BSA filed comments with Korea's Personal Information Protection Commission (PIPC) on the PIPC's draft amendments to the Enforcement Decree of the Personal Information Protection Act (PIPA). BSA recommended that notification obligations be limited to incidents presenting a material risk of significant harm to data subjects, that internationally recognized certifications be credited toward mandatory ISMS-P certification, and that the penalty framework distinguish between companies that invest in security from those who do not.

Translation: Korean