(1) Upon operating personal information files, the head of a public institution shall register the following matters with the Protection Commission. The same shall also apply where the registered matters are modified:

1. The titles of the personal information files;
2. The grounds and purposes for the operation of the personal information files;
3. Particulars of personal information that are recorded in the personal information files;
4. The method of processing personal information;
5. The period for retaining personal information;
6. The recipient of personal information, if it is provided routinely or repetitively;
7. Other matters prescribed by Presidential Decree.

(2) Paragraph (1) shall not apply to any of the following personal information files:

1. Personal information files that record national security, diplomatic secrets, and other matters relating to grave national interests;
2. Personal information files that record the investigation of crimes, institution and maintenance of a prosecution, punishment, and probation and custody, corrective orders, protective orders, security observation orders, and immigration;
3. Personal information files that record the investigations of violations of the Punishment of Tax Offenses Act and the Customs Act;
4. Personal information files prescribed by Presidential Decree, which are recognized as having little need for continuous management, such as ephemeral files;
5. Classified personal information files pursuant to other statutes or regulations.

(3) The Protection Commission may, if necessary, review where personal information files are registered and the content thereof under paragraph (1), and may recommend that the head of a relevant public institution make improvements.

(4) If necessary to guarantee the rights of data subjects, the Protection Commission shall make public the status of registered personal information files under paragraph (1) so that anyone may access them with ease.

(5) Matters necessary for the registration referred to in paragraph (1), the method, scope, and procedure of public disclosure referred to in paragraph (4), shall be prescribed by Presidential Decree.

(6) The registration and public disclosure of the personal information files retained by the National Assembly, the Court, the Constitutional Court and the National Election Commission (including their affiliated entities) shall be prescribed by the National Assembly Regulations, the Supreme Court Regulations, the Constitutional Court Regulations, and the National Election Commission Regulations.