(1) The Protection Commission may order a person who violates this Act (excluding central administrative agencies, local governments, the National Assembly, the Court, the Constitutional Court, and the National Election Commission) to take the following measures:

1. To suspend personal information breach;
2. To temporarily suspend personal information processing;
3. Other measures necessary to protect personal information and to prevent personal information infringement.

(2) A local government, the National Assembly, the Court, the Constitutional Court, or the National Election Commission may order their affiliated entities and public institutions, which are found to have violated this Act, to take the measures provided in the subparagraphs of paragraph (1).

(3) When a central administrative agency, a local government, the National Assembly, the Court, the Constitutional Court, or the National Election Commission violates this Act, the Protection Commission may recommend that the head of the relevant agency take any of the measures provided in the subparagraphs of paragraph (1). In such cases, upon receiving the recommendation, the agency shall comply therewith unless there is a compelling reason not to do so.