124 Free Compliance Generators — South Korea PIPA + PCI DSS v4.0 SAQ-D
ComplyKit now has 124 free compliance generators — no account required. Today we're adding two highly-requested tools: the South Korea PIPA 2023 Amendments Compliance Checker (123rd) and the PCI DSS v4.0 SAQ-D Compliance Checklist (124th). Both cover 42 compliance items across six categories and generate a full AI compliance report.
South Korea PIPA 2023 Amendments Compliance Checker (123rd generator)
South Korea's PIPA 2023 amendments introduced the most significant reforms since the law's 2011 enactment — data portability rights, automated decision-making protections, a unified 72-hour breach notification timeline, expanded extraterritorial scope, and penalties up to KRW 3B or 3% of global turnover. The Personal Information Protection Commission (PIPC) has been actively ramping up enforcement, making this a high-priority compliance area for Korean companies and MNCs with Korean operations. The South Korea PIPA Compliance Checker covers 42 key obligations across six categories:
- Lawful Basis & Consent (PIPA Articles 15–22): Lawful basis mapping (6 bases), consent architecture (freely given/specific/informed/unambiguous, separate from ToS), separate explicit consent for sensitive personal information (9 categories), purpose limitation, minimum collection principle, consent withdrawal mechanism, consent records
- Data Subject Rights (PIPA Articles 35–40): Right to access (10-day response), correction and deletion (10 days), suspension of processing, 2023 Amendment data portability right (이동요구권), 2023 Amendment automated decision-making right (explanation + objection), identity verification for requests, PIPC complaint pathway
- Personal Information Handler Obligations (PIPA Articles 23–31): Privacy notice (개인정보 처리방침) — mandatory contents annually updated; Resident Registration Number (RRN) processing controls (strict legal authorisation requirement); sensitive personal information enhanced protections; retention schedule and automated deletion; security measures (encryption, access control, access logs); processor contracts with PIPC-required clauses
- Security Measures & Breach Notification (PIPA Articles 29, 34): Mandatory encryption (RRNs, passwords, biometric, financial data); access control matrix; incident response plan; 72-hour PIPC notification (2023 Amendment harmonisation); individual notification for high-risk breaches; breach incident register; annual security self-assessment
- Third-Party Provision & Cross-Border Transfer (PIPA Articles 17–18, 39-12): Third-party provision consent (separate, with recipient/purpose/retention/items disclosed); cross-border transfer consent (country name + recipient + rights disclosed); adequacy determination/contractual safeguards; 2023 Amendment PIPC restriction power; processor agreements with PIPC-required clauses; sub-processor controls
- PIPO, Governance & PIPC Compliance (PIPA Articles 31, 33, 2023 Amendments): PIPO appointment (qualification criteria, authority, independence); PIPC registration; 2023 Amendment local representative for foreign companies (1M+ Korean data subjects or KRW 10B+ Korea revenue); Privacy Impact Assessment (개인정보 영향평가) for high-risk systems; staff training; PIPC enforcement risk management (KRW 3B/3% penalty)
Who it's for: Korean companies and startups; MNCs with Korea operations; foreign SaaS companies serving Korean enterprise customers; e-commerce platforms targeting Korean consumers; fintech, healthtech, and edtech companies; legal/compliance teams preparing for PIPC audits; organisations processing sensitive personal information or RRNs.
PCI DSS v4.0 SAQ-D Compliance Checklist (124th generator)
PCI DSS v4.0 became mandatory on March 31, 2024, retiring v3.2.1. SAQ-D is the most comprehensive assessment form, applicable to merchants and service providers that store, process, or transmit cardholder data and do not qualify for simpler SAQs. v4.0 introduces significant new requirements — 12-character passwords, expanded MFA for all CDE access, authenticated vulnerability scanning, SDLC security, enhanced file integrity monitoring, and the Customised Approach option. The PCI DSS v4.0 SAQ-D Compliance Checklist covers 42 key controls across six requirement groups:
- Network Security Controls (Req 1–2): NSC/firewall rules with 6-month review cycle; CDE segmentation validated annually; wireless controls (WPA3/WPA2-Enterprise) with quarterly rogue AP scans; hardening standards (default passwords changed, unnecessary services removed); deny-all permit-by-exception rules; current network diagram with CHD flows; v4.0 TRA for NSC review frequency
- Protect Account Data (Req 3–4): CHD discovery and inventory; PAN masking (first 6/last 4); SAD not retained post-authorisation; AES-256 encryption at rest; TLS 1.2+ for transmission (no SSL/TLS 1.0/1.1); key management (generation/distribution/rotation/destruction with split knowledge and dual control); v4.0 targeted risk analysis for retention and deletion
- Vulnerability Management (Req 5–6): Anti-malware deployed and auto-updated; patch management (critical: 1 month); secure coding standards (input validation, parameterised queries, OWASP Top 10); v4.0 SDLC with pre-production code review and annual developer security training; v4.0 authenticated internal vulnerability scanning; WAF/automated solution/annual code review for public-facing web apps; v4.0 TRA for scan frequency
- Strong Access Control (Req 7–9): RBAC with minimum access; MFA for all non-console CDE access; individual accounts (no shared/generic); v4.0 12-character password minimum (90-day rotation); v4.0 MFA for all CDE accounts including admin; physical access controls (badge, visitor log, CCTV); media protection (encryption, NIST SP 800-88 disposal)
- Monitor & Test Networks (Req 10–11): Audit logging of all CDE access (daily review, tamper-evident, 12-month retention, 3 months immediately available); IDS/IPS for CDE perimeter; quarterly internal vulnerability scans (QISA); quarterly external ASV scans; annual penetration test (network + application layers); v4.0 FIM for system/configuration/content files
- Information Security Policy & Governance (Req 12): Annual security policy review; annual risk assessment; security awareness training (hire + annual, including phishing); role-based training for security staff; incident response plan (tested annually, card brand notification procedures); service provider management (TPSP list + agreements + annual assessment); v4.0 targeted risk analysis and Customised Approach documentation
Who it's for: E-commerce merchants; SaaS companies handling payment data; payment facilitators and aggregators; service providers with access to cardholder data; organisations migrating from PCI DSS v3.2.1; security teams preparing for QSA assessment; startups building payment functionality and needing to understand PCI DSS scope.
Browse all 124 generators
All 124 free compliance generators are at /generate. No account required. Covers GDPR, CCPA, SOC 2, HIPAA, ISO 27001/27701, EU AI Act (GPAI + High-Risk), NIS2, DORA, PSD2/PSD3, FCA Consumer Duty, CSRD, CRA, NIST CSF 2.0, NIST AI RMF, NIST SP 800-53 Rev 5, CMMC 2.0, Digital Markets Act, EU Data Governance Act, EU Data Act, ePrivacy, AI Fairness, SOC 2 Trust Services Criteria, US State Privacy Laws, APRA CPS 230, APRA CPS 234, Singapore PDPA, India DPDP Act, Saudi Arabia PDPL, Australia Privacy Act 2024, Thailand PDPA, Japan APPI 2022, South Korea PIPA, PCI DSS v4.0 SAQ-D, and more.