Comprehensive Guide to Personal Information Protection Training & Retirement Pension Training Targets & Materials

Personal information protection training and retirement pension training are not applied uniformly to all workplaces; instead, the criteria for eligibility, materials, and documentation must be verified based on whether personal information is processed and whether a retirement pension system is operated.

Key Summary

item	Personal Information Protection Training	Retirement pension education
Educational nature	Education connected to the obligation to manage, supervise, and educate personal information handlers	Statutory education for retirement pension scheme participants
Main targets	Personal information processors, personal information handlers, and personal information protection officers	Retirement pension scheme subscribers
Application criteria	In cases where personal information is processed for business purposes	DB In cases where a DC or DC type retirement pension system is operated
Training cycle	Regular training is required, and operation at least once a year is recommended.	At least once a year
Educational materials	Personal Information Learning Center, Personal Information Protection Commission materials, internal management plan, internal security standards	Materials provided by retirement pension providers, retirement pension bylaws, current status of system operations, and subscriber information materials
Supporting documents	Training plan, training materials, attendance list, certificate of completion, internal management plan	Educational materials, subscriber list, dispatch records, certificates of completion, posting records
Fines and sanctions	Risk of sanctions arises for leaks or insufficient safety measures, rather than a fixed fine solely for failure to conduct training.	Failure to conduct training at least once a year may result in a fine of up to 10 million won.

Personal information protection training and retirement pension training are all HR· This is training that is frequently managed together by management support personnel. . However, the two types of education differ in their scope of application and legal nature. . Personal information protection training covers tasks involving the processing of personal information and the management of personal information handlers. · Connected to the supervisory system , Retirement pension education is subscriber education that must be conducted annually if there are subscribers to the retirement pension system. .

What are Personal Information Protection Training and Retirement Pension Training?

Personal Information Protection Training is education provided by organizations that process personal information to their personnel regarding appropriate handling standards, access control management, prevention of leakage, and internal management plans. The Personal Information Protection Act requires the management and supervision of personnel handling personal information, and the Enforcement Decree stipulates that internal management plans for the safe processing of personal information must include matters regarding management, supervision, and training for such personnel.

Retirement pension education is training that employers who have established a Defined Benefit (DB) or Defined Contribution (DC) retirement pension plan must conduct for their subscribers at least once a year. The training content includes information that subscribers need to understand, such as the operation of the retirement pension plan, types of benefits, eligibility requirements, contributions, payment procedures upon retirement, the tax system, and retirement planning.

Therefore, while both types of education are often grouped and managed as “legally mandated education,” in practice, they must be separated as follows.

division	Key judgment criteria
Personal Information Protection Training	Whether our organization processes personal information, and who the personal information handlers are
Retirement pension education	Whether our organization operates a retirement pension system and who the subscribers are
Common management points	Retention of participant list, educational materials, completion records, and supporting documents

Who needs to check?

It is recommended that the personal information protection manager and the retirement pension manager review personal information protection training together, rather than the HR manager managing them alone.

manager	Things to check
HR manager	List of trainees, management of new hires, resignees, and employees on leave, verification of completion status
Management Support Manager	Training schedule, external training institution contract, data storage, internal announcements
Privacy Officer	Scope of personal information handlers, internal management plan, access rights management, training content
IT· Security personnel	Training on personal information processing system access rights, access logs, and security protocols
Retirement pension manager	List of retirement pension subscribers, types of schemes, educational materials, cooperation with retirement pension providers
Manager/Team Leader	Encouraging team member participation in training, guidance on personal information processing standards

In particular, since HR, general affairs, accounting, payroll, recruitment, customer service, marketing, and IT departments are highly likely to handle personal information, you must verify whether they are personal information handlers. Retirement pension training is not automatically applied to all employees; instead, eligibility must be determined based on those enrolled in the retirement pension scheme.

Procedures that the person in charge must check

1. First, determine if the training applies to our company.

The applicability of personal information protection training and retirement pension training may vary depending on the company's circumstances.

Education Name	Application Judgment Criteria
Personal Information Protection Training	Verify whether personal information of customers, employees, applicants, members, etc., is processed for business purposes
Retirement pension education	DB Check if a DC or DC retirement pension plan is in operation and if there are any subscribers.

If there is work involving the processing of personal information, it is necessary to conduct personal information protection training regularly for personal information handlers. Retirement pension training must be conducted at least once a year for subscribers by employers who have established a retirement pension system.

2. Finalize the training participants

If the training participants are not accurately organized, some may be omitted even if the training is conducted.

division	Examples of Personal Information Protection Training Targets	Examples of Retirement Pension Education Target Audiences
HR· HR manager	Processing of employee personal information and job applicant information	Management of retirement pension subscribers
Payroll and Accounting Manager	Processing of salary, accounts, resident registration numbers, etc.	Check contributions and salary calculation data
Customer Service Representative	Customer name, contact information, consultation history processing	Not applicable
Marketing Manager	Processing of member information, email, and event application information	Not applicable
IT· Security personnel	Personal Information Processing System Access Authority Management	Not applicable
Employees enrolled in the retirement pension	Exclusion possible if not a personal information handler	Retirement pension education target

Personal information protection training is “ While it can be conducted as "training for all employees," the key in practice is to ensure that personal information handlers are not omitted. For retirement pension training, you must first verify whether the workplace operates only a severance pay system or has established a retirement pension system.

3. Prepare educational materials.

For both training sessions, it is recommended to utilize both official and internal company materials. Using only common materials may omit our organization's actual processing procedures or the operational status of our systems.

Education Name	Available materials	Content to add within the company
Personal Information Protection Training	Personal Information Learning Center, Personal Information Protection Commission Information Materials, Personal Information Processing Policy Training Materials	Scope of personal information handlers, access permission standards, internal management plan, and leakage response procedures
Retirement pension education	Educational materials, system explanation materials, and subscriber information materials provided by retirement pension providers	Our company's retirement pension types, operational status, subscriber contact information, and retirement procedures

The personal information protection education materials include the collection of personal information. · utilization · custody · Destruction criteria , Access control management , Leak prevention , Consignment management , It is recommended to include incident response procedures, etc. .

Retirement pension educational materials must include content related to benefit types, eligibility requirements, contributions, benefit payment procedures upon retirement, transfers to individual retirement accounts, taxation, and retirement planning.

4. Check the training methods and online operation standards.

Personal information protection training and retirement pension training can be conducted in various ways, such as online training, group training, posting of materials, and email distribution. However, what is more important than the training method is whether the content was actually delivered to the participants and whether supporting documentation remains.

Educational methods	Things to check during operation
Online education	Check completion status, training hours, training content, and certificate of completion
Group training	Attendees' list, training log, training materials, photos, or record keeping
Video Education	Storage of access logs, participant lists, and educational materials
Send email	Check recipient, sending date, attachments, and receipt records
Posting on the company bulletin board	Check posting location, posting period, and accessibility
External commissioned training	Verification of data, certificates of completion, contracts, or entrustment records from educational institutions or retirement pension providers

Personal information protection training can utilize online resources such as the Personal Information Learning Center, and its practical applicability is enhanced when conducted in conjunction with internal organizational training materials. Retirement pension training can be conducted by utilizing materials provided by the retirement pension provider or by making the content accessible to subscribers through internal computer networks, bulletin boards, or email.

5. We keep supporting documents.

If you have conducted training, you must keep supporting documentation. You should be able to explain “who the target audience was, who completed the training, and what materials were used,” rather than focusing solely on the training itself.

Supporting documents	Personal Information Protection Training	Retirement pension education
Education plan	Regular training schedule, target audience, training content	Annual Retirement Pension Training Schedule
List of subjects	List of personal information handlers	List of retirement pension subscribers
Educational materials	Personal Information Protection Training Materials, Part of Internal Management Plan	Retirement pension system explanatory materials, subscriber guide materials
Certificate of Completion	Verification of online training completion	Confirmation of completion of retirement pension training
Sending records	Email, internal bulletin board announcement records	Records of sending and posting educational materials
Training Log	Training Date, Instructor, Content, Attendees	Date and time of training, method of providing materials
Supplementary education records	Training for new personal information handlers and absentees	Training for new members and absentees

It is good to manage personal information protection training in conjunction with internal management plans. , Even if retirement pension education is entrusted to a retirement pension provider, the company must verify whether the education for subscribers has been conducted and provide supporting documentation. .

Practical Checklist

item	check
We checked the applicability of personal information protection training and retirement pension training, respectively.	□
A list of personal information handlers was compiled.	□
I checked the list of retirement pension scheme subscribers.	□
The personal information protection training materials included content on collection, use, storage, destruction, access rights, and response to data leakage.	□
The retirement pension education materials included information on system types, operational status, benefit payment procedures, taxation, and retirement planning.	□
When operating online education, measures were made to allow verification of completion status and educational content.	□
When materials were provided via email or bulletin board, records of sending and posting were kept.	□
Training standards were established for new hires, new personal information handlers, and new retirement pension subscribers.	□
When utilizing external commissioned training or materials from retirement pension providers, we verified whether they aligned with the company's internal standards.	□
Educational materials, participant lists, certificates of completion, dispatch records, and training logs were kept.	□
We also provided guidance on consultation and grievance response procedures in the event of personal information leaks or retirement pension complaints.	□

parts that are often missed

First, there are cases where personal information protection training is simplified to the point where "all employees simply attend for one hour once a year." The core of personal information protection training is to manage, supervise, and educate personal information handlers to ensure they handle personal information safely. Therefore, the scope of personal information handlers, access rights, internal management plans, and procedures for responding to data breaches must all be managed together.

Second, there is a misconception that retirement pension training applies equally to all companies. However, retirement pension training must be conducted for subscribers at workplaces that have established a retirement pension system. Workplaces operating only a severance pay system must separately verify whether this applies.

Third, there are cases where companies believe that they do not need to verify the matter if they entrust it to a retirement pension provider. While companies can utilize the provider's data or outsource training, they must jointly verify whether the subscriber education was actually conducted and whether supporting documentation remains.

Fourth, there are cases where support for the person in charge is missed following a personal information leak. Personal information incidents can lead not only to legal and technical responses but also to stress for the person in charge, the burden of handling customers, and disputes over responsibility within the organization.

Fifth, there are cases where only educational materials are kept without recording whether each participant has completed the course. It is necessary to keep educational materials, participant lists, certificates of completion, training logs, and email sending records together to make it easier to explain compliance later.

EAP Situations where it is needed

While personal information protection and retirement pension training are intended to ensure compliance with regulations, in actual practice, counseling, grievance handling, and organizational communication may be necessary even after the training.

In the following situations, you may consider EAP or external counseling and organizational support systems together.

situation	EAP Directions for use
The person in charge complained of extreme stress following the personal information leak incident.	Individual psychological counseling, stress management support
The team atmosphere deteriorated due to customer complaints and internal disputes over responsibility.	Manager coaching, organizational communication support
Personal information handlers complain of work burden and anxiety about making mistakes.	Job stress counseling and work response guides provided
Employee inquiries and anxiety have increased following changes to the retirement pension system.	Guidance on consultation channels and administrator support after the briefing session
Financial and psychological anxiety related to retirement, reinstatement, and older workers appear together	Counseling on life issues, psychological support, and connection to external resources
Education was provided, but a culture of personal information protection has not taken root.	Organizational culture diagnosis, manager training, recurrence prevention program

Personal information protection training and retirement pension training must not merely be managed in terms of completion, but must be linked to ensure employees actually understand and act safely. EAP can be utilized as a complementary system to support psychological support after an incident, alleviate the burden on personnel, facilitate managerial response, and restore trust within the organization.

Frequently Asked Questions

Q1. Do all companies have to conduct personal information protection training?

Organizations that process personal information in the course of business must conduct management, supervision, and training for personal information handlers. However, rather than viewing the training as having fixed times and methods identical for all workplaces, as is the case with other mandatory legal training, it is advisable to determine the training targets based on the specific tasks involved in processing personal information and the scope of personal information handlers.

Q2. Is a fine immediately imposed for personal information protection training as well?

Personal information protection training is linked to the obligations of management, supervision, and training for personal information handlers. However, rather than assuming that a fine of a fixed amount will be immediately imposed solely for the failure to conduct training, it is safer to review the risk of sanctions in conjunction with personal information leakage, insufficient safety measures, and inadequate internal management plans.

Q3. Is retirement pension education required for all employees?

Retirement pension education is intended for participants in the retirement pension system. Businesses operating a defined benefit (DB) or defined contribution (DC) retirement pension system must provide education to participants at least once a year.

Q4. Is there a fine for not providing retirement pension education?

If an employer who has established a retirement pension system fails to conduct subscriber education at least once a year, they may be subject to a fine of up to 10 million won. Therefore, it is recommended to manage records regarding the provision of educational materials, completion status by subscriber, and posting or distribution.

Q5. Can I conduct the personal information protection training and the retirement pension training on the same day?

While it is possible to conduct them on the same day for operational reasons, the target audience and content of the training must be separated. It is advisable to manage supporting documents separately, focusing on personal information handlers and processing standards for personal information protection training, and on retirement pension participants and system operations for retirement pension training.

Next step

I want to go beyond simply managing completion of personal information protection and retirement pension training and connect it with personal information incident response, employee grievances, organizational risk management, and psychological support. Multifaceted nudge EAP Training tailored to our organization through introduction consultation · counsel · Review the organizational support system. .

👉 Go to Nudge EAP Implementation Consultation ->

source

This content is intended for general informational purposes. Specific legal, labor, employment, personal data protection, and psychological counseling matters may vary depending on workplace circumstances and the latest laws, so a review by relevant experts may be necessary.

Personal Information Protection & Retirement Pension Training