Articles 30-3 and 31 with Decree Article 32: the business owner or representative bears final responsibility and must provide staff and budget; every controller designates a chief privacy officer (small business owners may skip, in which case the owner is the officer); from 11 September 2026 controllers above decree thresholds (annual revenue over 180 billion won with 50,000 sensitive or identifier data subjects or one million data subjects, universities with 20,000 students, tertiary hospitals, public system operators) must have the board approve appointment, change or dismissal and report it to the Commission within six months; the officer plans and runs protection, manages staff and budget, reports to the owner and board, audits practices, handles complaints, builds internal controls and training, and must be guaranteed independence, access to information and a reporting line, and not be disadvantaged.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.