PD Almanac catalogue
Catalogue of actions with personal data
Actions (operations) with PD under Law 152-FZ, with an explanation of each action
A glossary of terms describing actions (operations) with PD. It mainly presents concepts sourced from Law 152-FZ of 27.07.2006 "On Personal Data" and the state standards of the Russian Federation.
| Action with PD | Definition |
|---|---|
| Blocking | Temporary cessation of PD processing, except where processing is necessary to clarify the PD |
| Restoration | Returning the content of PD that were modified or destroyed by unauthorised actions to its original state |
| Access | Disclosure of PD to a specific person or a specific group of persons without giving them the ability to process the disclosed PD further |
| Recording | Entering PD into an electronic computer or fixing PD on a physical medium |
| Change | Modification of PD values |
| Extraction | Building structured PD from unstructured or semi-structured machine-readable documents |
| Use | Actions with PD performed in order to make decisions or take other actions that give rise to legal consequences for the data subject or other persons, or otherwise affect the rights and freedoms of the data subject or other persons |
| Copying | Actions aimed at creating one or more copies of existing PD, i.e. moving PD to a separate physical medium or to another database, PDIS and (or) workstation, provided that the original PD remain unchanged |
| Accumulation | Forming an initial, unsystematised set of PD |
| Depersonalisation | Actions that make it impossible, without additional information, to determine whether PD belong to a specific data subject1) |
| Updating | Bringing recorded PD into line with the state of the depicted objects of the subject domain |
| Processing | Any action (operation) or set of actions (operations) performed with PD, with or without the use of automation, including collection, recording, systematisation, accumulation, storage, clarification (updating, change), extraction, receipt, search, copying, matching (comparison), combining (linking), use, transfer (dissemination, provision, access), including cross-border transfer, depersonalisation, restoration, blocking, deletion, destruction |
| Combining (linking) | Actions to enrich (merge, consolidate, integrate) a set of PD with additional PD, and to establish links between sets of PD |
| Transfer | Actions aimed at dissemination, provision and (or) access in respect of PD |
| Search | Actions that make it possible to select specific PD from a data set |
| Receipt | Actions aimed at accepting or generating PD, other than collection of PD |
| Provision | Disclosure of PD to a specific person or a specific group of persons |
| Dissemination | Disclosure of PD to an indefinite (unlimited) group of persons |
| Collection | Actions aimed at accepting PD directly from the data subject or their representative |
| Systematisation | Arranging PD in a particular sequence |
| Matching (comparison) | Actions to search for and determine the correspondence of records relating to the same data subject in one or more sets of PD |
| Cross-border transfer | Transfer of PD to the territory of a foreign state to a foreign state authority, a foreign individual or a foreign legal entity |
| Deletion | Actions to remove PD from a PDIS, workstation and (or) physical medium |
| Destruction | Actions that make it impossible to restore the content of PD in a PDIS, on a workstation and (or) on a physical medium (incl. by destroying the physical medium itself) |
| Clarification | Updating or changing PD |
| Storage | Transmission of PD through time, involving keeping the states of the PD's physical medium unchanged |
1)
In other words, this concerns reversible de-identification/depersonification/depersonalisation of PD (pseudonymisation). Outside the Russian legal framework are irreversible de-identification/depersonification/depersonalisation (anonymisation, sanitisation) - actions that make it impossible to determine whether data belong to a specific data subject, and re-identification/repersonification/repersonalisation (reversing depersonalisation) - actions as a result of which depersonalised data take a form that makes it possible to determine that they belong to a specific data subject, i.e. become PD