Keeping access logs is easy.
Reviewing them is the hard part
Article 29 of Korea's Personal Information Protection Act (PIPA, 개인정보 보호법) requires personal information controllers to take the measures needed to keep personal information secure. It applies to any organization that processes personal information of people in Korea, including foreign companies. The detailed rules are in the Personal Information Protection Commission (PIPC) notice, the Standards for Personal Information Security Measures (「개인정보의 안전성 확보조치 기준」). Of these, access control and access log reviews are the clauses where monitoring and log analysis help directly.
What it requires
This is based on PIPC Notice No. 2026-9, in effect since July 1, 2026.
Article 3 of the notice says to apply measures suited to your own environment, taking into account how much personal information you hold, what types, and the impact on data subjects.
| Article | Summary |
|---|---|
| Article 4 Internal management plan | Set up and carry out an internal management plan covering access rights, access control, encryption, access log retention and review, vulnerability assessment, breach response and more. The chief privacy officer reviews how well it is carried out at least once a year. Small business owners, individuals and groups processing fewer than 10,000 data subjects may skip this |
| Article 5 Managing access rights | Grant rights differentially, limited to what each job needs. Change or revoke them without delay when roles change. Keep records of granting, changing and revoking for at least 3 years. Issue a separate account to each person handling personal information and don't share accounts. Restrict access after a set number of failed authentication attempts |
| Article 6 Access control | Restrict access by IP address and similar means. Analyze the IP addresses and other details of connections to detect and respond to leak attempts. Apply secure authentication for staff connecting from outside. Disconnect automatically after a set period of inactivity |
| Article 6-2 Blocking internet access | If the daily average number of users whose data was stored and managed over the last 3 months, as of the end of the previous year, is 1 million or more, block internet access on the computers of staff who can set access rights or download or destroy personal information |
| Article 7 Encryption | One-way encryption for passwords. Store resident registration numbers, passport numbers, driver's license numbers, alien registration numbers, credit card numbers, bank account numbers, biometric information and similar data encrypted with a secure algorithm. Encrypt data sent and received over the internet |
| Article 8 Keeping and reviewing access logs | Keep access logs for at least 1 year, or at least 2 years for systems processing 50,000 or more data subjects or processing unique identification information or sensitive information, and for key telecommunications operators. Define in the internal management plan how often and how access logs and downloads are checked and what follow-up steps are taken, and carry it out. Prevent forgery, alteration, theft and loss |
| Article 9 Preventing malware | Install and run security software, update automatically or at least once a day, apply security updates immediately when they are announced |
Under Article 2 of the notice, an access log is an electronic record of the identifier, access date and time, access location, the data subject whose information was processed, and the task performed. If you only keep login records and leave out whose information was looked up, you don't meet the requirement.
How the requirements map to Genox features
Genox doesn't create access logs itself.
It takes the records left by your personal information processing systems or DB access control solution and finds lookups and downloads that don't fit the usual pattern.
| Requirement | Related Genox features / services | What you have to do yourself |
|---|---|---|
| Article 6(1)(ii) Analyzing connection IPs and detecting leak attempts | Behavioral Analyzer compares each account's access hours, access location and download volume against its baseline. Threat Correlator links VPN, proxy and lookup records into a single case | Set IP-based access restriction policies, run the follow-up procedure after detection |
| Article 8(2) Reviewing access logs and downloads | Flags bulk lookups and suspected exports with the evidence behind them, so there is less to review. You can hand the review work to AI security monitoring and MDR | Define review frequency, method and follow-up steps in the internal management plan, and decide on follow-up such as asking for explanations or disciplinary action |
| Article 8(1) · Article 8(3) Retention period and preventing tampering | You set the retention period for logs and verdict records Genox receives. Genox signs and keeps its own audit logs | Keep the original access logs securely for at least 1 or 2 years. Genox does not keep the originals for you |
| Article 5 Managing access rights | Flags access and use of privileges that fall outside each account's baseline | Run the procedures for granting, changing and revoking rights, and keep those records for 3 years |
| Article 4(1)(x) Vulnerability assessment | Vulnerability Scanner, penetration testing and assessment | Decide how often to assess, fix what is found |
| Article 9 Preventing malware | Analyzes suspicious files in the Behavioral Analyzer sandbox. It does not replace antivirus | Install security software and keep it updated |
| Article 7 Encryption | No related feature. Vulnerability Scanner can find some keys and passwords left in plain text in repositories or code | Identify what needs encryption, apply encryption and set up key management procedures |
If you operate a public system
Institutions operating public systems designated by the PIPC have the additional measures in Chapter 3 of the notice.
- Article 17: take the necessary measures, such as analyzing public system access logs in an automated way to detect illegal leaks and attempts at misuse and requiring the reason to be explained
- Article 17: provide a function that lets institutions using the public system review the access logs of their own staff directly
- Article 18: a vulnerability assessment for each public system at least once a year, and a penetration test by an outside specialist organization or expert at least once a year. Article 18 takes effect on January 1, 2027
You can prepare the automated analysis with Behavioral Analyzer and Threat Correlator, and the penetration test with our penetration testing and assessment service. The institution still has to set the detection criteria and the explanation procedure.
Frequently asked questions
If we use Genox, have we met the access log review duty?
No. The notice says to define review frequency, method and follow-up steps in the internal management plan and carry them out. Genox is a tool that picks out which of the many access log entries to look at first. Deciding that the review was done, and taking follow-up action, is still up to the person in charge.
Doesn't this raise employee surveillance concerns?
The baseline only uses metadata your policy allows (access time, transfer volume, what was accessed). Even so, employee monitoring may require consultation with employee representatives or notice to staff, so we suggest agreeing on the scope with HR and legal before you adopt it.
If we use MDR, will Genox see personal information?
If the monitored logs contain personal information, Genox analysts can see it. This can count as outsourcing the processing of personal information, so the scope of outsourcing and how it is supervised need to be set at the contract stage. With an on-premises install, analysis data doesn't leave your network, and Genox staff access is approved case by case.
Does a company with few users need Genox?
Not necessarily. If you process few data subjects and your systems are simple, the standard reports from your DB access control solution may be enough for reviews. If you don't have a security person, you could start with Genox Guard or the free self-assessment.
References
- Standards for Personal Information Security Measures (개인정보의 안전성 확보조치 기준), Korean National Law Information Center (in Korean)
- Personal Information Protection Act (개인정보 보호법), Korean National Law Information Center (in Korean)
- Personal Information Protection Commission
Let's first look at where and how your access logs are kept today
Share your list of personal information processing systems and how they keep access logs, and we'll show you how to narrow down what needs reviewing and what's missing.