Organising compliance

1

Order

date of appointment, Arts. 22.1 and 18.1(1)(1) of 152-FZ, appointee's signature

2

Job description

functions, right to information and directive powers: Roskomnadzor asks for it with the order at inspections and visits

3

Employment terms

agreement changing the function (Art. 72 of the Labour Code) or consent to additional work for extra pay (Arts. 60.2, 151)

4

Power of attorney

for replies to subjects, letters to Roskomnadzor and events: without it the head answered for a letter to the regulator (case No. 12-392/2019)

5

Register of operators

one person in the notification (Art. 22(3)(7.1)), update the data on change (Art. 22(7))

External responsible person

Spell out duties in the contract

not by referring to the law: duties under Art. 22.1(4), supply of data to the extent of Art. 22(3), instructions and reporting to the executive body (Art. 22.1(2)). Documents name a specific individual, otherwise the arrangement risks being treated as a void transaction or borrowed labour

Group of companies

Appointment in each legal entity

no exemptions for groups: one person may be responsible in several companies, but each operator issues its own order, and a DPO network across group, subgroup and company levels only coordinates them

• Function
• What it covers in practice
• Evidence

• Control
• internal control of legal and protection compliance, maintaining the record of processing, expert review of contracts, projects and internal regulations
• control reports, register of findings, opinions

• Information
• informing staff of requirements and training, turning norms into working rules
• familiarisation sheets, training programme and log

• Communications
• receiving and handling subject requests or overseeing them, working contact from the register of operators
• request log, replies on time, substitute person

• Beyond the minimum
• harm assessment, incidents and notices, replies to authorities, inspection support, practice monitoring
• function statute with a full task list

• Powers
• demand compliance with requirements, request information, propose process changes and penalties, instruct the working group
• job description, which classifies the person under Art. 2.4 of the CAO

Independence: the law gives direct accountability to the executive body and an unconditional right to information (Art. 22.1(2)-(3)), but, unlike Art. 38 GDPR, does not protect against substantive instructions and dismissal. This is offset by reporting to the top person, metrics and requirements even for one's own unit

How liability is allocated

Art. 2.4 CAO test

an official performs organisational and administrative functions: the job description and actual powers decide, not the role's title

No appointment or powers - the head is liable

pointing to functions assigned to a specialist does not release the head (case No. 7-81/2025 under Art. 13.12(6) of the CAO)

Powers are risky without appointment too

an employee with directive functions and PD processing is held liable even without appointment, and in case No. 4a-449/2017 even an ordinary specialist

The process owner decides

the responsible person advises and takes no risks: assessment, approval and decision are recorded in a document, otherwise liability shifts to them

Criminal risk requires intent

Art. 272.1 of the Criminal Code is an intentional offence (Art. 25), so the DPO's personal risk follows their own actions with data, not the post

Takeaway: directive powers, approval procedure and recorded decisions determine who answers for a violation better than any appointment order

Letter of 12.04.2023 No. 08-31155

Roskomnadzor's reply

to A. Muntyan's query on the status of the person responsible for PD processing

a legal-entity operator must appoint a responsible person

the responsible person may be an employee, a non-employee individual or another legal entity

several responsible persons cannot be appointed

the operator is liable for violations, while officials' liability is assessed on the circumstances of the case

only a court decides on release from liability

Questions that remain open

• 1
• whether an external DPO, including a legal entity, is an official under the CAO

• 2
• when the head is liable and when the DPO instead

• 3
• whether an employee and an external appointee can be combined

Recommendation

Appointment is made by order

each group entity has its own responsible person, some functions delegated by regulations

Practice: per the 2022-2025 CAO case law review (Section 31), of 106 officials punished under Art. 13.11(1)-(1.1), 9 were DPOs; under (2)-(2.1), 2 of 19

• Feature
• DPO, Art. 22.1 of Law 152-FZ
• DSO, Res. 1119, item 14

• When mandatory
• always for a legal-entity operator
• from protection level 3; at level 1 also a unit or unit functions (item 16)

• Scope
• organising processing: control, informing, requests
• technical perimeter of Art. 19: threats, measures, access, action logging, computer incidents

• Who inspects
• Roskomnadzor
• FSTEC and FSB in state systems (Art. 19(8)); at commercial operators, unscheduled FSB and prosecutor's office

• Sanction
• Art. 13.11 of the CAO
• Art. 13.12(6): ₽50-100k for a legal entity

• Qualification
• not set; needs law, processes and IT
• not set; with crypto tools - sufficient skills (FSB Order 378); significant CII objects - FSTEC Order 235 qualification

• New
• since 2025 formal appointment is costly: turnover fines, Art. 272.1 Criminal Code
• from 01.03.2026 in the public sector FSTEC Order 117 applies alongside Res. 1119

Combining: Roskomnadzor allows combining the roles (webinar of 27.07.2023), but a gap in one perimeter is not closed by an appointment in the other, and one person should not check their own decisions

PD processing record

What, where, why and on what basis

a record for each process. Unlike Art. 30 GDPR, the law does not expressly require it and sets no sanction for its absence

a supervisory request rebuilds the record anyway: activities, categories of subjects and PD, purposes, bases, PDIS with database addresses

reply to a reasoned request is mandatory (Art. 20 of Law 152-FZ): case A51-8682/2019, Supreme Court refused the operator's appeal 16.10.2020

Processing regulation

for each purpose: PD and subject categories, periods and destruction procedure (Art. 18.1(1)(2))

Notification to Roskomnadzor

since 01.09.2022 built from purposes, like the record (Art. 22(3.1))

Harm and threat assessment

whose data and in which systems: input for harm assessment and threat model

Internal control

audit compares reality with the record; gaps are the findings

Procedure: changes go first into the record, then the regulation and, if needed, the notification. Simple test: every purpose in the notification and regulation is in the record

Record entry: 11 fields per purpose

• 1
• process and owner unit

• 2
• processing purpose

• 3
• basis, separate for each operation

• 4
• subject categories, marking children and vulnerable

• 5
• PD categories and list

• 6
• PD operations

• 7
• PDIS and other storage sites

• 8
• recipients and processors

• 9
• processing and storage periods

• 10
• destruction procedure and method

• 11
• safeguards

Starter form

Three tabs

processes, third parties, systems: enough to derive the regulation and notification

Mature form

Six more tabs

paper collections, compliance management, PDPS, findings, incidents, revision history

• When to update
• new purpose or process
• new data set
• recipients or processors change

• PDIS launch or retirement
• new periods and destruction procedure

• Recruitment
• HR management
• Staff remuneration
• Training and development

• Motivation and benefits
• Mobility and relocation
• Operational security
• IT services and information security

• Compliance and records management
• Contracts, payments and procurement
• Communications, marketing and sales
• Core business

88

RPPA list

Micro-purposes in 12 groups

a standard set of purposes for any type of organisation

How to use

Micro-purpose: the unit of record

a basis, PD set and storage period are chosen for each micro-purpose, not for an abstract purpose such as "HR work"

Recruitment: 8 micro-purposes

• 1
• searching for candidates for vacancies

• 2
• communicating with candidates

• 3
• assessing fit to requirements, testing knowledge and abilities, surveys

• 4
• reliability checks: legal, reputational and compliance risks, conflict of interest, corruption, accuracy of data

• 5
• decision to hire or reject

• 6
• pre-contract interaction (preboarding)

• 7
• managing recruitment effectiveness, including candidate satisfaction

• 8
• building and keeping a talent pool

1

Preparation

website, policy and consent forms; kick-off meeting; a secure exchange channel, not an open cloud

2

Data collection

documents from a ready list and interviews, from open to standard questions; result: the record of processing and a findings tab

3

Corrective measures

measure, deadline and owner for each finding in the record itself, not in correspondence; chosen by the process owner

4

Documents

policy, regulation, instructions, harm and protection level assessments, notifications and a plan for open items

Axis 1

Criticality

role: operator or processor

visibility to regulator and subject

volume, third parties, data sensitivity, CBT

direct CAO offence: liability at once, no window to remedy

Axis 2

Remediation difficulty

editing documents and forms

reworking IT systems

restructuring third-party relations

new process or control

• Document
• Provision
• Scope and audience
• Typical error

• Operator's general policy
• Art. 18.1(1)(2) and (2)
• approach to all processing, unrestricted access for anyone
• none exists: only a website policy

• Website or app policy
• Art. 18.1(2)
• collection via the resource, a link on every collection page; one policy for several sites is allowed
• someone else's policy or consent disguised as a policy

• Processing regulation
• Art. 18.1(1)(2), Art. 86(8) Labour Code
• all processing, including HR and accounting; employees sign for it
• published in full with lists of positions and premises

Five elements per purpose, Art. 18.1(1)(2)

• PD categories and list
• subject categories

• processing methods
• processing and storage periods

destruction procedure

Does not work

a policy is not a basis for processing: only Art. 6(1) provides bases

Roskomnadzor's 2017 recommendations are inapplicable after the change to Art. 18.1 (Roskomnadzor orally, 22.08.2025)

01

small business

Basic

one regulation, orders on appointment and access, consent and processing instruction forms, published policy

02

medium business

Modular

umbrella regulation and topic acts: employees, requests, destruction, incidents, CBT

03

large companies and groups

Advanced

12 sections across 10 control areas, roles assigned to functions, plus a navigator brochure

• operator maturity and scale grow
• Privacy Advocates set

policy

processing and security regulation

confidentiality terms in contracts

DTA, DPA, framework agreements

consent and explanation forms

harm assessment, training, checks

registers, logs, acts

CBT documents

orders, protection level act, threat model, measures

Res. 211: the Res. 211 list for state bodies is a guide for a private operator: for each item decide whether to take it as a separate document, merge it into the regulation or drop it, and record the decision in writing

• 1
• Approve by dated order

an unapproved draft is not a measure, and a file's date is not a formal detail

• 2
• Get signed acknowledgement

sheet tied to the version; remote staff are informed via the portal only if the contract or regulations say so (Art. 312.3(5) Labour Code, case No. 88-16944/2020)

• 3
• Check for restrictions

do not narrow subject rights or grant the operator powers: requests in person only, withdrawal of consent not before a deadline

• 4
• Cross-check with policy and record

regulations-policy mismatch is a typical violation per Roskomnadzor; the record settles disputes

• 5
• Review

at least every three years and on triggers: incident block, harm assessment, separate consent

Art. 18.1(4) of Law 152-FZ

The operator proves

on Roskomnadzor's request the operator provides documents or otherwise proves its measures. The authority proves guilt (Art. 1.5(3) of the CAO), but in practice what is not provided is deemed not done

case A40-81171/2017: failure to adopt acts on dismissed employees' PD upheld in three instances (Moscow District Court, 15.01.2018)

evidence is gathered in two groups: routine before an incident and response after

+

Procedure

Standing local act

scope: law, protection requirements, operator's policy and regulations

format: internal control, external audit or both

methodology: record check, checklist, interviews, PDIS survey

frequency: plan once a year or half-year plus triggers - complaint, incident, change of processes or law

inspectors and their right to information

Report

Result of a specific check

period, methodology and inspectors

list of measures performed

violations found and provisions

remedies, deadlines and owners

decisions based on control results

Practice: the Supreme Court on 21.01.2026 (No. 5-AD25-119-K2) upheld a ₽100k fine on the Ministry of Labour for a leak: no evidence of internal control or audit under Arts. 18.1, 19, 22.1 of Law 152-FZ

• Procedure
• Provision
• Scope
• Result
• How requested

• Internal control and/or audit
• Art. 18.1(1)(4) of Law 152-FZ
• compliance with law, policy and internal regulations
• report with violations, measures and deadlines
• as a separate request item

• Subject harm assessment
• Art. 18.1(1)(5), RKN Order 178
• possible harm and its ratio to measures
• harm assessment act
• as a separate request item

• Threat identification
• Art. 19(2)(1), Res. 1119
• technical scenarios for PDIS
• threat model or other document of the operator's choice
• in security measure documents

• Measure effectiveness assessment
• Art. 19(2)(4), item 17 of Res. 1119, FSTEC Order 21
• implemented measures, before launch and at least every 3 years
• assessment document
• in security measure documents

Rule: an audit is an umbrella: it checks that harm assessment and threat identification were done without replacing them, and an IS specialist checks the technical soundness of measures

Four cross-cutting slices

slice 1

Data and systems

which PD is processed in which PDIS

slice 2

Purposes and principles

minimisation, periods, deletion once the purpose is met

slice 3

Transfers

who receives data, including processors

slice 4

Access

who sees data and in what roles

Typical errors

a paper audit: procedure and report exist, no survey

a checklist instead of a survey: shows a policy exists, not that it matches processes

over-retention is found by an inspector, not your own audit (A40-81171/2017)

audit only on an external trigger: reports dated by complaints and requests

report with no violations, deadlines or inspectors

Format: regular own control is combined with an external audit before a major launch, after an incident and before a visit, but responsibility for the measure stays with the operator

01

A role with powers

a responsible person is mandatory for a legal entity but works only with a job description, a right to information and directive functions

02

The record as a single source

the regulation, notification, harm assessment and audit derive from the record of processing, and every change starts there

03

Three policies, not one

the general policy, site policy and internal regulation differ in scope and audience, not length

04

Documents can be produced

a measure exists if introduced by order, signed for and retrievable on request (Art. 18.1(4))

05

Fact-based control

audit checks processes vs the record, replaces neither harm assessment nor threat model