A method for protecting personal information in a home network, the method comprising the steps of: receiving, by a controlled device, a subscribe request for a service of the controlled device, from a control point; accepting, by the controlled device, the subscribe request; receiving, by the controlled device, information about the control point from the control point; and performing, by the controlled device, event information delivery to the control point according to a policy when an event occurs in the controlled device; wherein the method is characterized in that it further comprises the steps of: transmitting, by the controlled device, the information about the control point to a policy manager; and receiving, by the controlled device, a policy for event information delivery to the control point, which is generated by the policy manager based on the information about the control point; wherein the step of performing, by the controlled device, event information delivery to the control point is in accordance with the policy received from the policy manager, wherein the policy manager generates the policy for event information delivery by setting event delivery conditions based on user input, said event delivery conditions prescribing whether at least one of delivery, authentication and encryption is to be applied. receiving, by a controlled device, a subscribe request for a service of the controlled device, from a control point; accepting, by the controlled device, the subscribe request; receiving, by the controlled device, information about the control point from the control point; and performing, by the controlled device, event information delivery to the control point according to a policy when an event occurs in the controlled device; wherein the method is characterized in that it further comprises the steps of: transmitting, by the controlled device, the information about the control point to a policy manager; and receiving, by the controlled device, a policy for event information delivery to the control point, which is generated by the policy manager based on the information about the control point; wherein the step of performing, by the controlled device, event information delivery to the control point is in accordance with the policy received from the policy manager, wherein the policy manager generates the policy for event information delivery by setting event delivery conditions based on user input, said event delivery conditions prescribing whether at least one of delivery, authentication and encryption is to be applied. transmitting, by the controlled device, the information about the control point to a policy manager; and receiving, by the controlled device, a policy for event information delivery to the control point, which is generated by the policy manager based on the information about the control point; wherein the step of performing, by the controlled device, event information delivery to the control point is in accordance with the policy received from the policy manager, wherein the policy manager generates the policy for event information delivery by setting event delivery conditions based on user input, said event delivery conditions prescribing whether at least one of delivery, authentication and encryption is to be applied.