Korea privacy watchdog expands security guidelines to cover passkeys, AI and quantum risks

The Personal Information Protection Commission said it has published a revised guide to the country's personal data security standards, updating it to cover new authentication technologies, artificial intelligence and the looming shift to post-quantum cryptography.

The guide explains the commission's amended notice, which from July 1 requires operators of public systems to run vulnerability checks and penetration tests at least once a year and to fix any flaws found without delay. The commission said it revised the notice to prevent leaks of personal data in the public sector caused by external hacking, and added explanations and a FAQ section so that public-system operators can understand and carry out the obligation.

The commission widened its list of acceptable authentication methods to 12 from seven. The earlier list covered passwords, one-time passwords and text messages; the revised guide adds passkeys, QR codes and mobile apps, and includes examples involving artificial intelligence.

It also addresses quantum computing, introducing post-quantum cryptography and stressing that encryption keys should be stored and managed securely — not kept in plain text in application source code or configuration files.

The FAQ section adds checks for the safe use and management of application programming interfaces, which are widely used to link information between systems, and explains what safeguards to consider when system updates are delayed. On password rules, it notes that forcing users to change passwords too often can push them toward simple passwords that are easy to remember.

"Through this revision of the guide, we expect to improve how the security standards are understood in the field and to reduce the confusion that personal data handlers may face when applying safeguards in their working environments," said Lee Sang-min, director-general of the commission's personal information policy bureau. He added that the commission will keep updating the guide in line with changes in data processing environments and technology.

The commission is chaired by Song Kyung-hee.