Personal data protection regulation

Employer / organization​ Approved by document No. Document number​ dated Document date.

The purpose is to prevent unauthorized access, disclosure, loss and alteration of data. Protection shall be proportionate to threats, data types and processing methods under Articles 18.1 and 19 of Federal Law No. 152-FZ (ФЗ). Systems, premises and media: Personal data systems and storage locations​. Responsible persons and authority: Persons responsible for organizing processing and security​.

The controller shall provide unrestricted access to the public processing policy and information on protection requirements implemented. Where data are collected over a network, these shall be published on the relevant network, including the website pages where data are collected. This internal regulation supplements the public policy; passwords, configurations and other information whose disclosure would create a security threat shall not be published.

The head shall approve protection measures, provide resources and monitor rectification of violations. The person responsible for organizing processing shall coordinate the process register, training, data subjects’ requests and cooperation with the authorized authority. Administrators shall implement approved settings and maintain technical records; subdivision heads shall justify access and report personnel changes. One employee may combine roles only where authority is documented and oversight ensured. Employees shall use data only for the assigned purpose, shall not copy them to personal media or unapproved services, shall not disclose them to third parties and shall immediately report loss, misdirected transmission or suspicious access. Confidentiality shall continue after access ends; it shall not prevent lawful requests by a data subject or transfers in response to lawful requests from public authorities.

A request shall specify the purpose, system or premises, data items, permitted actions and duration. The subdivision head shall confirm the job-related need; an authorized person shall approve access, and an administrator shall implement and record the decision. Individual accounts shall be used. Shared administrative access shall be restricted and recorded separately, and actions must be traceable. Rights shall be reviewed upon reassignment; upon dismissal or loss of the basis for access, access shall be terminated and passes and media returned. Rights shall periodically be checked against actual duties and unnecessary rights removed. Information shall not be disclosed in response to a telephone or electronic request until the recipient’s identity, authority and legal basis have been checked.

Permitted roles and minimum necessary rights: Roles and permitted access rights​. Access shall be granted by a documented decision, reviewed regularly and terminated when its basis ceases. Sharing account credentials with other persons is prohibited. Employees shall receive access only after familiarizing themselves with the rules and confidentiality duty.

Before a system is commissioned and after material changes, identify current threats, the required protection level and the measures to be applied, and document the result. The level shall not be selected automatically according to the organization’s size. Protection effectiveness shall be assessed before operation begins. Apply access controls, secure authentication, media inventories, anti-malware protection, timely remediation of vulnerabilities, control of external connections and logging of actions involving data. Protection tools shall undergo the necessary conformity assessment where required. Logs shall be protected against alteration and accessible only to authorized persons. Backups shall receive no less protection than operational data. Restoration shall be tested periodically in a dedicated environment and the result recorded; backups shall be included in retention periods and destruction procedures. Upon restoration, earlier lawful deletions and restrictions shall be reapplied to prevent data returning to ordinary processing. Threats and protection of information systems: Threats, protection level and justification of measures​. Technical measures: Protection tools and settings for specific systems​. Backups: Backup parameters​. Paper files shall be stored in lockable locations accessible only to authorized persons; documents serving incompatible purposes shall be separated. Issue and return shall be recorded. Copying is permitted for a specific task with control of the number of copies, and transfer shall use packaging that prevents inadvertent viewing. Documents shall not be left unattended on desks or near shared printers. Spoiled copies shall be collected for controlled destruction, rather than discarded with ordinary waste. Storage locations, responsible persons and specific issue arrangements: Locations and persons responsible for paper records​.

A person discovering an incident shall immediately notify: Contacts and procedure for immediate incident reporting​. The responsible person shall record the circumstances, limit harm, preserve evidence and organize an investigation. Where an unlawful or accidental transfer resulting in infringement of data subjects’ rights is established, the controller shall notify the authorized authority within 24 hours and report internal investigation results within 72 hours under part 3.1 of Article 21 of Federal Law No. 152-FZ.

Employees shall not destroy logs or conceal errors. The responsible person shall record the detection time, report source, categories of affected data and persons, estimated scope and measures taken, preserve original evidence and restrict access to it. The technical team shall contain the incident without unjustified destruction of traces; legal assessment shall determine notification duties and further action. Available verified information shall be submitted before statutory deadlines expire; the investigation shall continue, documenting causes and corrective measures. After remediation, verify that unauthorized access has not recurred and review rights, procedures and training.

Training, reviews, effectiveness assessment and remediation of deficiencies: Plan for training, reviews and rectification of violations​. Oversight shall include reconciliation of rights, checks of storage and backups, and analysis of incidents and compliance with previous directions. Reviews shall document findings, responsible persons and remediation deadlines; closure of a violation shall be confirmed by a follow-up review. When grounds for ending retention arise, data shall be isolated from ordinary use, and mandatory document retention periods and related copies checked. Destruction shall be performed by authorized persons using a controlled method; record the data concerned, basis, method, date and evidence of the result. Responsible persons, systems, media and approved destruction method: Destruction procedure and evidence​. Merely deleting a file shall not be considered sufficient without checking that recovery is impossible where such a check is required. Signatory’s position​ __________ / Signatory’s full name​ /; authority Basis of authority​.