# PIPA Compliance Assessment Record

## Organisation Details

| Field | Value |
|-------|-------|
| Organisation Name | Zenith Global Logistics Korea Co., Ltd (제니스 글로벌 로지스틱스 코리아) |
| Business Registration Number | 123-45-67890 |
| Address | 25F, Gangnam Finance Center, 152 Teheran-ro, Gangnam-gu, Seoul 06236 |
| Industry | International Logistics and Freight Forwarding |
| Assessment Date | 14 March 2026 |
| Chief Privacy Officer (CPO) | Park Soo-jin, Director of Compliance |

## Processing Activity Register

### Activity 1: Customer Freight Services

| Element | Detail |
|---------|--------|
| Activity ID | PAR-KR-001 |
| Purpose | Freight forwarding contract fulfilment |
| Data Items | Name, phone, email, business address, shipping details, customs ID |
| Lawful Basis | Art. 15(1)(4) — Contract performance |
| Retention Period | Contract duration + 5 years (Commercial Act Art. 33) |
| Cross-Border Transfer | Yes — EU HQ (Germany), APAC operations (Singapore, Japan) |

### Activity 2: Employee HR Management

| Element | Detail |
|---------|--------|
| Activity ID | PAR-KR-002 |
| Purpose | Employment contract execution and legal compliance |
| Data Items | Name, resident registration number (encrypted), address, bank details, salary |
| Lawful Basis | Art. 15(1)(4) (contract) and Art. 15(1)(2) (legal obligation) |
| Sensitive Data | None (resident registration number has special protection per Art. 24-2 but is not classified as sensitive) |
| Retention Period | Employment + 3 years (Labour Standards Act) |

## Consent Register

| Consent Element | Article | Collection Channel | Status | Collection Rate |
|----------------|---------|-------------------|--------|-----------------|
| Essential service processing | Art. 15(2) | Customer registration form | Active | 100% |
| Marketing communications | Art. 22(2) | Separate opt-in checkbox | Active | 42% |
| Third-party logistics partner sharing | Art. 17 | Separate consent form | Active | 95% |
| Cross-border transfer to EU HQ | Art. 28-8 | Privacy notice notification | Active | 98% |
| Sensitive information (if applicable) | Art. 23 | Separate explicit consent | Active | 100% |

## Cross-Border Transfer Register

| Transfer ID | Destination | Mechanism | Notification Date | Status |
|------------|-------------|-----------|-------------------|--------|
| CBT-KR-001 | Germany (EU) | Adequacy recognition | Privacy notice v3.2 | Active |
| CBT-KR-002 | Singapore | PIPC SCCs | Employee notice 1 Sep 2025 | Active |
| CBT-KR-003 | Japan | Consent (Art. 28-8(1)(1)) | Consent collected | Active |
| CBT-KR-004 | United Kingdom | Adequacy recognition | Privacy notice v3.2 | Active |

## Data Subject Rights Log

| Request ID | Date | Type | Subject | Deadline | Status |
|-----------|------|------|---------|----------|--------|
| DSR-KR-2026-001 | 8 Jan 2026 | Access (Art. 35) | Kim Minjun | 18 Jan 2026 | Completed |
| DSR-KR-2026-002 | 20 Feb 2026 | Deletion (Art. 36) | Lee Soyeon | 2 Mar 2026 | Completed |
| DSR-KR-2026-003 | 5 Mar 2026 | Suspension (Art. 37) | Choi Hyunwoo | 15 Mar 2026 | In progress |

## Pseudonymisation Register

| Data Set | Purpose | Technique | Additional Info Separated | Review Date |
|----------|---------|-----------|--------------------------|-------------|
| Customer shipping patterns | Statistics (Art. 28-2) | k-anonymity (k=5) | Yes — HSM storage | Mar 2027 |
| Employee productivity metrics | Scientific research | Tokenisation | Yes — isolated DB | Jun 2026 |

## PIPA Compliance Checklist

| Requirement | Article | Status | Evidence |
|------------|---------|--------|----------|
| CPO designated | Art. 31 | Compliant | Appointment letter filed |
| Internal management plan | Art. 29 | Compliant | Plan v4.0 approved Jan 2026 |
| Consent mechanisms per requirements | Art. 22 | Compliant | Consent platform audit |
| Resident registration number encrypted | Art. 24-2 | Compliant | AES-256 encryption verified |
| Cross-border notifications provided | Art. 28-8(3) | Compliant | Notification records |
| Data destruction within 5 days | Art. 21 | Compliant | Automated lifecycle management |
| Breach notification procedure | Art. 34 | Compliant | Incident response plan |
| Employee PIPA training | Best practice | Compliant | Annual training completed |