Personal data retention and protection regulation

Employer / organization​ No. Document number​ dated Document date

Approval and commencement: Approval and commencement details​.

Processes and data subjects: Information processes and categories of data subjects​. Processing shall be limited to predetermined lawful purposes. Excessive data shall not be collected; access shall be granted only to the extent necessary. Retention periods shall be determined by the purpose and applicable obligations, rather than a single period for all data. Register of purposes and retention periods: For each purpose, record the processing basis, categories of data subjects and data, operations, storage location, retention period and termination event. Before a new process starts, the responsible person shall check its lawfulness; using previously collected data for an incompatible purpose is prohibited.

Additional details reflecting actual circumstances: Purpose register: data, subjects, basis, operations, retention periods and termination for each purpose​ Responsible person: Person responsible for processing: full name and position​.

Procedure for granting and terminating access: Access shall be granted for a specific function on a manager’s request, following approval by the responsible person. Users shall receive only the necessary rights, be informed of their confidentiality duty and use individual accounts. Sharing passwords and using others’ accounts are prohibited. Rights shall be reviewed upon reassignment; access shall be revoked without delay upon dismissal or termination of the assignment. Exports and copying shall be permitted only for the established purpose.

Additional details reflecting actual circumstances: Roles, scope of access and granting/revocation procedure​ Paper records: Documents shall be kept in locked cabinets or rooms with restricted access. Records serving different purposes and retention categories shall be separated. Issue shall be logged and return monitored; copies shall not be left on publicly accessible desks or printers. Transfer shall prevent access by unauthorized persons. Locations and custodians: Storage locations, responsible persons and issue log for paper records​. Personal data information systems (ИСПДн) and databases: Personal data information systems (ИСПДн), databases and hosting locations​. Technical measures: The responsible person shall identify threats and applicable protection requirements; access controls, activity logging, anti-malware protection, updates, backups and restoration testing shall be implemented. Media shall be inventoried, and remote access restricted and monitored. When equipment is withdrawn from service, data shall be erased before transfer to third parties. Specific systems and measures: Threats, protection level, measures, backups and logging​. No cross-border transfers are made under this procedure. Any change requires prior legal review and updating of documents.

Requests shall be registered on the day of receipt and forwarded to the responsible person. Identity, representatives’ authority and the request’s connection with the data shall be checked; excessive identity documents shall not be requested. The responsible person shall determine the applicable deadline and monitor the response, correction, blocking or termination of processing. Refusals shall state reasons by reference to a lawful basis and be sent through a secure channel.

Additional details reflecting actual circumstances: Contact and procedure for registering requests, verifying identity, responding and monitoring deadlines​ While a request is investigated, unlawfully processed data shall be blocked; inaccurate data shall be blocked subject to the statutory conditions and corrected after confirmation. Termination, destruction and responses shall occur within the periods prescribed by Article 21 of Federal Law No. 152-FZ (ФЗ), taking account of lawful grounds for continuing processing. Destruction and confirmation procedure: Before destruction, check the purpose, retention period, mandatory retention and any lawful basis for continued processing. Paper shall be destroyed so that it cannot be read; electronic data shall be deleted from operational systems and included in the backup deletion cycle. When a backup is restored, earlier deletion decisions shall be reapplied. The person performing destruction shall record the data concerned, basis, method, date and evidence of destruction; where timely destruction is technically impossible, the statutory blocking procedure shall apply. Additional details reflecting actual circumstances: Destruction methods, responsible persons, evidence and grounds for extended retention​

Employees shall immediately report loss of media, misdirected transmission, unauthorized access and other signs of a breach to the responsible person. The responsible person shall restrict further access, preserve logs and evidence, assess the scope and consequences and organize an investigation. Notification deadlines run from detection of the incident, not completion of the investigation. The urgent reporting contact and deputy shall be designated when this regulation is approved. Additional details reflecting actual circumstances: Immediate reporting channel and persons responsible for incidents​ Where an unlawful or accidental transfer of data resulting in infringement of data subjects’ rights is established, the controller shall notify the authorized authority of the incident within 24 hours and of the internal investigation results within 72 hours under part 3.1 of Article 21 of Federal Law No. 152-FZ. Internal control shall cover the purpose register, currency of access rights, retention periods, performance of processing assignments, requests and protection measures. Employees shall be informed and trained according to their roles. Violations shall be recorded with responsible persons and deadlines; remedial action shall be verified. Changes to processes, threats and legislation are grounds for updating this regulation. Additional details reflecting actual circumstances: Internal control and training procedure​ The public policy shall be provided separately; internal protection information shall be disclosed only to the extent required by law.

Signatory’s position​ ______________ / Head’s full name​ /