PD Almanac catalogue
Catalogue of terms on personal data
Terms of PD and information privacy from Russian legal acts and national standards
A glossary of highly specialised terms (concepts) in the field of PD and information privacy. It mainly presents concepts established in the regulatory legal acts and state standards of the Russian Federation.
| Term (short form, abbr.) | Definition |
|---|---|
| Automated processing | Processing of PD using automation tools - processing of PD according to a set algorithm by means of computing equipment, including PDIS, information and telecommunication networks, workstations and (or) machine-readable media |
| Automated workstation (AWS) | A hardware and software system based on a stationary or mobile (portable) personal computer, designed to automate the activities of a particular category of users or a particular kind of activity. |
| Database (DB) | A set of independent materials (articles, calculations, regulatory acts, court decisions and other similar materials) presented in objective form and systematised so that they can be found and processed by means of an electronic computer |
| PD security | Protection of PD from unlawful or accidental access to them, destruction, change, blocking, copying, provision, dissemination, and from other unlawful actions in respect of PD |
| Biometric PD | Information that characterises the physiological and biological features of a person, on the basis of which the person can be identified and which is used by the operator to identify the data subject |
| Owner of documented information | A function (person or structural unit) that, independently or jointly with other functions, organises and carries out the preparation, updating, adaptation to a specific task/situation, storage and destruction of documented information |
| GIS "UBS" | State information system "Unified System for Identification and Authentication of Individuals Using Biometric Personal Data" |
| Civil Code | Civil Code of the RF |
| Trusted states | Foreign states listed in the current version of the List of Foreign States Ensuring Adequate Protection of the Rights of Personal Data Subjects (approved by RKN Order No. 128 of 05.08.2022) |
| Documented information | Information recorded on a physical medium by documentation or presented in electronic form, in a form suitable for human perception |
| Friendly states | Foreign states and territories not listed in the current version of the List of Foreign States and Territories Committing Unfriendly Actions Against the Russian Federation, Russian Legal Entities and Individuals (approved by Government Directive No. 430-r of 05.03.2022) |
| GosSOPKA | State system for detecting, preventing and eliminating the consequences of computer attacks |
| Foreign recipient | A foreign state authority, foreign individual or foreign legal entity to which CBT is planned |
| Information security of PD (IS) | The state of protection of PD from unlawful or accidental access to them, destruction, change, blocking, copying, provision, dissemination, and from other unlawful actions in respect of PD |
| PD information system (PDIS) | The set of PD contained in databases (DB) together with the information technologies (IT) and technical means (TM) that ensure their processing |
| Incident | Any unlawful or accidental transfer (provision, dissemination, access) of PD, incl. one that has violated the rights of data subjects and (or) occurred as a result of a computer attack |
| Information technologies (IT) | Processes and methods of searching for, collecting, storing, processing, providing and disseminating information, and ways of carrying out such processes and methods |
| CAO | Code of Administrative Offences of the RF |
| Physical medium | A material object, i.e. a paper or machine medium of information (incl. PD), used to record and store verbal, audio or visual information, incl. in converted form |
| Non-automated processing (processing of PD without the use of automation tools) | Carrying out, according to a set algorithm and with the direct participation of a person, search, access, use, clarification, dissemination and (or) destruction of PD contained on physical media and (or) in systematised collections of PD (incl. card indexes, PDIS databases, electronic files on workstations) in respect of each data subject (PD processing cannot be recognised as carried out using automation tools solely because the PD are contained in a PDIS or were extracted from it) |
| Untrusted states | Foreign states not listed in the current version of the List of Foreign States Ensuring Adequate Protection of the Rights of Personal Data Subjects (approved by RKN Order No. 128 of 05.08.2022) |
| Unfriendly states | Foreign states and territories listed in the current version of the List of Foreign States and Territories Committing Unfriendly Actions Against the Russian Federation, Russian Legal Entities and Individuals (approved by Government Directive No. 430-r of 05.03.2022) |
| NCCCI | National Coordination Centre for Computer Incidents |
| Processing | Any action (operation) or set of actions (operations) performed with PD with and (or) without the use of automation tools 1) |
| Processor | A person that processes PD on the operator's instruction |
| Publicly available sources | Information resources created for information support purposes (including directories and address books) into which PD are included with the written consent of the data subject |
| Operator | A state body, municipal body, legal entity or individual that, alone or jointly with others, organises and (or) carries out the processing of PD, and determines the purposes of PD processing, the composition of the PD to be processed and the actions (operations) performed with PD |
| PDIS operator | A citizen or legal entity engaged in operating a PDIS, incl. processing the PD contained in its DB. Unless otherwise established by law, the PDIS operator is the owner (or holder on another basis) of the TM used to process the PD contained in the DB who lawfully uses that DB, or a person with whom this owner has concluded a PDIS operation contract |
| CBT assessment | An assessment carried out by the operator of whether the foreign recipients to which CBT is planned maintain the confidentiality of PD and ensure PD security during processing |
| Personal data (PD) | Any information relating to a directly or indirectly identified or identifiable individual (data subject) |
| Staff | The Operator's employees; non-staff personnel involved in the Operator's activities and (or) performing a job function for the Operator; members of the Operator's management and supervisory bodies who are not its employees; interns and placement students of the Operator |
| Premises | Part of the volume of a building or structure that has a defined purpose and is bounded by building structures, in which PD are processed |
| Disseminated PD | PD permitted by the data subject for dissemination - PD to which the data subject has granted an unlimited circle of persons access by giving consent to the processing of PD permitted by the data subject for dissemination, in the manner provided by Law 152-FZ |
| Roskomnadzor (RKN) | Federal Service for Supervision of Communications, Information Technology and Mass Media of the Russian Federation (the authorised body for the protection of data subjects' rights) |
| RF | Russian Federation |
| Information protection tools | Technical, software and hardware-software tools, substances and/or materials designed or used to protect information |
| PD protection system (PDPS) | A set of organisational and (or) technical measures defined with regard to the relevant threats to PD security and the information technologies used in the PDIS |
| Cryptographic information protection tools (CIPT) | Hardware, software and hardware-software encryption (cryptographic) tools that implement algorithms for the cryptographic transformation of information to restrict access to it, including during its storage, processing and transmission. |
| Consent to PD processing (CPD) | An act of will by the data subject, provided for by law, permitting the operator to process the subject's PD on certain conditions |
| Special categories of PD | Information concerning racial and national origin, political views, religious or philosophical beliefs, health status, intimate life, and criminal records |
| Labour Code | Labour Code of the RF |
| Cross-border transfer of PD (CBT) | Transfer of PD to the territory of a foreign state to a foreign state authority, a foreign individual or a foreign legal entity |
| Third parties | Individuals, including individual entrepreneurs, and/or legal entities acting in their own interests or representing the interests of third parties, in their relations with the Operator within or in connection with prospective, concluding or concluded civil-law contracts |
| Technical means (TM) | Products, equipment, apparatus or their components whose functioning is based on the laws of electrical engineering, radio engineering and (or) electronics, containing electronic components and (or) circuits that perform one or more of the following functions: amplification, generation, conversion, switching and storage |
| Threats to PD security | A set of conditions and factors creating a danger of unauthorised, including accidental, access to PD, which may result in destruction, change, blocking, copying, provision or dissemination of PD, as well as other unlawful actions during their processing in a PDIS |
| Criminal Code | Criminal Code of the RF |
| PD protection level | A composite indicator characterising the requirements whose fulfilment ensures the neutralisation of certain threats to PD security during their processing in a PDIS |
| FGIS "ESIA" | Federal state information system "Unified System of Identification and Authentication in the Infrastructure Ensuring Information-Technological Interaction of Information Systems Used to Provide State and Municipal Services in Electronic Form" |
| FGIS "NSUD" | Federal state information system "Unified Information Platform of the National Data Management System" |
| FSB | Federal Security Service of the Russian Federation (the federal executive body authorised in the field of security) |
| FSTEC | Federal Service for Technical and Export Control of the Russian Federation (the federal executive body authorised in the field of countering technical intelligence and technical protection of information) |
| Data Privacy Officer (DPO) | Person responsible for organising PD processing |
| Data Security Officer (DSO) | Person responsible for ensuring PD security during processing in a PDIS |
1)
See also Catalogue of actions with personal data.