Korea’s Information Security Certificate Requirement for Companies Engaged in Online Commerce in Korea

The Korean Information Security Management System (“ISMS”) certification is mandated for certain companies doing business in Korea under the Act on Promotion of Information and Communication Network Utilization and Information Protection, Etc. (the “Network Act of Korea”). Application and approval from Korea Internet & Security Agency (“KISA”) is required for all domestic and foreign companies providing online services in Korea with either: (1) one million average daily users per day in the prior fiscal year; or (2) KRW 10 billion in sales in the prior fiscal year.

Korean ISMS Certification

The Korean ISMS certification certifies that a particular company doing business in Korea has a computer information technology management system that meets, among other things, security and reliability requirements as mandated by the Network Act of Korea. The certification is issued by KISA. KISA performs a comprehensive review of security and IT protocols within the respective company. IPG Legal strongly recommends having a proactive lawyer on the team that applies for this certification. Many issues and delays can be avoided with the use of a proactive lawyer with experience in working with KISA. In many cases, it takes six months to a year to obtain approval, thus, act quickly in getting this started. In some cases, substantial changes are required to internal IT systems and protocols because of the unique requirements of KISA.

Penalties for Non-compliance with the Network Act of Korea

Any company foreign or domestic that is not in compliance with mandates under the Network Act of Korea may be fined yearly KRW 30,000,000 until compliance. Additionally, if a data breach occurs, Korean courts and government agencies are more willing to award damages/fines for negligence.

Additionally, ISMS-P certification reduces potential administrative penalties by up to 40% for personal information breaches/leaks. Recently, an internet service provider was fined over KRW 15 billion by Korea’s Personal Information Protection Commission. 

IPG Legal recommends most companies doing business in Korea to perform a Korean Compliance Audit.

New York Attorney Sean Hayes is the only non-Korean to have worked as a government attorney for the Korean court system and one of the first non-Koreans to be a regular member of a Korean law faculty. Sean is rated a Top Attorney by LawAsia and other publications. Schedule a call with Sean Hayes at: Schedule a Call.