Articles 39 to 39-7: controllers are liable for damage from breaches unless they prove no intent or negligence; for leaks caused by intent or gross negligence courts may award up to five times the damage; data subjects may instead claim statutory damages up to 3 million won per person for leaks; courts may order production of evidence (trade secrets included where essential) and confidentiality orders; controllers meeting decree revenue and volume criteria must hold insurance or reserves to cover damages, with exemptions for some public bodies, small businesses and those covered under other laws.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.