A personal information processor shall conduct personal information protection impact assessment of the following circumstances in advance and keep a record of the processing:

• (I) processing sensitive personal information;
• (II) making use of personal information to make automatic decisions;
• (III) entrusting others to process personal information, providing other personal information processors with personal information, and disclosing personal information;
• (IV) providing personal information to overseas parties; and
• (V) other personal information processing activities that have a significant impact on individuals’ rights and interests.