Privacy policy

What must a privacy policy include?

A privacy policy generally states what information you handle, why, for how long and with whom, plus how customers can view and delete their own information. The specific items are set out in Korea's Personal Information Protection Act (PIPA) and the Personal Information Protection Commission's (PIPC) "Privacy Policy Writing Guidelines."

The guidelines are revised from time to time, so check the latest version on the Personal Information Portal whenever you create or update your policy. The table below lists items small businesses commonly handle, as examples only; it isn't a substitute for legal advice.

It's better to write the policy in words customers can easily understand rather than copying legal terms as they are. A line like "We collect your phone number to send booking confirmation texts" helps customers feel comfortable leaving their information.

How do I write a privacy policy?

A privacy policy starts not with copying another site's document but with listing the information your own website actually collects.

A privacy policy isn't something you write once and forget. Whenever the way information flows changes, like adding a booking feature or switching text message providers, the policy needs updating too.

If a cafe website only has a contact form, its privacy policy will be short and simple too. Remember: the less information you collect, the less you have to write and the fewer obligations you have.

1. 01Find every place on your website that collects customer information. (contact form, booking, sign-up, orders, newsletter)
2. 02Write down what each one collects and what it's used for.
3. 03Set a retention period for each item. Also check whether other laws require you to keep records, as they do for online shops.
4. 04List the companies you entrust with processing (hosting, text messaging, payment gateway, booking tools).
5. 05Check for tools that record information automatically, like visitor analytics or ad pixels.
6. 06Write the text for each item while following the PIPC's writing guidelines.
7. 07Link to it at the very bottom of your website, separate from other terms, and when it changes, keep the revision date and the previous version.

Is getting privacy consent the same as publishing a privacy policy?

No. A privacy policy is a public notice anyone can read, while consent is a separate step where you ask the customer at the moment you collect their information.

Besides consent, PIPA provides other legal grounds for processing personal information, such as when it's needed to enter into or carry out a contract. So not every piece of information needs a consent checkbox, but on the other hand, some cases, like marketing texts, require separate consent.

For example, if a cafe only sends booking confirmation texts, that information can arguably be seen as necessary for the booking, but sending new-menu news by text generally requires separate consent to receive advertising. To find out which applies to your business, check the guides on the Personal Information Portal or ask a professional.

What do I write if I entrust personal information to another company?

Handing information to companies that do work on your business's behalf, like sending texts, hosting your website or processing payments, is called "outsourced processing." Your privacy policy lists the names of those companies and the work you've entrusted to them.

Giving information to another company to use for its own purposes is "provision to a third party," which is handled separately from outsourcing. And if you use a service with servers overseas, you may need to include information about cross-border transfers, so check the writing guidelines.

For instance, if a craft studio uses both a booking tool and a text notification service to take class sign-ups, both companies go on the outsourcing list. If you switch providers, update the privacy policy as well.

What are common mistakes in privacy policies?

The most common mistake is when the privacy policy doesn't match the actual website. If you add a birthday field to your contact form but leave the policy unchanged, what you told customers no longer matches reality.

You should also avoid hiding the policy somewhere hard to find. The law requires the policy to be disclosed in a way customers can easily check, such as keeping it posted on your website at all times.

• Copying another company's policy and leaving that company's name in it
• Listing items you don't even collect, like resident registration numbers or home addresses
• Writing the retention period only as "permanent" or "until account deletion," with no real standard
• No privacy officer contact, or one nobody answers
• Adding visitor analytics or ad pixels without updating the policy
• Making fields required even when they aren't needed for the inquiry

What should I ask my web agency for?

Final responsibility for the privacy policy lies with the business collecting the information, but the agency knows best what the website stores and how. So it works well to get the technical facts from the agency and reflect them in your policy.

Even if the agency drafts the policy for you, you need to check that it matches how your business actually runs. How long you really keep booking records and who answers customer inquiries are decisions for your business, not the agency.

If you have questions, you can find guides and resources on the Personal Information Portal. To report or get advice about a privacy violation, call 118 (no area code needed).

• A list of the items each form on the website stores
• A list of outside tools used (visitor analytics, ad pixels, maps, chat, text messaging)
• Which country the servers and data are in
• Whether there's a feature that automatically deletes information past its retention period
• Who can access the admin panel, and whether access logs are kept
• Whether they can add a short note next to the contact form explaining what is collected and why