The Personal Information Protection Commission of South Korea announced yesterday local time the "2024 Personal Information Processing Policy Assessment Results." This annual assessment investigated 49 companies across seven major areas, including evaluations by experts and general users. The report shows that 72% of the evaluated companies have discrepancies between their actual personal information retention status and their statements. Furthermore, over half of the companies described their retention/use period for personal information as the vague "necessary period," and some companies did not specifically explain "personal information that is not destroyed according to the law." This means that data subjects find it difficult to understand which personal information will be destroyed and when it will be destroyed. The report indicates that companies need to update their statements to data subjects in a timely manner regarding their actual methods of personal information processing when introducing new services, changing, or terminating existing services.