Order appointing the person responsible for personal data processing

Organization​

On appointing the person responsible for organizing personal data processing

Order date, City​

Pursuant to Articles 18.1 and 22.1 of Federal Law No. 152-FZ (ФЗ) dated 27.07.2006, I hereby order: With effect from Effective date, appoint Responsible person’s position​, Responsible person’s full name​, as the person responsible for organizing personal data processing. The responsible person shall receive instructions directly from the head and report to the head. Coordination shall cover all the controller’s personal data processing activities: those relating to employees, job applicants, customers, partners and other data subjects, as applicable. Assign the following duties:

• internal control of compliance with legislation and personal data protection requirements;
• communicating legislative requirements, internal policies and data protection requirements to employees;
• organizing the receipt and handling of requests from data subjects and their representatives and supervising this work.

Within these functions, arrange recording of processing activities and changes to them, verification that access corresponds to job tasks, updating of the policy and internal documents, registration of requests and monitoring of their handling. Upon discovering a violation, report immediately to the head and coordinate action to stop the violation with the authorized subdivisions. Arrange preparation of notifications and responses within the applicable statutory deadlines; signing authority shall be determined separately. Additional allocation of tasks reflecting the controller’s structure: Responsible person’s duties​. Provide the responsible person with the necessary information on purposes, grounds, categories of data and data subjects, processing methods and protection measures. Appoint the following deputy during the responsible person’s absence: Deputy (full name, position)​. Approve employees’ access rights within their functions: List of employees authorized to access personal data​ Inform employees of personal data requirements when granting access and when applicable rules change. Provide additional training for authorized employees under the plan: Additional training plan​. Obtain confidentiality undertakings from authorized employees; these undertakings do not replace access restrictions. I retain oversight of implementation. Appointment of a responsible person does not release the controller from its duties.

Head’s position​ __________ / Head’s full name​ /

Acknowledgment of this order (personal signatures and dates): Acknowledgment: full name, position, actual date, signature​

Employees shall immediately report unauthorized access, misdirected transmission, loss or disclosure of data through: Internal channel for urgent incident reporting​. The responsible person shall register the report, preserve available information about the event and arrange cooperation with IT and the head. Access restrictions, recovery and destruction of data shall be performed only by authorized persons. The controller shall separately determine whether and how to notify the supervisory authority and data subjects.

Check that actual processing purposes and grounds comply with internal policies, access authorizations are current, evidence of acknowledgment is available, requests are recorded and protection measures are implemented. Report identified violations to the head with a proposed responsible person and deadline for remedial action.