(1) “Matters prescribed by Presidential Decree” in Article 26 (1) 3 of the Act means the following:

1. The purpose and scope of entrusted work;
2. Matters concerning limitation to re-entrustment;
3. Matters concerning measures to ensure safety, including limitation to access to personal information;
4. Matters concerning supervision and inspection of the status of management of personal information retained in relation to entrusted work;
5. Matters concerning liability, such as compensation for damages caused by a breach of contractual obligations on the part of a person entrusted under Article 26 (2) of the Act (hereinafter referred to as “person entrusted”).

(2) “Manner prescribed by Presidential Decree” in Article 26 (2) of the Act means the method wherein a personal information controller that has entrusted personal information processing (hereinafter referred to as “person entrusting”) continuously posts details of the entrusted work and the person entrusted on its website.

(3) Where it is impossible to post on the website as prescribed in paragraph (2), the entrusted work and the person entrusted shall make public in one or more of the following manners:

1. Posting at easily noticeable places such as workplace of a person entrusting;
2. Publishing in the Official Gazette (only where the person entrusting is a public institution) or a general daily newspaper, weekly newspaper, or online newspaper, as defined in subparagraphs 1 (a) and (c) and 2 of Article 2 of the Act on the Promotion of Newspapers which mainly covers the City/Do where the person entrusting’s workplace, etc. is located;
3. Publishing at a periodical, newsletter, PR magazine, or invoice to be published under the same title at least twice annually and distributed to data subjects on a continual basis;
4. Stipulating in an agreement, etc. for the supply of goods and services executed between the person entrusting and the data subjects and providing a copy of the same to the data subjects.

(4) “Manners prescribed by Presidential Decree” in the former part of Article 26 (3) of the Act means in writing, etc.

(5) Where a person entrusting is unable to inform the data subjects of the entrusted work and the person entrusted in the manner stated in paragraph (4) without its negligence, the person entrusting shall post the relevant matters on its website for at least 30 days: Provided, that a person entrusting who has no website shall post them at easily noticeable places of its workplace, etc. for at least 30 days.

(6) Where a person entrusted processes personal information, the person entrusting shall supervise whether the person entrusting complies with the obligations of a personal information controller provided for in the Act and this Decree and the matters referred to in Article 26 (1) of the Act, pursuant to Article 26 (4) of the Act.