PD compliance overview

PD is separated from other information; no data with incompatible purposes on one medium

media for different purposes stored apart; storage places and authorised persons defined

model forms and pass logbooks follow items 7-8, Res. 687

outside Art. 1 only oral speech and unsystematised paper; boundary disputed

RKN 01.07.2026: PCs, 1C, emailed documents are automation; the Art. 22(2)(8) exemption fails

9th AAC, A40-12676/2024: collection via a website form is not by itself automation if a human processes the data

Moscow Dist. AC 27.03.2025: view deemed right, appeal reversed

RKN's broad reading is contestable, but relying on this case is risky

CENTRAL ROLE

PD operator

Applicants and related persons

5 categories

Staff, owners and related persons

16 categories

Counterparties and related persons

9 categories

Interacting persons

9 categories

Other categories

8 categories

Data subject category catalogue

privacy-advocates.com/pd/

katalog_subektov

As of: 15.11.2025

The list is non-exhaustive and needs adapting to the operator's activities

SOLE TRADER'S DUAL STATUS

A sole trader is both a data subject and a PD operator as an economic actor

Regulator's word

oral positions at open days and meetings, cautions and orders to remedy

Practice

written RKN and Digital Ministry clarifications, inspection lists, case law

Rules

152-FZ, 149-FZ, Labour and Civil Codes, Res. 1119, 687, 1046, RKN orders 18, 140, 178, 179, 180, 187, FSTEC 21, 117, FSB 378, 77

Constitutional

Arts. 23-24: private life, personal, family secrets

Informational

149-FZ: access restriction and confidentiality

Special

152-FZ: PD regime, subject rights, operator duties

Civil law

Civil Code Ch. 8: private life, image (Art. 152.1)

Sectoral

bank, medical, telecom secrecy, Labour Code Ch. 14

Roskomnadzor

subject rights: inspections, preventive visits, remote oversight, Art. 13.11 CAO cases

FSTEC of Russia

technical protection: Orders 21, 117, security tool certification, Art. 19(8) control in GIS

FSB of Russia

crypto (Order 378), GosSOPKA, orders on system access and DB copies

Prosecutor's office

general supervision beyond 248-FZ limits, brings Art. 13.11 CAO cases

Min. of Digital Development

regulation: biometrics and UBS, depersonalisation and NSUD, bills

Bank of Russia

finance: FinCERT incidents, IS standards, fintech biometrics

FAS of Russia

ads: mailings, calls without consent, Art. 18 Advertising Law

Rospotrebnadzor and Rostrud

forced consent in consumer contracts, HR data under Labour Code Ch. 14

Operator

PD

inspections under 248-FZ

no-contact actions

preventive visit

citizens' appeals and Art. 20(4) requests

prosecutor's request (Art. 17.7 CAO)

Six criteria

free and in own interest, plus five features in Art. 9(1)

ORDINARY FORM

Any provable method

active tick in a web form, oral with a recording, by conduct

the operator bears the burden of proof: event log with date, time, text and identifier

screenshots plus notes do not satisfy a court

an interface tick is not an electronic signature

WRITTEN FORM, ART. 9(4)

Only where the law expressly requires it

Special categories

Art. 10, 152-FZ

Biometrics

Art. 11, 152-FZ

Public sources

Art. 8, 152-FZ

Automated decisions

Art. 16, 152-FZ

Employee PD from third parties

Art. 86(3), Labour Code

Transfer of employee PD

Art. 88, Labour Code

Art. 10

152-FZ

The list is closed

Property status and credit history stay ordinary PD; genetic and biometric data have their own regimes. The list cannot be widened by interpretation, nor the regime lowered.

Inferred data counts too

If health or beliefs are inferred from purchases, geolocation or a search profile, the derived data is processed under Art. 10.

Photos: purpose decides

A facial image becomes a special category when processed specifically to determine race, ethnicity or beliefs.

UBS TRACK

572-FZ: facial image and voice

Identification (1 to N, who is this?) only via the UBS: own biometric identification in organisations' systems is banned (Art. 15)

Authentication (1 to 1, is it you?) against UBS vectors via an accredited organisation; the office needs no own accreditation

Initial collection only by authorised bodies (MFCs, banks) and the Gosuslugi Biometrics app; no own enrolment terminal

Res. 1912 (from 01.03.2026) kept UBS check-in, and from 01.04.2026 by Gosuslugi document. From 01.01.2027 regional segments hold vectors only

ART. 11 TRACK, 152-FZ

Everything outside 572-FZ

Fingerprints, vein pattern, iris (outside the Res. 408 list) and checks by an official

Written consent in a separate document, to a specific operator, processors named

An employer may not take fingerprints for passes (Rostrud); biometrics is destroyed on dismissal

Not biometrics: visitor counting, PPE control, meeting transcription without identification

Biometrics leak - Art. 13.11(17) CAO: ₽15-20m regardless of volume

Ban on coercion

rules and sanctions

Art. 11(3), 152-FZ

service cannot be refused for declining to give biometrics

Art. 3(11)-(13), 572-FZ

services and sales cannot be conditional on biometrics

Art. 5.63(2.1), Art. 14.8(8) CAO

official refusing a state service: up to ₽25k; entity refusing a consumer: ₽200-500k

Children's SIM cards

From 01.03.2027 a subscriber may tell the telecom operator that a child uses the number (210-FZ of 26.06.2026). Draft rules bar login codes and other SMS to it.

Marketing and profiling

Direct marketing to a child only with prior consent (Art. 15(1)); profiling children is a high-risk zone.

Harm assessment

Processing minors' PD under a contract with them, outside legal cases, means high harm (RKN Order 178).

PROCESSING INSTRUCTION (ART. 6(3))

Processor acts for others' purposes

actions and processing purposes

confidentiality and Art. 19 security measures, protection level

localisation per Art. 18(5) as of 01.07.2025

incident notice well before the operator's 24 hours

destruction proof, audit right, sub-processing terms

PD TRANSFER (no instruction)

Recipient is an independent operator

framework inter-operator agreement, mutual and equal

lawful transfer: consent or another basis under Art. 6(1)

confidentiality (Art. 7) and security (Art. 19(1)) on each side

informing subjects and handling their requests

?

whether the recipient has its own purpose

Website hosting and support

regulator treats it as an instruction (case A49-14214/2022)

Capacity without data access

RKN orally: instruction (14.08.2026); experts: four processor features, incl. access

Each has a legal duty

no instruction, each processes under its own duty (e.g. clearing)

Is access defined?

The list of persons entitled to access at a given moment or period can be reliably determined

Is access controlled?

Access is in fact blocked for everyone not entitled to it

Provision

to a defined circle; no Art. 10.1 consent needed, an Art. 6 basis is

Dissemination

to an undefined circle; Art. 10.1 regime, usually consent per RKN Order 18

Art. 3(11), 152-FZ

Transfer to the territory of a foreign state to a foreign person. The expert approach adds purposefulness.

foreign analytics and clouds, backups abroad

document flow with a foreign parent company

bookings and tickets with foreign companies

remote access by a foreign contractor from abroad

transfer to a Russian citizen abroad

dissemination to an undefined circle

service with no data access

own branch, not a legal entity (disputed, RKN's view changed)

BASELINE RISK

e.g. Armenia, Azerbaijan, Serbia, Turkey, Argentina, Mexico

start right after notification

ELEVATED

EU states, UK, Switzerland, Japan, Republic of Korea

start after notification, higher chance of an interagency ban

ELEVATED

e.g. UAE

start after 10 working days, country law review needed

MAXIMUM

e.g. USA

start after 10 working days, backup route in advance

Recruitment

applicant search, assessment, talent pool

HR management

hiring, onboarding, records, dismissal

Staff remuneration

pay, deductions, incentives

Staff productivity, development and safety

training, health and safety, medical checks

Staff support and motivation

health insurance, benefits, company events

Staff geographic mobility

business trips, relocation, transport

Operational security

access control, protection from intrusion

IT support of operations

communications, equipment, software, IS

Operational efficiency and resilience

management, control, protection of rights

Support of operations

contracts, settlements, procurement

Improvement and development of operations

marketing, platforms, audience analysis

Core business operations

core activity under the charter

Catalogue of PD processing purposes

privacy-advocates.com/pd/

katalog_celej

paper: cross-cut shredding, burning, redaction

machine media: mechanical destruction, erasure, handover for disposal by inventory

SSDs are not wiped by software overwriting; crypto-erase is not fixed in law

Art. 19(2)(3.1), 152-FZ: conformity-assessed security tools with destruction

assessment form disputed: FSTEC allows any (04.10.2024), FSB - certification (05.10.2024)

failure is Art. 13.12 CAO, not Art. 13.11

RKN Order 179: an act always, with automated processing plus a PDIS event log extract

keep 3 years, electronic act allowed

if instructed, processor's act first, then operator's (RKN, 14.08.2026)

Traps

from 2025 oversight checks the process, not a one-off

Backups

retired before rotation; restoring from a copy brings back what was destroyed

Surviving data

an act does not help: mailing after destruction is fined, Art. 13.11(5)

Forgotten media

laptops, USB sticks, email, exports left out of the plan

STAGE 1

Survey

collecting and analysing documents and data

interviews, survey of processes and PDIS

findings log and record of processing (RoPA)

STAGE 2

Assessment and threat models

list of recommendations from the survey

subject harm assessment (RKN Order 178)

threat models and protection level (Res. 1119)

STAGE 3

Documents and decisions

policy, regulation, orders and forms

RKN notifications on processing and CBT

protection model, PDPS and action plan

Control

of legal and protection compliance

Information

communicating requirements to staff, training

Communications

subject requests, contact in the operators register

One per operator

the notification names one person, duties are delegated internally

May be external

an employee of another organisation or a legal entity, but a non-staff officer is low harm under Order 178

Reports to the executive body

has access to information, but no guarantee of independence

Not appointed

no separate offence; the head answers as an official. Sole traders and individuals need not appoint

Wider in practice

RoPA, contract review, harm assessment, incidents, support in inspections

Since 2025 formality is costly

turnover fines, Art. 272.1 Criminal Code, fine reduction via IS spend

Unit of analysis

describe the process and pick a scale: from all of marketing to a single site

Exposure

sum of 9 parameters (status, purposes, sensitivity, sources, subjects, third parties, CBT, scale, scenarios) × visibility from 1 to 4

Criticality

weighted sum over 10 requirement domains; life cycle and security weigh up to 4 points

RKN remote oversight

Monitoring of sites, policies, consent forms, cookies; register checks with no requests or visits

Subject complaints

Complaints to RKN, prosecutors, courts over spam, forced consents and unanswered requests

PD leaks

Incidents at the operator and its processors. RKN notice in 24 and 72 hours, turnover fines for repeat leaks

FOR THE OPERATOR

Overall takeaways

All three trigger externally; the operator does not choose when

Front-end compliance (site, policy, consents, cookies) defuses claims by RKN and subjects

Replying to a subject within 10 working days heads off a complaint

An incident response plan and processor control cut the cost of a leak

THREE EXEMPTIONS SINCE 01.09.2022

Art. 22(2), 152-FZ

Art. 13.11(10) CAO since 2025

entities ₽100-300k, officials of state bodies and NGOs ₽30-50k, one-year limitation

Risk indicator

3+ mismatches between notification and website policy justify an unscheduled action

CBT separately

a separate notification under Art. 12 is filed for CBT, the Art. 22 form states only the fact

Group of companies

each legal entity files separately (RKN, 14.08.2026); old notifications are updated on form 180

PD left the perimeter?

accessible to outsiders: publication, employee's personal e-mail, copying by third parties

Caused by a computer attack?

or other security breach of an information infrastructure object

Roskomnadzor

Art. 21(3.1) of Law 152-FZ, RKN Order 187, PD Portal

FSB via GosSOPKA

FSB Order 77: connected ones - to NCCCI, others - same form via RKN

Bank of Russia

FinCERT: 24 h, 3 h at enhanced/standard level, 30-day report

detection

counted from detection by the operator, RKN or another party, possibly the processor. Calendar hours

initial notification

what happened, suspected causes and harm, measures taken, representative's contact

follow-up notification

investigation results: causes, harm, measures, persons whose fault caused the incident

if 72 hours are missed

RKN demands investigation results, reply in one business day

The act: five mandatory details, no approved form, the highest of several degrees applies. The operator sets the procedure in a local act.

In a leak case the act backs the argument on measures taken (expert view): on 21.01.2026 the Supreme Court upheld a fine under Art. 13.11(1) on a ministry that had not taken all measures, including internal control.

Incident circumstances

scale, data categories, exposure time, range of recipients

Status and conduct

first offence, admission, no complaints, remedy before the report. No SME relief under (11)-(18)

Measures before/during

Art. 18.1 and 19 documents, harm assessment, internal control, working security

Actions after

timely notices, informing subjects, monitoring copies, compensation

1-3%

of annual revenue

at least and at most

₽20-500m

1-3%

of annual revenue

at least and at most

₽25-500m

Computer information

data as electrical signals (note to Art. 272)

Contains PD

PD per Art. 3(1) of Law 152-FZ

Obtained unlawfully

unlawful access, interference or other illegal means

923 applications

in 10 months of 2025 (Interior Ministry). Typical defendants: low-level staff with database access, even sales staff are charged with official position.

basic offence: use, transfer, collection, storage

fine up to ₽300k

children's PD, special categories, biometrics

fine up to ₽700k

gain, major damage, group, official position

fine up to ₽1m

involves CBT or movement of storage media

fine up to ₽2m

grave consequences or an organised group

most serious offence

creating a resource for illegal trade

fine up to ₽700k