Personal data flows and inventory
Map collection fields, storage, recipients, processors and deletion paths.
Security & cloud
Trace personal data from collection through deletion
ISMS-P adds personal data lifecycle requirements to information security management. Prepare evidence of actual collection, use, disclosure, outsourcing and deletion flows.
Source record updated:
Discuss your certification →Scope and applicability
Korean integrated information security and privacy management certification
KISA's guidance allows entities subject to ISMS to choose ISMS or ISMS-P. ISMS-P is not automatically mandatory for every organization processing personal data; distinguish any future expansion by scope and effective date.
Korean certification schemes and international standards are different. A translated guide does not extend a Korean certificate to other countries. Confirm the target market, product classification and current requirements with the relevant body.
Who this is for
- Platforms processing substantial customer data
- Services with complex processors and disclosures
- Companies meeting customer privacy assurance requirements
Documents to prepare
Privacy policies and contracts
Reconcile notices, consent, retention periods, processor contracts and monitoring.
Integrated risks and operating evidence
Connect security controls to rights requests, deletion and incident response.
Preparation process
Define privacy scope
Identify services, systems, processors and personnel handling data.
Operate and improve controls
Review lawful processing and safeguards against actual flows and retain evidence.
Assess and resolve deficiencies
Support on-site checks and corrective submissions before the decision.
Timing
Allow for the required system operating history plus assessment and remediation. Multiple services and processors increase data-flow reconciliation work.
Agency fees
Institutional assessment fees
Calculated using the official fee worksheet
The scope includes infrastructure, personnel, personal data services and processors.
Sources and references ↗Document automation and management cost KRW 300,000 per month. Expert services and certification body testing or assessment fees are separate. Specify supports preparation; the relevant authority or certification body makes the final decision.
Pricing and certification costs →Optional expert consulting
Expert review and consulting are optional, separately scoped services. Choose support for ISMS-P Certification based on your team's readiness and the evidence or assessment preparation you need.
- Confirm institutional testing, assessment and registration fees separately in the contract.
- Development fixes, clinical studies where applicable, security equipment and infrastructure operations may require separate budgets.
- Confirm internal staffing, travel, translation, VAT, surveillance and renewal costs in the quotation.
Questions and answers
Does ISMS also mean ISMS-P certification?
No. Confirm that the additional privacy lifecycle requirements were assessed and included in the issued scope.
Is a privacy notice enough?
Actual flows, contracts, consent, rights handling and deletion must agree with operating evidence.
Is a published cost range a binding quote?
No. Request a written quote for the actual scope and separate assessment fees from preparation support.