(1) A person who intends to perform any of the following work shall be designated by the Protection Commission or the head of a relevant central administrative agency as an institution specializing in managing personal Information:

1. Support for the exercise of the right to request the transmission of personal information under Article 35-2;
2. Establishing and standardizing a personal information transmission system to support the exercise of the rights of data subjects;
3. Managing and analyzing personal information to support the exercise of rights of data subjects;
4. Other affairs prescribed by Presidential Decree to effectively support the exercise of the rights of data subjects.

(2) Requirements for designation as an institution specializing in managing personal information under paragraph (1) shall be as follows:

1. The applicant shall have the technical level and expertise to transmit, manage, and analyze personal information;
2. The applicant shall be equipped with a level of measures to ensure safety for safely managing personal information;
3. The applicant shall have the financial capability necessary for the stable operation of an institution specializing in managing personal Information.

(3) No institution specializing in managing personal information shall engage in any of the following acts:

1. Forcing a data subject to request the transmission of his or her personal information, or unfairly inducing it;
2. Any other act prescribed by Presidential Decree, which is likely to infringe on personal information or restrict the rights of a data subject.

(4) If an institution specializing in managing personal information falls under any of the following, the head of the Protection Commission or of a relevant central administrative agency may revoke the designation of the institution specializing in managing personal information: Provided, that he or she shall revoke such designation in cases falling under subparagraph 1:

1. Where the institution has obtained the designation by fraud or other improper means;
2. Where the institution ceases to meet the requirements for designation under paragraph (2).

(5) If the Protection Commission or the head of a relevant central administrative agency intends to revoke the designation under paragraph (4), he or she shall hold hearings under the Administrative Procedures Act.

(6) The Protection Commission and the head of a relevant central administrative agency may provide an institution specializing in managing personal information support necessary for performing its work.

(7) In performing affairs under the subparagraphs of paragraph (1) at the request of a data subject, an institution specializing in managing personal information may collect from the data subject expenses incurred in performing such work.

(8) Matters necessary for the procedures for the designation of an institution specializing in managing personal information under paragraph (1), the detailed requirements for designation under paragraph (2), the procedures for revocation of designation under paragraph (4), etc. shall be prescribed by Presidential Decree.