Storage, depersonalisation and destruction of PD

Does not end processing

Depersonalisation

a way to minimise processing and ensure PD confidentiality. It is itself processing (Art. 3(3) of Law 152-FZ), and its result remains PD

Destruction or deletion

destruction is irreversible; deletion removes data from a system or medium, with recovery possible

Blocking

temporary suspension of processing, except processing needed to rectify PD

Archiving

moving documents to archival storage under Law 125-FZ with its own terms and destruction procedure

Consequence: depersonalisation in response to a subject's destruction demand or consent withdrawal does not meet the demand, and RKN does not allow listing it as a destruction method in the act

Art. 3(8) of Law 152-FZ

Destruction

actions that make it impossible to restore the content of PD in a PDIS and/or destroy the PD's physical media

ARB letter of 02.12.2011 No. 5

Deletion

removal of PD from a computer with recovery still possible. There is no legal definition; the Digital Ministry reads deletion as excluding data from a medium or an information system

Art. 3(7), 21(2) of 152-FZ

Blocking

temporary suspension of PD processing, except where processing is needed to rectify PD

• PD operation
• Reversibility
• Duration
• Access
• Computer / paper

• Destruction
• irreversible*
• permanent
• not possible
• yes / yes

• Deletion
• reversible
• permanent or temporary
• not possible
• yes / no

• Blocking
• reversible
• temporary
• possible
• yes / yes

Job

Operational storage

data is used and changed, access without extra restrictions

Archive

Archival storage

data is unused and blocked, access via a special procedure

Destruction

End of storage

confirmation for PD names specific subjects, for archived data it does not

PD regime

152-FZ

Art. 5(7), Art. 21(7) of Law 152-FZ, RKN order of 28.10.2022 No. 179

destruction when processing purposes are met

an act and a log export with data on subjects

Archive regime

Law 125-FZ

Art. 4(1)(2), Art. 14(5) of Law 125-FZ, Rosarkhiv orders of 20.12.2019 No. 236 and 31.07.2023 No. 77

long document retention periods

destruction without subject data

no explicit duty to report incidents

Important: Law 152-FZ stops applying to documents only after the formal transfer to the archive, and when the archive term expires they are destroyed under archival rules

Art. 3(9) of Law 152-FZ

Depersonalisation

actions that make it impossible without additional information to determine whether PD belong to a specific subject

reversible by design: with additional information the data is restored to its original form

a hash function does not depersonalise, it is a cryptographic protection tool (RKN letter of 01.06.2023 No. 08-45913)

Not a way to end processing

per the Digital Ministry and RKN it is a method of processing and ensuring confidentiality that lowers the identifying potential of PD

Condition 1. Basis

consent to depersonalisation or another ground from Art. 6(1) of Law 152-FZ

Condition 2. Method

a method or combination of methods from the closed list in RKN order of 19.06.2025 No. 140

Order 140 methods from 01.09.2025

• introducing identifiers
• changing composition or semantics

• decomposition
• shuffling
• generalising, new method

Identifying data

Direct identifiers in place

direct identifiers untouched or partly masked, indirect untouched

Pseudonymous data

Direct identifiers hidden

direct identifiers removed or changed, indirect untouched

Anonymous data

No identifiers

all identifiers removed to break the link between data and person

1

Pseudonymisation

random identifiers, hashing, encryption

2

Anonymisation by generalisation

aggregating (generalising) values

3

Anonymisation by randomisation

adding noise, swapping data or removing attributes

4

Generalise + randomise

combining several techniques

In Russian law: hashing and encryption are not in the closed list of order No. 140, the law has no concept of anonymisation, and RKN treats any transformation as depersonalisation

vs

General regime

RKN order of 19.06.2025 No. 140

replaced order No. 996 of 05.09.2013, in force from 01.09.2025

binding on all operators who depersonalise PD on their own grounds, not only state bodies

closed list: four methods, plus generalisation (aggregation) is allowed

internal regulations, method sufficiency assessment, data sets and key stored apart, operations logged

the result remains PD and is reversible by design

Data sets regime

Art. 13.1, 152-FZ; Res. 1154 of 01.08.2025

Art. 13.1 added by 233-FZ of 08.08.2024, in force from 01.09.2025

only on a targeted Digital Ministry demand in cases on the Government's list (Res. 538 of 24.04.2025)

five methods of Res. 1154: introducing identifiers, changing composition or semantics, decomposition, shuffling, transformation

the operator excludes restricted-access data; sets are not built from special categories (except health data) or biometrics

the result goes to the GIS "Unified Information Platform of the National Data Management System"

Important: all operators must follow the depersonalisation requirements, but need not depersonalise. An operator must depersonalise PD on a Digital Ministry demand and when processing for statistical or research purposes without consent (Art. 6(1)(9))

• Step
• Data
• Direct identifiers
• Indirect identifiers
• Technique

• Unhindered identification
• identifying
• Name: Muntyan Alexey Vitalyevich, SNILS: 123-456-789 01
• age: 39, IP address: 192.168.0.1
• no techniques used

• Depersonification
• identifying
• Name: Muntyan A. V., SNILS: 123-456-789 01
• age: 39, IP address: 192.168.0.1
• name reduction

• Enhanced depersonification
• identifying
• Name: Muntyan A. V., SNILS: *****67890
• age: 39, IP address: 192.168.0.1
• SNILS masking

• Pseudonymisation
• pseudonymous
• Name: 5L7T-LX619Z, SNILS: *****67890
• age: 39, IP address: 192.168.0.1
• artificial identifier (pseudonym) instead of the name

• Enhanced pseudonymisation
• pseudonymous
• Name: 5L7T-LX619Z, SNILS: d5efe83e
• age: 39, IP address: 192.168.0.1
• SNILS protected by hashing

• De-identification
• pseudonymous
• removed
• age: 30-40, IP address: 252.112.1.90
• removing direct identifiers, generalising age, replacing the IP address

• Anonymisation
• anonymous
• removed
• removed
• removing indirect identifiers and adding noise

PD is stored no longer than the processing purposes require and destroyed once the purposes are achieved or no longer needed (Art. 5(7))

• Purpose achieved
• processing purposes achieved and/or maximum retention periods expired

• Purpose not needed
• the need to achieve the processing purposes is lost

• Subject's information
• the subject confirmed PD were obtained unlawfully or are not needed for the purpose

• Unlawfulness
• lawful processing of PD cannot be ensured

• Consent withdrawal
• the subject withdrew consent and PD are no longer needed for the purposes

• Limitation period
• limitation periods expired on the legal relations behind the processing

• Liquidation
• liquidation or some forms of reorganisation of the operator

152-FZ deadlines

• 7 working days
• Subject data, Art. 20(3)

PD unlawfully obtained or not needed

• 10 working days
• Unlawful processing, Art. 21(3)

lawfulness cannot be ensured

• 10+5 working days
• Subject's demand, Art. 21(5.1)

to stop PD processing

• 30 days
• Purpose achieved, Art. 21(4)

or the need to achieve it is lost

• 30 days
• Consent revoked, Art. 21(5)

if PD is no longer needed

• 6 months
• Blocking, Art. 21(6)

if PD cannot be destroyed in time

Limitation, records

3 months

labour disputes, incl. moral harm for breaching employee PD rules, Art. 392(1) Labour Code

1 year

disputes on unpaid wages and employee liability for damage, Art. 392 Labour Code

3 years

general limitation (Civil Code Art. 196) from when the breach became known (Art. 200); for a contract, from its end

5 years

primary accounting records after the reporting year (Art. 29, 402-FZ), tax records (Tax Code Arts 23-24); insurance contributions 6 years

Other terms

e.g. over 5 years, if the term passes the "why this exactly?" test

Destruction schedule

• actual period
• desired period
• legal period

• set period
• triggers, periods

Data map

records for each PD category all storage places, period, trigger and destruction method

Period in settings

the period in internal regulations must be set in the system, or records stay until the disk is full

Databases

• primary and backup
• development
• testing

logging

Backups

restoring from a backup revives destroyed records, so it is checked against the destruction log

Logbooks

overwriting PD logs is confirmed under Order No. 179, per RKN position of 27.08.2025

Risk: expired records left in backups, test environments and logs enlarge the number of affected data subjects and the severity of liability in a leak

Art. 3(14)(5), (15)

Consent withdrawal

data subject withdrew consent to process biometric PD

Art. 3(14)(6), (15)

Subject's demand

to destroy biometric PD and/or UBS vectors

Art. 4(14), 26(3)

Placement in UBS

biometric PD are destroyed in organisations' information systems

Art. 14(7), 15(1)(3), 15(2)

10 days off UBS

retention period of biometric PD for handling subject enquiries expired

Art. 16(15)

UBS operator request

reasoned request to destroy UBS vectors

Art. 8(2)(6), 5(8)(7)

Authorised body request

reasoned RKN request to the UBS operator or regional segment

Outside UBS: after the retention period the authenticating organisation destroys biometric PD with security tools that passed conformity assessment, with automatic destruction on expiry of the set period (Art. 15(2))

PD destruction act

operator's name and address

processor's name and address if processing is instructed

names or other identifiers of subjects whose PD is destroyed

names, positions, signatures of those who destroyed, wet-ink or electronic

list of categories of PD destroyed

medium name and number of sheets for non-automated processing

PDIS name for automated processing

destruction method

destruction reason

destruction date

Export from the PDIS event log

Five items

exported when destroying PD in a PDIS

names or other subject identifiers

list of categories of PD destroyed

PDIS name

destruction reason

destruction date

Procedure: an act is drawn up for destruction on physical media and in a PDIS alike, an export is not enough (RKN letter of 15.03.2023 No. 08-21165). Items missing from the export go into the act, both are kept 3 years

• ?
• Does a log export replace the act?

no, an export confirms destruction of PD processed with automation tools and does not remove the need to draw up an act

• ?
• Where to put what the export lacks?

details that cannot technically be shown in the event log export are recorded in the destruction act

• ?
• Are names required in the act?

the Order allows names or other information on the person. Responding to comments on the draft, RKN required names where held, and at its 27.07.2023 webinar allowed any identifier

• ?
• When is another identifier better?

when there are no names or they are hard to trust, since names repeat and are often collected unverified, while a client or contract number is unambiguous

• ?
• Does the order apply to archive documents?

no, it does not cover storing, acquiring, accounting for and using documents of the Russian Archive Fund and other archives

Template 1

Act on destruction (end of processing) of PD

a commission of a chair and two members selects PD whose purposes are achieved or no longer needed

9-column table: medium, its type and register number, subject's name, PD categories, PDIS, destruction method and reason

media are checked against the act, destroyed or returned for reuse and written off the record logs

Template 2

Act on destruction of physical media with PD

the list of media, e.g. written consents, goes into an electronic file

the file is identified by name, size in bytes and MD5 and SHA-1 hash sums

the file is burned to a CD kept with the act

Also: the act may be drawn up electronically and signed with any type of electronic signature (RKN letter of 27.12.2022 No. 08-115265), and a hash serves integrity control and is not depersonalisation

When determining retention periods for personal data destruction acts and exports from the event log of a personal data information system, para. 8 of the Requirements should be followed, which does not contradict Art. 21.1(1) of the Archives Law

Rosarkhiv letter of 16.10.2024 No. R/P-448

Question

1

para. 8 of Order 179 requires keeping the act and export 3 years from destruction, but the standard archive list (Rosarkhiv Order 236) omits them

• 2
• is 3 years an archive term, and how long to keep documents after it

The reason

• 1
• Order 179 does not apply to archive documents (Art. 1(2)(2) of Law 152-FZ)

• 2
• acts and exports are not in RKN's draft departmental list

Internal regulation

Operator's choice

the operator picks destruction methods, sets the procedure in an internal act and states each operation's method in the destruction act

the only test: content cannot be recovered with means available to an intruder

Paper media

blacking out or deleting data

cutting the medium

burning the medium

shredding the medium

handover for recycling

Machine media

mechanical destruction of media

erasure by built-in software

erasure by specialised software or devices

disabling the functionality of the medium

handover for recycling

In a PDIS: machine media need security tools with a destruction function and conformity assessment (Art. 19(2)(3.1))

01

Procedure and basis

internal acts on handling Archive Fund documents, basis - an act selecting documents for destruction

02

Paper media

shredding or another method preventing recovery of content, with marks in the record forms

03

Electronic documents

certified destruction devices, breaking the medium's integrity or removing residual data

Required

Government

federal executive bodies, nuclear and space bodies and subordinate organisations (para. 1.1). The head sets the procedure (para. 1.5), violators are liable (para. 1.8)

Recommendation

Others

regional and local bodies, state institutions, unitary enterprises, state-owned and other companies (para. 3), no liability for breach

For PD: such documents usually contain PD, so the public sector adds the Res. 1233 procedure to Order 179 and Art. 19(2)(3.1), and for business it is a benchmark and a possible customer requirement

233-FZ of 08.08.2024

Art. 19(2)(3.1), 152-FZ

PD security is ensured by using, for PD destruction, security tools that have passed conformity assessment in the established manner and include an information destruction function

• 1
• Automation only

the requirement does not apply to PD processing without automation tools

• 2
• Security measure

it is an Art. 19 measure, not a measure for meeting operator duties (Art. 18.1) or the proper destruction duty (Art. 21)

• 3
• Outside remit

Digital Ministry and RKN did not treat it as their remit

• 4
• Liability

breach falls under Art. 13.12 of the CAO, not 13.11

Supervision: item 33 of the checklist (RKN Order of 24.12.2021 No. 253) covers only organisational measures under Art. 19(1), RKN does not check technical measures under Art. 19(2). The form is changed by an RKN draft of 03.08.2026

We believe that the question raised in your enquiry falls within the competence of the federal executive bodies indicated

RKN, letter of 12.09.2024 No. 08-377683, on the FSB and FSTEC of Russia

Roskomnadzor

FSB and FSTEC exercise control and supervision of the Art. 19 measures within their powers

Digital Ministry

letter No. P25-21859-OG of 10.09.2024 redirected the enquiry (Art. 8(3), 59-FZ)

The law says

FSB and FSTEC oversee Art. 19 measures in state PDIS (Art. 19(8)), in other systems only by Government decision (Art. 19(9))

• 1
• Tool choice

the operator picks tools under FSB and FSTEC acts issued under Art. 19(4), 152-FZ (para. 4, Res. 1119)

• 2
• When assessment is needed

for all protection levels, assessed security tools are used when needed to neutralise current threats (Res. 1119 para. 13(g), FSTEC Order of 18.02.2013 No. 21 para. 4)

• 3
• Assessment form

state control (supervision), testing, registration, conformity confirmation, acceptance and commissioning of the object, or another form (Art. 7(3), 184-FZ)

• 4
• Regulators differ

FSTEC accepts tools assessed in the 184-FZ forms, FSB only tools certified to FSTEC and FSB requirements

Section 4 of the annex to Order 21

ZNI.8 - the only destruction measure

destruction (erasure) or depersonalisation of PD on machine media when passed between users or to outside organisations for repair or disposal, and control of the destruction (erasure) or depersonalisation

machine media are PD processing (storage) devices and removable PD media (para. 8.4 of Order 21)

vs

FSTEC of Russia

Any conformity assessment form

letter 04.10.2024 No. 240/24/4419

ZNI.8 is met only by tools with a destruction (erasure) function assessed in any 184-FZ form

such tools are mandatory when needed to neutralise current threats under Res. 1119 and Order 21

FSB, 8th Centre

Certified tools only

letter 05.10.2024 No. 149/7/2/6-2076

PD can be destroyed only by tools with a destruction function certified to FSTEC and FSB rules

using other means to destroy PD is not permitted

if available tools do not fit, development can be ordered from licensees

Choice: an operator outside the public sector without crypto tools can follow FSTEC; with crypto tools or in the public sector, a certified tool covering both positions is safer

Software, Kod Bezopasnosti LLC

Secret Net Studio

the data destruction function irreversibly wipes all information, including the partition table, logical volumes, file objects and residual data, on the protected computer's local disks except the system disk and on attached removable media

TERRIER version 3.0

Software, TsBI-servis JSC. Program to find and securely destroy data on disks and monitor security tool effectiveness, FSTEC-certified

Priboy Module-3.5

Appliance, Computer Service Devices LLC

Stek-NS3

Appliance, Anna LLC

Astra Linux Special Edition

an example of an OS with guaranteed destruction: it clears freed external storage so deleted files cannot be restored

Astra Linux Special Edition clears freed external storage to prevent leaks of confidential data when deleted files are restored

• File state
• Metadata blocks
• Data blocks
• Result

• File with data
• inodes point to the data blocks
• confidential data
• data accessible

• Plain deletion
• metadata marked as unused
• confidential data stay in place
• can be restored

• Guaranteed destruction
• metadata marked as unused
• data blocks are overwritten with other data
• cannot be restored

Takeaway: until data blocks are overwritten, deleting a file by OS means is deletion, not destruction under Art. 3(8), 152-FZ