Employee Personal Data Processing Regulations

Employer / organization​

Approved by: Particulars of the approval order​. Regulations dated Document date, No. Document number​. Effective from Effective date.

These Regulations cover personnel-related processing of data of employees, former employees and other persons expressly listed in the purpose register. Processing is lawful, for defined purposes and limited to what is necessary; combining incompatible purposes and collecting excessive data are prohibited. The register forms part of these Regulations:

Detailed purposes, data covered, grounds and retention periods by document type: Register of purposes, categories of persons and data, grounds and retention periods​ Data are obtained primarily from the employee. When obtaining data from third parties, the prior notification and written consent requirements of Article 86 of the Labor Code of the Russian Federation (ТК РФ) are observed. Personnel processing required by law or contract performance is not replaced by a demand for blanket consent to any operations. Where consent is necessary, it is executed separately from other documents signed by the employee and is specific and demonstrable. Withdrawal stops only processing for which no other lawful ground exists. Special categories of data and biometric data are processed only on separate grounds provided by law.

Person responsible for organizing personal data processing: Responsible person's full name, position and contact details​, accountable to the controller's executive body; this person organizes monitoring, staff familiarization and handling of requests. Only authorized persons may access data within their duties. Personnel staff use information to administer employment relations, payroll staff for payments and mandatory reporting, and unit heads only as needed to organize work. A technical administrator's access does not itself authorize use of personnel information for other purposes. Named list of persons and access limits: Positions, names, data sets and access limits​. Before access is granted, persons are familiarized with processing rules and the duty of confidentiality. On a change of position or termination of work, access is reviewed or revoked and storage media are returned. Paper records and information systems are used: Information systems and databases used​. Individual accounts, access controls, activity logging, backups and recovery, and protection against unauthorized access are provided to the extent determined for the controller's systems. Storage locations and safeguards adopted: Storage locations and safeguards​. Database localization requirements are observed when collecting Russian citizens' data. Decisions affecting employees' rights are not made solely on the results of automated processing, except where permitted by law.

Data are transferred to state authorities on a lawful ground and to the extent necessary. Transfers to other recipients require an applicable ground and compliance with Article 88 of the Labor Code of the Russian Federation (ТК РФ). Recipients are notified of purpose limitations and confidentiality, except where statutory exceptions apply. These Regulations do not authorize publication of employees' personal data in the public domain. These Regulations do not automatically authorize cross-border transfers: a separate review and completion of applicable procedures are required before transfers begin.

The employee reports changes to information needed by the employer and provides supporting documents where applicable. The report is registered; the responsible person checks whether the change is relevant to the processing purposes, updates the data and, where necessary, informs authorized recipients. Excessive document copies are not retained "just in case". The employee may know what data are processed and how, obtain access and copies where provided by law, and request removal or correction of inaccurate or incomplete information. The employee may appoint a representative; authority is checked before release. Transfers to employee representatives are limited to data necessary for their lawful functions. If the employee disagrees with evaluative information, they may supplement it with a statement of their own view. Refusal of access or correction is documented with the grounds and appeal procedure; the employee may not be compelled to waive data protection rights.

Requests are received through: Channels for data subject requests and person responsible for replies​. After authority is checked, the requester is provided with information and data access, and updating, blocking, cessation of processing and destruction are arranged within statutory time limits; refusals are reasoned. The right to appeal is not restricted. The employee immediately informs the responsible person of lost storage media, misdirected information or unauthorized access. Access is restricted, evidence is preserved and an investigation is conducted. For an incident covered by Part 3.1 of Article 21 of Federal Law No. 152-FZ (152-ФЗ), the controller sends an initial notification to the authorized authority within 24 hours, and the internal investigation results within 72 hours of detection. Retention periods are determined by purposes and mandatory document requirements, rather than a single arbitrary period. Once grounds cease, data are destroyed or anonymized where provided for; destruction is confirmed under the prescribed procedure. Procedure: Retention review and destruction procedure​. Internal monitoring: Internal monitoring procedure and frequency​. Employees acknowledge these Regulations and relevant amendments by signing. Violations entail liability within the law; contractual fines are not imposed on employees. Signatory's position​ __________ / Employer's signatory: full name​ / Acknowledgment sheet: employee's full name, signature, date __________.

Logs contain only necessary information; access to the logs themselves is restricted.