation in personal data protection BB-DPA-1 Section 1 - Short Title BB-DPA-4 Section 4 - Principles Relating to Processing UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) 27400-7.1 Network Security for IoT 27400-7.4 Data retention and deletion MDS2-Audit-Logging-AUDT-Integrity-IGAU-Cybersecurity-Risk-CYBR-Monitoring MDS2 Audit Controls + AUDT + Integrity + IGAU + Cybersecurity Risk + CYBR + Continuous Monitoring MDS2-PHI-Data-Handling-DATA-Storage-STCF-Transmission-TXCF-TXIG-Encryption-FIPS MDS2 PHI Handling + DATA + STCF Storage + TXCF Transmission + TXIG Integrity + Encryption + FIPS MTCS-Acquisition-Development-Maintenance-Supplier-Vulnerability-DevSecOps-SBOM-SDLC-SCA-API-Container MTCS Acquisition + Development + Maintenance + Supplier + Vulnerability + DevSecOps + SBOM + SDLC + SCA MTCS-Operations-Physical-Network-Tier-III-Data-Centre-Hardening-Patching-Network-Segmentation-DDoS MTCS Operations + Physical + Network + Tier III Data Centre + Hardening + Patching + Segmentation + DDoS MU-DPA-Cross-Border-Transfer-Section-36-Adequacy-SCC-BCR-Mauritius-Global-Business-IBC-Financial-Services Mauritius DPA Cross-Border + Section 36 + Adequacy + SCC + BCR + Mauritius Global Business + Financial Services MU-DPA-Security-Breach-Notification-Section-25-BREACH-72-Hour-Commissioner-Cyber-Security-Strategy Mauritius DPA Security + Breach Notification + Section 25-BREACH + 72 Hour + Commissioner + Cyber Security Strategy MX-LFPDPPP-Cross-Border-Transfer-Articles-36-37-Reglamento-66-68-Domestic-International-APEC-CBPR-USMCA Mexico LFPDPPP Cross-Border + Articles 36-37 + Reglamento 66 + 68 + Domestic + International + APEC CBPR + USMCA MX-LFPDPPP-Security-Breach-Notification-Reglamento-63-No-Time-Limit-INAI-Recommendations-CERT-MX Mexico LFPDPPP Security + Breach Notification + Reglamento 63 + No Specified Time + INAI Recommendations + CERT-MX NISTSP144-3 Data Classification, Handling, and Sovereignty NISTSP144-5 Identity and Access in Cloud, Federation, and Privileged Access NISTSP145-3 Rapid Elasticity Characteristic and Capacity Management NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition NISTSP146-6 Cloud Security and Privacy Recommendations NISTSP146-7 Service Level, Performance, Reliability, Interoperability, and Portability NHPA-7 Data Protection Assessments and Processor Contracts NHPA-8 AG Formella Enforcement, Permanent 60-Day Cure, and Penalties NJDPA-7 Data Protection Assessments and Processor Contracts NJDPA-8 AG Platkin Enforcement, 18-Month Cure Sunset, and Division of Consumer Affairs NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security NGNDPR-6 Data Protection Officer, DPCOs, and Processor Obligations OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices OREGONCPA-8 Cure Period, Attorney General Enforcement, Training, Compliance Monitoring PDPASG-1 Accountability, Records, DPO Appointment, and Training PDPASG-4 Children's Data, DPIA, and Privacy by Design PDPATH-4 DPIA, Privacy by Design, Children's Data PDPATH-7 DPO, Records of Processing, Retention, Marketing, Training POPIASA-4 Special Personal Information, Children, Information Quality, Documentation POPIASA-7 Information Officer, Records of Processing, Notification, Training NORWAY-4 DPIA, Privacy by Design, Records of Processing NORWAY-7 DPO, Cooperation with Datatilsynet, Retention, Marketing, Training NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design NZPRV-8 Privacy Officer, OPC Cooperation, Compliance Notices, Complaints, Training SA-PDPL-19 Data protection officer designation SA-PDPL-21 Data protection impact assessments IM8-DAT.2 Data Protection IM8-DAT.4 Data Retention and Disposal SWE-1 Scope and Purpose SWE-2 Relationship to GDPR Standard 15 Online Tools Standard 2 Data Protection Impact Assessments UKGDPRREG-2 Data Subject Rights (Articles 12-22) UKGDPRREG-3 Controller and Processor (Articles 24-43) URUGUAY-4 Security and Cross-Border URUGUAY-5 Database Registration with AGESIC URCDP ASD37-27 Outbound data loss prevention (Very Good) AWWA-3.4 Encryption and Data Protection AL-DPA-14 Direct Marketing CPG-3.C Strong and Agile Encryption FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) ISO-26000-6.7 Consumer issues ISO23894-A.5 Privacy and Data Protection in AI LGPD-BR-Governance-Encarregado-DPO-ROPA-DPIA-Privacy-by-Design-Article-46-50-Codes-of-Conduct Brazil LGPD Governance + Encarregado (DPO) + ROPA + DPIA + Articles 46-50 MY-PDPA-DPO-Designation-Class-Data-User-Registration-DPIA-Code-Practice-Section-43A-2024-Amendment Malaysia PDPA Governance + DPO Section 43A + Class of Data User Registration + DPIA + Code of Practice MN-CDPA-Data-Privacy-Assessment-DPIA-Section-325O-07-Sensitive-Targeted-Sale-Profiling-AI-Consumer-Health Minnesota CDPA DPIA + Section 325O.07 + Sensitive + Targeted + Sale + Profiling + AI + Consumer Health MT-CDPA-Data-Protection-Assessment-MCA-30-14-2815-Sensitive-Targeted-Sale-Profiling-AG-Inspection Montana CDPA Data Protection Assessment + MCA 30-14-2815 + Sensitive + Targeted + Sale + Profiling + AG Inspection NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management NGCB-7 Patron and Employee Data Protection + Data Inventory + Vendor Management OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation OMANCS-4 Data Protection, Cryptography, and Privacy Alignment PARAGUAY-5 Security of Processing, Data Integrity, Information Security PERU-3 Data Subject Rights (ARCO), Habeas Data, Automated Decisions QATAR-7 DPO, Records, Retention, Marketing, Training SOC-CY-C2 Encryption and Data Protection PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 STUDPRV-2 Data Subject Rights for Students and Parents TEF-2 Openness and Transparency TISAXASS-3 Prototype Protection and Confidentiality TAIWAN-3 Data Subject Rights TANZANIA-1 Scope, Registration, Lawful Basis TSSR-INFO-1 Network Data Protection TEXASTDPSA-3 Sensitive Data, Children, Sale Notice TURKEYKVKK-3 Special Categories and Sensitive Data UKAI-2 Sector-Specific Regulator Engagement D.1 Incident Response Planning UNESCOAI-2 Principles 4-7: Sustainability, Privacy, Human Oversight, Transparency UNICEFAI-4 Transparency, Explanation, Adult Capacity CPSC-CS.3 Data Protection for Safety Systems US-ITAR-EAR-DS-01 Technical Data Protection VIETNAMPDP-3 Data Subject Rights VIRGINIAVCDPA-3 Sensitive Data Consent and Children Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in KISO Code Chapter 4: User Protection and Participation Query this from an agent The graph holds this control, the 193 it maps to, and the evidence behind each claim, over MCP and REST.