Law of Telecommunications and Information Technology

1. A service provider shall take all the measures and arrangements necessary to protect the confidentiality of the user’s personal information and documents and to prevent access thereto or unlawful use thereof, including preparing policies for such purpose and submitting them to the Commission for approval, in accordance with relevant statutory provisions. 2. The user's information and documents may not be disclosed except with his Law of Telecommunications and Information Technology consent and subject to relevant statutory provisions. 3. Subject to relevant statutory provisions, if the user's information or documents are compromised in any way, the service provider shall take all the measures necessary to protect such information and documents and shall promptly notify the Commission and the user of the incident in detail. 4. Without prejudice to relevant statutory provisions, a service provider shall retain the user's information and documents for the period determined by the Commission. Such period shall be calculated from the last date the service is provided. If a dispute arises between the user and the service provider, such information and documents shall be retained until the dispute is resolved.