Part II, section 06
Data strategies and six permissibility criteria
06.1
Two data strategies and different costs of error
STRATEGY 1
Playing to win
Maximising benefit
Data as an asset: more collection, more analytics, faster launches
STRATEGY 2
Playing not to lose
Minimising damage
Data as a risk: less excess data, fewer grounds for claims and fines
vs
A demonstrator of turning a controls checklist into a local regulation
The material has three parts
Structure: 12 sections
In each of Sections 2-11
Regulation on PD processing
As of 31.03.2026
RACI MODEL
for 10 functions: from DPO and DSO to top management
06.2
Six filters every processing operation passes through
Any data about a person is PD until proven otherwise
Specific, predetermined and lawful purposes
Minimum data, separate storage, no stockpiling
Each processing rests on a legal basis
The subject knows what is done with their data and why
PD confidentiality and protection measures
Art. 3(1), Law 152-FZ: 15 groups of data relating to a person
Any data about a person is PD until expressly proven otherwise
person
Deals and sales of products
Events, interactions and sport
IT, telecoms and Internet
Geolocation and navigation
Diagnostics and telemetry
Medical data
Biometrics, genome and anthropometry
Travel and transport
Insurance, pensions, taxes
Employment, military records, civil service
Education and profession
Identity and family
Basic identifying data
Law 152-FZ Art. 5(2)
Processing is limited to specific, predetermined and lawful purposes
wording is specific, with no generic phrases like "exercising the rights and legitimate interests of the operator or third parties" or "achieving socially significant goals"
purpose is set at collection, and a new purpose for PD already collected is compatible with the original
the purpose is lawful: it neither breaches nor conflicts with established requirements
Processing is shown to be necessary if
the purpose cannot be achieved otherwise
alternatives without PD or with less PD exist but demand disproportionate cost or effort from the operator
Law 152-FZ Art. 5(3)-(7)
The list of PD collected and processed is minimised
PD categories are stored separately, including those incompatible by processing purpose
Identifiers (name, e-mail, phone, address) and interaction data (services, purchases, correspondence) are kept in separate databases
No accumulation of PD "just in case" and no client profiling without vital need
Fewer processing instructions to third parties: liability stays with the operator while control over security measures weakens
Law 152-FZ Art. 6(1)
The main four bases for PD processing
Auxiliary bases, plus items 4, 10, 11
Law 152-FZ Art. 14(1)-(2)
Data subjects may receive information on the processing of their PD in an accessible form. Self-check questions for the operator:
?
Was the subject properly informed of the PD processing before it began or changed materially?
?
Does the subject have a reasonable expectation of PD processing: logical, fair and justified from an ordinary person's viewpoint in the specific situation?
5 text readability formulas for Russian
Flesch-Kincaid, Coleman-Liau, Automated Readability Index, SMOG, Dale-Chall
Service: plainrussian.ru
Law 152-FZ Arts. 7 and 19
Classic IS: 30+ subsystems, including
Depersonalisation
Not a way to end PD processing: it is reversible
Roskomnadzor approves depersonalisation requirements and methods
Secure data processing technologies (SDPT)
Obfuscation: anonymisation and pseudonymisation, synthetic data, differential privacy, zero-knowledge proofs (ZKP)
Processing encrypted data: homomorphic encryption (HE), MPC, trusted execution environments (TEE)
Federated learning (FL)
