Protection of personal data under Federal Law No. 152, Federal Law No. 149 and the legislation of Kazakhstan
Audit and development of a complete set of documents for organizations that operate personal data.
New requirements for the processing of personal data
Since 2023, new legal requirements for the processing of personal data have entered into force.
Acsour lawyers will prepare all documents in full compliance with the current legal requirements of the Russian Federation and the Republic of Kazakhstan.
We will develop a complete set of documents or bring into compliance a personal data protection system to reduce the risks of fines.
Acsour lawyers will prepare all documents in full compliance with the current legal requirements of the Russian Federation and the Republic of Kazakhstan.
We will develop a complete set of documents or bring into compliance a personal data protection system to reduce the risks of fines.
Acsour Personal Data Protection
- Audit of compliance with legislationAudit of personal data processing processes and information systems for compliance with the requirements of personal data processing and development of recommendations for the elimination of inconsistencies.
- Comprehensive preparation of documentsLawyers will prepare a complete package of necessary documents (policies, templates, internal documents) in accordance with the new requirements of the legislation of the Russian Federation.
- Hourly legal adviceAs part of the hourly consulting, Acsour lawyers can advise you on any issues related to the processing of personal data in Russia and in other countries.
Important to know
- Who is the operator?The vast majority of legal entities are personal data operators, as they collect and process personal data of employees, contractors and individual clients.
- Responsibility for violations in the Russian FederationViolation of legislation in the field of personal data protection can lead to serious consequences. In accordance with Article 13.11 of the Administrative Code of the Russian Federation, fines are provided for legal entities up to 18 million rubles.
- Responsibility for violations in the Republic of KazakhstanIllegal actions with personal data can lead to a fine from 229,725 tenge to 3,063,000 tenge (Article 79 of the Administrative Code of the Republic of Kazakhstan). Violations of the confidentiality of personal information can be punishable by imprisonment for up to seven years (Article 147 of the Criminal Code of the Republic of Kazakhstan).
- Individual approachWe offer an individual approach to the protection of clients' personal data, analyzing the scope of their activities and the specifics of the company to determine the optimal security measures and necessary services.
- Confidentiality of informationIn accordance with the law "On Personal Data", we will help not only reduce the risks of fines, but also ensure the protection of confidential client information, preventing possible security threats and preserving the company’s reputation.
By contacting us, you will receive professional help and expert support. We offer a wide range of services, including analysis and development of security measures, employee training, audit of the data protection system and much more. Our goal is to provide complete and reliable protection of your personal data so that you can focus on your business without worrying about possible threats.
Services for compliance with the requirements of Federal Law No. 152 "On Personal Data"
The kit includes the preparation of the following set of documents:
- The Regulation on the processing of personal data
- The Regulation defining the list of positions and third parties who have access to personal data
- Regulation on the cross-border transfer of personal data.
- Regulations on the applicable means of personal data protection.
- Regulations on the backup of personal data.
- Regulations on the depersonalization of personal data.
- Regulations on conducting control measures and responding to information security incidents.
- Privacy statement for the company’s website (if available).
- The decision to approve the personal data system.
- Notification of the processing of personal data / Notification of a change in the information contained in the notification of the intention to process personal data.
- Notification of the intention to carry out cross-border transfer of personal data (if any).
- Consent to the processing of personal data and their standard forms.
Audit of personal data processing processes and information systems for compliance with the requirements of personal data processing under Federal Law No. 152 and development of recommendations for the elimination of inconsistencies.
For companies that want to understand their personal data protection risks and eliminate them.
The service includes:
For companies that want to understand their personal data protection risks and eliminate them.
The service includes:
- Information collection: Lawyers collect and analyze all publicly available information, provided documentation and data revealed during the interviewing of company employees.
- Assessment of compliance with the requirements of the Federal Law "On Personal Data": Based on the conducted survey of information systems and personal data processing processes, the degree of compliance with the requirements of Federal Law No. 152 dated 07/27/2006 "On Personal Data" in terms of personal data processing is determined.
- Preparation of a report including a description of the identified risks and recommendations for their elimination and minimization.
Acsour lawyers will provide professional advice on specific issues related to the storage, processing and transfer of personal data, including in accordance with international law.
If necessary, analyze a narrowly focused question on the topic of working with personal data, which is not described in our services.
The service includes:
If necessary, analyze a narrowly focused question on the topic of working with personal data, which is not described in our services.
The service includes:
- Information collection: Lawyers collect and analyze all publicly available information, provided documentation and data revealed during the interviewing of company employees.
- Assessment of compliance with legal requirements and current practice.
- Preparation of a legal opinion with a description of the risks or preparation of relevant documents.
Audit (examination) of compliance with the laws on data protection of other countries and regions.
Stages:
1.Collecting information;
2.Conformity assessment: based on the conducted survey of information systems and personal data processing processes, the degree of compliance with the requirements of the relevant legislation in terms of personal data processing is determined.
3. Preparation of a report including a description of the identified risks and recommendations for their elimination and minimization.
Stages:
1.Collecting information;
2.Conformity assessment: based on the conducted survey of information systems and personal data processing processes, the degree of compliance with the requirements of the relevant legislation in terms of personal data processing is determined.
3. Preparation of a report including a description of the identified risks and recommendations for their elimination and minimization.
Lawyers will develop documents on the Law of the Republic of Kazakhstan "On personal data and their protection", taking into account local specifics.
For companies operating on the territory of Kazakhstan, and also performing operations affecting the jurisdiction of the republic.
The composition of the documents being developed:
Additionally, other necessary documents may be developed.
For companies operating on the territory of Kazakhstan, and also performing operations affecting the jurisdiction of the republic.
The composition of the documents being developed:
- Personal Data Processing Policy.
- Regulation on the organization of processing and ensuring the security of personal data.
- A list of personal data necessary and sufficient to perform the tasks performed in the Company.
- A list of business processes containing restricted personal data and persons with access to them.
- Register of the transfer of personal data to third parties, cross-border transfer, and dissemination of personal data.
- The register of consents to the processing of personal data.
- An order on the appointment of a person responsible for the organization of personal data processing.
- Instructions from the person responsible for the organization of personal data processing.
Additionally, other necessary documents may be developed.
- Reducing risksaudit and preparation of documentation under Federal Law No. 152, taking into account new requirements
- TOP 5 "Pravo-300"Acsour is among the leaders of the regional ranking
- ISO 27001compliance with the international standard in the field of information security
Questions about the processing of personal data
- Question:What is the amount of fines for violation of the law in the field of protection of PD?Answer:For different types of violations, different fines are provided. So fines from 30 thousand to 18 million rubles can be imposed on a company in Russia.
- Question:Which companies are recognized as PD processing operators?Answer:The operator of personal data is a company that receives and processes personal information, and also has goals and a list of actions with the data provided.
- Question:What is recognized as personal data?Answer:Any information about an individual that allows you to identify him. There is no specific list of data in the law.
- Question:Does a company dealing with PD processing need to submit an application to Roskomnadzor?Answer:From September 1, 2022, the processing of personal data by operators without notifying Roskomnadzor is allowed only in certain cases listed in paragraph 2 of Article 22 of the Federal Law "On Personal Data":
—Personal data is included in the state information systems created to protect the security of the state and public order (the Ministry of Internal Affairs and other law enforcement agencies);
—PD processing activities are carried out without the use of automation tools (for example, only a paper log of visitors is kept);
—PD is processed for the safety of transport and transport facilities. In all other cases, companies are required to submit a notification to Roskomnadzor. - Question:Do foreign companies need to comply with the requirements of Russian legislation on the processing of PD?Answer:
Yes, foreign companies are required to comply with the requirements of Russian legislation on the processing of personal data if they collect, process and store personal data of citizens of the Russian Federation.
- Question:If a company has a website, does it need to post a privacy policy on it?Answer:
Yes, if your company collects personal data of its visitors through the site. For example, the site may have forms for subscribing to a newsletter, registering a personal account, applying for or receiving feedback, or an online chat system or an online consultant.
Be aware of changes in legislation
Subscribe to the monthly Acsour Review
You consent to the use of cookies, using our website. It ensures the correct operation of the website and helps us to improve it.
ОК