South Korea PIPA 32-2: Obtain ISMS-P style privacy certification where required, and maintain it

Article 32-2: the Commission certifies whether a controller's measures conform to the Act (valid three years, with annual follow-up audits, withdrawal for fraud, obstruction, falling below criteria or serious violations), run by KISA and designated bodies with qualified auditors. The 2026 amendment makes certification mandatory for controllers meeting decree revenue and scale criteria from 1 July 2027, with a fine for failing to obtain it; the decree criteria for that obligation had not been set by 25 September 2026.