A personal information processor shall conduct personal information protection impact assessment of the following circumstances in advance and keep a record of the processing:
(I) processing sensitive personal information;
(II) making use of personal information to make automatic decisions;
(III) entrusting others to process personal information, providing other personal information processors with personal information, and disclosing personal information;
(IV) providing personal information to overseas parties; and
(V) other personal information processing activities that have a significant impact on individuals’ rights and interests.