Comparison of Personal Information Protection Levels by Company Size and Type: From the Perspective of Privacy Policy Assessment

The growing emphasis on ESG management has elevated data privacy protection as a key corporate competitiveness factor. While cybersecurity and data privacy are now recognized as essential ESG risk elements by global investors, empirical evidence on how company size and type relate to privacy protection levels remains limited. (1) Background/Purpose: This study evaluates personal information protection levels across 33 domestic and global companies operating in the Korean market to examine whether company size, revenue scale, service platform type, and domestic versus global status are associated with differences in privacy protection. (2) Methodology/Approach: Using the Privacy Policy Assessment System (개인정보 처리방침 평가제) introduced by the Personal Information Protection Commission of Korea in 2024, the study assessed the publicly available privacy policies of 33 companies across 11 service sectors as of August 1, 2024. Evaluation covered 20 items, 29 indicators, and 41 sub-indicators across three domains: Compliance (적합성), Rights Protection (권리보장), and Security (안전성). Companies were sourced from Rankey.com site rankings. (3) Findings: Domestic companies generally achieved higher compliance rates with Korean privacy laws than global companies. No significant correlation was found between revenue scale and privacy protection levels. Technical protection compliance ranged 30–75% and policy protection ranged 32–75%, indicating wide variance across companies. No company was found to score high on policy protection while scoring low on technical protection, suggesting that meeting policy standards is more difficult than meeting technical standards. (4) Originality/Value: This study provides the first empirical cross-sector evaluation of privacy protection levels in the Korean market using the newly introduced Privacy Policy Assessment System, demonstrating that global company status—not revenue size—is the primary differentiator of privacy compliance, and identifying actionable improvement priorities for policymakers and companies.