<Abandon the Existing Personal Information Responsibilities and Pursue Reform: Proposals for Alternatives> This lecture presents opinions on various current issues (related to data breach incidents), including transparently disclosing the processing of personal information by changing the division of responsibilities between the Personal Information Team and personal information officers; forming a TFT organized as one team with developers; providing DFDs that the public can choose from and giving them the right to choose; and promoting simulated hacking and security monitoring under a unified personal information team system to provide administrative support personnel and technical safeguards aligned with the public’s expectations.

The grounds previously used to pursue certifications such as ISMS-P, including penalty reductions, have become even more significant. With the revision of the Enforcement Decree of the Personal Information Protection Act following a series of large-scale personal information breaches involving Coupang, SKT, Lotte Card, and others, an unprecedented system has been introduced that provides a reduction in administrative fines—40% of the 10% of revenue—when a proactive protection system has been established before an incident occurs. Accordingly, a legal basis has now been established through the reduction system for the priority introduction of measures such as inspections of personal information processing systems and the securing of dedicated personal information protection personnel, which had previously been difficult to manage and inspect under the existing Personal Information Protection Act. Therefore, additional items must be reflected in the personal information protection regulations, additional records of personal information protection activities must be prepared, and the time has come to review budgets, including records of the implementation of personal information protection solutions. These measures, scheduled to take effect from the second half of 2026, must be reflected in the personal information management system without delay so that reporting to the CPO can be carried out.

This training explores the service privacy reviews pursued by Naver, Kakao, and Toss. It is designed to improve the capabilities of domestic consulting and privacy protection teams by identifying where service-specific privacy protection should be applied and explaining what to check during service reviews. Rather than covering only general laws or standard review checklists, this is an in-depth review training program that also provides a checklist.

The purpose is to improve, compared with last year, awareness campaigns that are not defined in the regulations and often end merely with the distribution of promotional gifts, by referring to best practices from various organizations, given the current situation in which the performance of events and campaigns such as Information Security Day or Personal Information Protection Day, held monthly or annually, is gradually declining. These events must now move beyond gift-distribution activities organized by the Information Security Team and become events in which all employees participate and uphold security together. It is necessary to build mutual understanding through the establishment of a communication system for embedding security into the organization. Ultimately, employees must have a good understanding of information security and the Personal Information Protection Act so that the organization can realistically protect itself from hacking and insider threats. Since the departments other than the Security Team—including those responsible for commissioning various projects, managing entrusted service providers, controlling applications and security settings, planning various informatization projects, and conducting IT audits—are designated to take overall responsibility, the Security Team is distributing security-related tasks among the respective departments. However, the current situation is that each department is merely expressing dissatisfaction. This opportunity should therefore be used to move away from that situation, as internal consultative bodies alone are insufficient. Security-related scoring criteria must be reflected in the powerful personnel evaluation system. Through unannounced audits, those who fail to comply should be disciplined through pay reductions or suspension, while those who properly observe security requirements and demonstrate achievements in support of security should receive substantial financial rewards through an incentive system. Security must be embedded in the organization so that employees take the initiative themselves. Accordingly, department and individual evaluation KPIs should be adjusted through a report to the CEO under the direction of the CISO. In addition, through a system for designating department-level information security officers and personnel in charge, the organization should strengthen its human security framework against hacking and information leakage—including the leakage of documents managed by each department and the management of service providers—by providing position allowances for these responsibilities.

Massive leaks of citizens' personal information due to recurring hacking incidents of the same type at credit card companies and insurers. Other personal information controllers also suffer repeated incidents, failing to prevent the same causes and attack methods. Detection is impossible despite spending budgets on advanced monitoring, and while personnel are continuously hired, reporting systems and internal regulations remain inadequate. This is part of a lecture for ongoing research and guidance aimed at resolving the persistent customer dissatisfaction, inconvenience, and total loss of service trust caused by these incomprehensible management systems.

As the leakage of linkage information occurred and became known, measures such as evaluating the importance and management status of CI (Connecting Information) were implemented. Accordingly, specialized training is being conducted.

Following the Privacy Audit 1 lecture, there has been a continuous failure to advance the tasks of internal privacy officers, along with a failure to preemptively prevent and block accidents due to maintaining the same routine as previous years and negligence. There is a lack of key-point internal training and communication by the Privacy Team due to the insufficient understanding of privacy protection among executives, including the CEO, CPO, division heads, and department heads. As the department in charge of personal information, the Privacy Team needs to improve the issue of continuously using only checklists for legal judgment and inspection (inspections based on minimum legal provisions have many blind spots). As accurate inspections based on precise judicial precedents and sanctions are required, it is necessary to conduct training on accurate knowledge.

Establishment of a reporting system, including the promotion of various agendas for the Privacy Policy Council and Working-level Council, and reporting the results of inspections on safety measures and legal compliance by the Chief Privacy Officer (CPO) to the CEO. There is a need to establish and implement a self-audit system for personal information to conduct professional internal preliminary investigations and inspections regarding recent hacking and data breach incidents. Recognizing that existing certification systems such as ISMS-P cannot prevent accidents. Despite the need to develop audit checklists reflecting diverse services and industry characteristics and to carry out colorful and extensive tasks such as internal personal information files and business flow analysis for partners (over 1,000) and branches (over 100), these tasks are not being implemented. Furthermore, despite the need to defend various blind spots, experts are unable to do so due to a lack of knowledge. Accidents continue to occur and risks remain because appropriate audits of existing security systems are not being carried out, and those previously considered experts in management systems are not actually experts. Through this study, we aim to eliminate blind spots and strengthen the inspection of existing security systems (promoting detailed inspections), derive improvement measures, and proceed with reporting.

As a security audit task for the Information Security Division, provide 2026 cases to refer to when conducting on-site audits, along with specific inspection plans (due diligence) that reflect the characteristics of the audit, and provide training to enable improvements after reviewing existing work systems.

In Financial AI Security (PART 1. Basics), I provided an overview of AI security. Please note that this is a practitioner's training session on the AI inspections required during actual security reviews for penetration testers (Red TEAM). This lecture contains practical content and explains how to perform penetration testing on technical aspects (including checklists). When studying, you may find AI difficult, or you might find that many companies have failed to apply AI guidelines because they are focused on modeling, making reviews challenging. I expect many companies have received various feedback during audits regarding the establishment of AI security governance. This is naturally because there is no clear evidence of AI security within internal operations. Now is the time to establish it. I hope you study AI security and pursue a path as an AI security professional.

Finally, I feel that the AI security review (NIS/FSI) checklists, which have been vaguely positioned over the past 7–8 years, are now accurate from a practitioner's perspective, and I have established a clear framework for how to change, establish, and operate the management system. I will explain what AI security is and how it should be improved after June 2026, based on the standards of South Korea's top-tier companies (those with the highest level of information security). (This is not a basic or conceptual explanation*) I have developed this training divided into PART 1 (Basics & Overview) and PART 2 (Advanced & Security Review), so please refer to it.

This training was created to first help privacy officers recognize and understand the requirements for establishing a proactive protection system, as previously announced through the June 2026 Personal Information Protection Act and the Personal Information Protection Commission's (PIPC) compliance inspections. It aims to help companies review their current status, identify areas for improvement, and establish future action plans. Based on over 8 years of experience in providing advisory and consulting services for personal credit information protection, this course is designed to support strategy formulation and the preparation of reporting documents for executive management.