South Korea PIPA 29: Implement the decree's safety measures: management plan, access control, encryption, access logs, anti-malware and physical security

Article 29 with Decree Article 30: every controller takes the technical, managerial and physical measures set by decree to prevent loss, theft, leaks, forgery, alteration or damage: an internal management plan covering staff supervision and training and the privacy organisation; access rights granting, changing and revoking with authentication; intrusion detection and blocking, and internet separation for large controllers (average one million users or more); one-way encryption of passwords, encryption of resident registration numbers and other designated items and of data sent over networks; storage, review and protection of access logs; anti-malware; and physical storage protection, detailed in the Commission's safeguards notice. Larger public systems have extra duties (Decree Article 30-2).