Recommendations of Roskomnadzor on PD processing

The Federal Service for Supervision in the Sphere of Telecom, Information Technologies and Mass Communications (abbreviated in Russian as “Roskomnadzor”) has published recommendations for companies – operators of personal data associated with the organization and implementation of activities for the processing of such data.

According to the information on the website, Roskomnadzor offers operators to carry out a number of actions that can improve the security of working with personal data (PD) and reduce the risk of their unauthorized dissemination. The scope of the recommendations is as follows:

1. Minimization of collected data.

It is recommended to collect and process only those PD that are necessary for the conduct of the organization's activities. By reducing their redundancy, their extent of security increases.

2. Separate storage of PD

It is recommended to provide separate data storage depending on their category: suppliers, clients, employees, etc.

3. Storing identifiers in separate databases

It is better to store data identifying a particular person (full name, phone number, address, e-mail, etc.), as well as information about interaction with him or her (provision of services, sale of goods, conclusion of a transaction, etc.) in separate, unrelated databases. To link databases, it is possible to use synthetic identifiers that will not allow to attribute information to a specific PD subject without additional algorithms.

4. Refusal to accumulate "spare" PD

It is not recommended to collect and accumulate PD if the probability of their use is extremely small or absent. In this case, it is recommended to destroy such data, since they may not correspond to the purpose of PD processing.

5. Use of technical means

To ensure an appropriate level of PD security, it is recommended to use corresponding technical and software tools belonging to the PD operator.

6. Timely notification about the incidents

It is recommended to inform the Roskomnadzor authorities in a timely manner about signs or an incident that has already occurred in the field of PD, which led to the illegal dissemination of PD.

7. Providing physical access control

To prevent data compromise within the company, it is necessary to take measures to physically control access to data.

8. Appointment of a responsible person for the protection of PD

It is recommended to appoint a person responsible for the protection of PD and give him or her the appropriate powers.

Taking into account the recommendations above, the company should conduct an appropriate data audit, adapt internal processes in accordance with the instructions of Roskomnadzor, inform and train responsible employees of new methods of working with PD.

Please be reminded that for violation of the requirements of the legislation in the field of personal data, administrative liability is provided under article 13.11 of the Administrative Code of the Russian Federation. The scope of punishment depends on the type of offense committed. For more information about the scope of liability, see the table below.

Type of offense	The scope of punishment
PD processing that is not provided for by the legislation of the Russian Federation or PD processing that is incompatible with the purposes of collecting such data	Imposition of a fine: - for officers – in the amount of 10,000 - 20,000 rubles; - for legal entities – in the amount of 60,000 - 100,000 rubles. In case of repeated violation, the penalties are increased and will amount to: - for officers – in the amount of 20,000 - 50,000 rubles; - for legal entities – in the amount of 100,000 - 300,000 rubles.
PD processing without the consent of the PD subject	Imposition of a fine: - for officers – in the amount of 20,000 - 40,000 rubles; - for legal entities – in the amount of 30,000 - 150,000 rubles. In case of repeated violation, the penalties are increased and will amount to: - for officers – in the amount of 40,000 - 100,000 rubles; - for legal entities – in the amount of 300,000 - 500,000 rubles.
Non-fulfillment by the PD operator of the obligation to provide the PD subject with information about the processing of his or her PD	Imposition of a fine: - for officers – in the amount of 8,000 -12,000 rubles; - for legal entities – in the amount of 40,000 - 80,000 rubles.
Non-fulfillment by the PD operator when collecting PD, including via the Internet, of the obligation to ensure the recording, systematization, accumulation, storage, clarification or extraction of PD of citizens of the Russian Federation using databases located in the Russian Federation	Imposition of a fine: - for officers – in the amount of 100,000 - 200,000 rubles; - for legal entities – in the amount of 1,000,000 - 6,000,000 rubles. In case of repeated violation, the penalties are increased and will amount to: - for officers – in the amount of 500,000 - 800,000 rubles; - for legal entities – in the amount of 6,000,000-18,000,000 rubles.

In the matters of compliance with the legislation in the field of personal data, please contact Acsour experts.