Employee PD

• Provision
• When written employee consent is needed

• Art. 8, 152-FZ
• including PD in public sources, for example a corporate directory

• Art. 10, 152-FZ
• processing special categories of PD, except health data relating to ability to perform the job function

• Art. 10.1, Law 152-FZ
• processing PD allowed by the employee for dissemination, on a separate form

• Art. 11, 152-FZ
• processing biometric PD, for example biometric access alongside an alternative method

• Art. 16, 152-FZ
• decisions based solely on automated processing of PD

• Art. 86(3) Lab. Code
• obtaining PD from someone other than the employee, with prior notice

• Art. 88 para. 2 Lab. Code
• disclosing employee PD to a third party, except where federal law provides

• Art. 88 para. 3 Lab. Code
• disclosing employee PD for commercial purposes

Also in practice: voluntary benefits like health insurance, talent pool and external HR platforms. Guidance: RKN clarifications of 14.12.2012, Ministry of Digital Development letter of 28.08.2020 No. LB-S-074-24059 and the micro-enterprise model contract (Resolution of 27.08.2016 No. 858)

1

Purposes

search and assessment of applicants, reliability checks, hiring decision

2

PD scope

about 30 items, from name and contacts to work history and military records

3

Methods

mixed processing, transfer via internal network and internet

4

Sources

the applicant, open sources, counterparties and existing data

5

Recipients

processors, group companies and counterparties, incl. CBT

What to account for in 2026

since 01.09.2025 consent is separate from the form and other documents (Art. 9(1), Law 152-FZ)

RKN orally (14.08.2026) requires consent for selection, but not for immediate hiring or on recruitment platforms

scraping social media for hiring is risky, and refusing a candidate who gave no consent touches Art. 64 Labour Code

Period for a rejected candidate

Three benchmarks

30 days per Digital Ministry letter

up to 6 months per RKN's oral position (31.01.2024)

3 months, while a refusal to hire can be challenged (Arts. 391, 392(1) Labour Code)

a talent pool is kept under a separate consent

For

Why the model is popular

simple concept expressly set out in the Labour Code

matches the expectations of supervisory bodies

PD from anyone but the employee needs consent (Art. 86(3) Labour Code)

RKN allows consent in electronic form

Against

high time and cost of collecting consents, then the burden of administering and storing them

not every employee will sign updated consent, and a signed one can be withdrawn any time

an employee may hand-edit the text of a model consent

the illusion that withdrawal can stop it, though HR processing rests on the Labour Code and contract

per RKN, consent ends with dismissal, and transferring a former employee's archive needs a new one

written consent follows Art. 9(4) (one purpose, one consent) and since 01.09.2025 is drawn up apart from other documents

demanding consent may be held discrimination by a court (88-17959/2020, remitted for retrial)

Method of expression and sanction risk

Double opt-in

• tick plus confirmation by an e-mailed link
• low

Single opt-in

• the subject ticks an empty box
• low

Silent opt-in

• pre-ticked box or button with a proviso
• medium

Silent opt-out

• disagreement is preset, the subject does not clear it
• medium

Soft opt-out

• a tick for refusal, or a double negative
• high

Hard opt-out

• new terms accepted absent a timely written refusal
• high

Form of receipt and provability risk, expert approach

• Form
• Risk
• When it fits and what reduces risk

• Written
• low
• required only where the law says so, main risk is missing elements under Art. 9(4)

• Electronic, QES
• low
• equals paper by law, no agreements needed (Art. 9(4) of Law 152-FZ, Art. 6 of Law 63-FZ)

• Electronic, SES or UES
• medium
• equals paper by law or by e-interaction agreement, otherwise an SMS code gives only ordinary consent

• By conduct
• medium
• tick, registration, payment. Proved by the event log, does not replace written form

• Oral
• high
• hard to prove: needs identification, the terms read out and a call recording

Recording method

from 01.09.2025 consent is separate from other information and documents (Art. 9(1)). Under the expert approach and by phone, ask the consent question separately

Parties

client identifier at each participant, no single group record

PD operators

PD processors

recipient of consent, incl. partners

Fact of consent

date and time received

how expressed: opt-in, opt-out, etc.

channel: website, app, paper, call centre

Scope

purposes by each participant's products

actions with PD

PD scope

processing term

advertising permission by channel: phone, SMS, e-mail, push

Changes and withdrawal

date, time and content of full or partial withdrawal

current list of operators and partners

date and content of objection to a list change

PD update by the subject

notice of PD deletion

2026 practice: RKN orally (14.08.2026) does not allow one consent for several equal operators, so each group company has its own, and when statuses in systems conflict, refusal prevails

• ?
• Why does the company need consent?

to run the business, hold market positions and meet obligations to you, clients and partners

• ?
• How is my data protected at partners?

transfer to clients and partners requires your written consent, and recipients are bound to the company by a confidentiality agreement

• ?
• What happens without consent?

the company cannot pass data to providers and contractors, so cannot give you benefits

• ?
• What do I learn from consent?

purpose, scope and content of your PD processing, and consent validity

Where consent is really needed

Narrow zones

transfer of employee PD to third parties unless law allows (Art. 88 Labour Code)

contractors and cloud services: instruction under Art. 6(3), Law 152-FZ and each employee's written consent (RKN Office for Kursk Region, 18.06.2026)

voluntary benefits and talent pool

Honest boundary: routine HR work rests on the law and is not stopped by withdrawal of consent, and that is how it is explained to the employee

152-FZ Art. 6(1)

Item 2. Operator's duties

performing the functions, powers and duties imposed on the operator by law

Item 5. Contract

performing a contract to which the subject is a party

Item 7. Legitimate interest

exercising the rights and legitimate interests of the operator or third parties if the subject's rights are not violated

• Article
• What it gives the employer

• Art. 8
• adopt internal regulations within competence

• Art. 15
• employment is an agreement to perform a function personally under the employer's direction and control

• Art. 21
• the employee must perform the employment contract and observe work rules

• Art. 22
• demand performance of duties and observance of work rules

• Art. 57
• include contract terms not worsening the employee's position, incl. non-disclosure of secrets

Now: HR processing purposes are limited to the list in Art. 86(1) of the Labour Code, and RKN orally (28.01.2022) treats it under Art. 6(1)(2), not the contract. So the core basis recorded is duties under labour law

vs

Digital Ministry, 28.08.2020

Letter No. LB-S-074-24059

guidelines for general education organisations

no consent needed to transfer employee PD in connection with duties, incl. business trips under hotel service rules (letter cites Government Resolution No. 490, now No. 1912 of 27.11.2025)

PD law provisions are put into employment contracts, job descriptions and other internal acts

per the letter this is a measure to inform employees who process PD themselves (Art. 18.1(1)(6)), not a basis for processing their data

RKN, 14.12.2012

Clarifications on employees, applicants, talent pool

processing without consent in cases from a collective agreement, work rules, agreements and internal acts under Art. 372 Labour Code

no consent to transfer PD of an employee or official in connection with duties, incl. a business trip

access control without consent if the employer runs it or sets it by collective agreement and internal acts

In 2026: RKN orally (14.08.2026) does not require consent for a payroll scheme on the employee's request, but Rostrud (07.10.2026) deems a card issued without a request unlawful, and contractors need an instruction and written consent

SC RF, 01.07.2019, 67-KG19-5

Employment relations outlast the contract

The Labour Code also covers relations derived from employment (Art. 5): they arise before the contract, accompany it and persist after dismissal. Concluding that all rights and duties end with termination is unlawful

Udmurtia Supreme Court, 25.01.2012, 33-198/2012

employer processed its employee's PD, relations rest on an employment contract, consent not required under Art. 6(1)(5), Law 152-FZ

Ninth Appeal Court, 09.02.2022, 09AP-87227/2021

Art. 6(1)(5) is a general rule with no employment exception: transfer of employee PD for voluntary health insurance, spa treatment and accommodation performs the collective agreement

Moscow District Commercial Court, 30.05.2022

position in the Aeroflot case confirmed, RKN's cassation appeal dismissed

vs

No violation

St Petersburg City Court, 24.01.2012, 33-712/2012

the employee's surname appears in design documentation in performing duties under the job description and Art. 86 Labour Code

Violation

3rd Cassation Court, 01.02.2021, 88-714/2021

health insurance and meal compensation refused without consent to PD transfer to various organisations, and the employer did not show the transfer was needed

compensation of ₽25,000 upheld

same court on 16.12.2020 (88-17959/2020) noted signs of discrimination and remitted the case for retrial

Contrary line

St Petersburg City Court, 07.09.2023, 33-16277/2023

the employer and its contract with the insurer set the consent form for a voluntary benefit, and refusing the benefit without it is lawful

Safe line

a separate consent document for each purpose

data limited to the benefit's purpose

declining the benefit has no effect on labour rights

PD processing in employment is carried out in performing the employment contract and the law and cannot be made conditional on consent, as otherwise the contract could be neither concluded nor performed

Presnensky District Court of Moscow, decision of 30.01.2024, No. 2-907/2024

Presnensky Court, 2024

employer may transfer PD and instruct third parties to process it in its own legitimate interest if employees' rights are not infringed

Kemerovo, 30.09.2022

1

checking an open source for an employee's other position under an internal conflict-of-interest act (Arts. 11, 13.3, Law 273-FZ) rests on Art. 6(1)(7), Law 152-FZ

• 2
• refusal to open a case under Art. 13.11(2) of the CAO upheld (12-532/2022)

• 1
• Purposes

closed list in Art. 86(1) Labour Code, no other purpose justifies monitoring

• 2
• Time and place

outside working time and place a separate justification is needed, usually absent

• 3
• Privacy zone

places where an employee may expect privacy even during working hours

• 4
• Proportionality

continuous recording fails where a periodic check is enough

• Tool
• Position
• Basis

• Video surveillance
• Rostrud requires signed-for internal regulations and written consent, RKN orally sees Art. 6(1)(2) as the basis
• disputed

• Hidden camera
• covertness is judged by awareness: regulations, supplementary agreement, sign
• 2-2969/2019

• Work devices
• equipment and accounts are monitored, a personal device only with consent
• Art. 86(8) Lab. Code

• Breathalyser
• only with employee consent, refusing a test is not absenteeism
• Rostrud, 2021 and 2023

Procedure: monitoring is introduced by an internal act signed for by staff and a contract term, with current employees notified two months ahead of changed working conditions (Art. 74(2) Labour Code)

For

employment is already governed by the contract and internal work rules

Labour Code and federal laws allow employee PD transfer not only by consent

Digital Ministry (28.08.2020) and RKN (14.12.2012) do not require consent to transfer PD in connection with duties

courts accepted Art. 6(1)(5) as a basis for employee PD transfer (case A40-163911/2021)

Against

RKN refers Art. 6(1)(5) to civil-law contracts, and HR processing to Art. 6(1)(2) and Ch. 14 Labour Code (28.01.2022)

written consents are not put in the employment contract (31.01.2024), and CBT and transfer to third parties need written consent under Art. 88 Labour Code (15.05.2024)

PD processing terms may be deemed to worsen the employee's position (Arts. 9, 57, 86(9) Labour Code)

Cost of error

Possible consequences

organisations: fine up to ₽700k, repeat up to ₽1.5m (Art. 13.11(2), (2.1) of the CAO)

officials: up to ₽300k, repeat up to ₽500k

claims by subjects, usually up to ₽30k each

process rework under an order, usually in 6 months

negative press and damage to the reputation of the organisation and its managers

• 1
• Basis

processing to conclude, perform, change and end the contract and to meet laws and internal acts rests on the contract and law (Art. 6(1)(2), (5)), no consent needed

• 2
• Where the rules are

purposes, scope, actions, terms and protection of PD are set by law, contract and internal acts, and if necessary by employee consent

• 3
• Company's duties

process only necessary PD, protect it and enable the employee to work with others' PD

• 4
• Employee's rights

access to own PD, rectification, blocking and destruction if incomplete, inaccurate or unneeded

• 5
• Employee's duties

process other people's PD only for the purposes and in the manner set by Company rules, and safeguard it

Why

Three benefits for staff

processing of your PD is time-limited

the Company must create conditions for PD processing and protection

your PD rights are fixed in the contract

Term in the template

5 years after dismissal

model contract term: the Company may process PD for this long after the relationship ends, unless another term is set by agreement or law

• Processing zone
• Basis
• Risk
• How to reduce risk

• concluding, performing, amending and ending the contract, rights and duties under law and internal acts, processing until related obligations end
• Contract, acts
• low
• set out purposes, scope, sources, actions and retention in internal acts

• ongoing work and duties: powers of attorney, e-signature, work communications
• Acts
• low
• fix in internal acts, employee signs to acknowledge

• corporate perks: health insurance, incentive and training programmes
• Acts and request
• medium
• opt-in by employee application, opt-out ends processing

• CBT, transfer to third parties and for commercial purposes, obtaining PD not from the employee, public sources, archive transfer after dismissal, automated decisions
• Acts and consent
• high
• separate written consent (Art. 9(4)), standalone since 01.09.2025, and an internal-act clause on employee awareness

• special categories except health data for the job function, PD for dissemination, biometrics, criminal record
• law
• high
• only in cases and in the manner expressly provided by law

Effect: withdrawing consent to a sensitive operation stops only that operation, while mandatory processing keeps its basis in the law and internal acts