Processing on instruction and transfer to third parties

1

Basis for transfer

transferor's basis, Art. 6(1): consent, contract with subject, law

2

Does a role arise

reply to an authority or own service to the subject: no instruction

3

Purpose test

no own purpose - processor; own purpose and subject relationship - operator

4

Flow by flow

one person can be processor and operator for different flows

5

Document

instruction, transfer agreement or written conclusion

• Outcome
• Feature
• Typical examples
• Document

• processor
• no own purpose, a service function
• accounting and payroll, call centre, hosting and tech support, mailings, access control
• instruction under Art. 6(3)

• operator
• own purpose and direct link to the subject
• payroll bank, health insurance, medical checks, corporate taxi, recruiter (RKN, 19.08.2025)
• DTA and transfer basis

• no new role
• each party's own statutory duty
• reply to an authority (Art. 6(1)(2)), clearing and central counterparty (Bank of Russia, 27.08.2024)
• finding in the processing record

Important: Russia has no separate processor regime: a processor is also an operator (Gov. Res. 1046, para. 7) with only three reliefs - no consent collection, the operator answers to the subject for it, and it answers to the operator

• Four signs of a processor
• purpose regarding the content
• awareness of PD
• access to the content

independent actions with the data

• Counterparty
• Expert approach
• Regulator and courts

• SaaS: CRM, HR e-documents, analytics, AI models
• processor
• instruction

• IaaS and dedicated server without data access
• intermediary
• instruction even without access: RKN Office for Kursk Region, 18.06.2026

• Website hosting and support
• processor
• instruction; order to remedy held at first instance (A49-14214/2022)

• Software maintenance with password separation
• not a processor
• access not proved, order invalid (A16-1293/2011, appeal 15.05.2012)

• Archive with inventory, search and scanning
• processor
• access deduced from the price list, order lawful (A40-32030/2016, appeal 02.08.2016)

Argument: architecture rebuts the presumption of access, e.g. an encryption key held only by the client, not a contractual ban. An instruction cannot be avoided to limit liability

• Term
• Provision
• How to word it

• Purpose and list of PD
• Art. 6(3)
• as in the subject's consent or narrower: exceeding consent is not allowed

• List of actions
• Art. 6(3)
• without it the instruction breaks the law; this order item survived cassation (A40-81171/2017)

• Confidentiality and measures
• Arts. 7, 18.1, 19
• protection level per Gov. Res. 1119; for paper, Gov. Res. 687 instead of PDIS rules

• Documents on request
• Art. 6(3)
• audit right: reply deadlines, site visit, third-party auditor, costs on breach

• Incidents
• Art. 21(3.1)
• processor reports in 12 and 48 hours (operator: 24 and 72); no outside disclosure without operator's decision

• Localisation
• Art. 18(5)
• version effective 01.07.2025; earlier instructions need updating

• Termination
• Art. 21, Order No. 179
• destruction within 5 working days with confirmation, not tied to the service term

Risk: RKN (07.08.2025) found a reference-only instruction insufficient. A defect draws an order to remedy, then Art. 19.5 of the CAO; a foreign template without the Russian minimum does not remove this risk

vs

Written form

Employees, special categories, biometrics

one purpose, one instructed person, with name and address (Art. 9(4)(6))

a list of possible processors does not replace names (A40-32030/2016)

on changing contractor, consent is reissued, not supplemented

Roskomnadzor expects a signature for each processor or category of recipients

Ordinary form

Other cases of consent

processor can be named by link to a website list (positions 27.07.2023, 22.10.2025, 14.08.2026)

from 01.09.2025 consent is a separate document, not a contract clause

a contract with the subject can be a basis, but RKN named consent on 07.08.2025

sub-processor allowed only if the instruction provides for it and consent covers it

PA approach: in employee consent, group purposes into blocks and third parties into categories (processors by name, recipients unnamed) with a signature or tick per category. Instruction without consent draws a destruction order (A56-82428/2022, appeal 20.03.2023)

before

access

Vetting and minimisation

checklist by transfer type, no surplus fields, transfer shown in the record and policy

during

oversight

Audit and chain map

audit every 1-3 years, sub-processor list, contract checked against the real flow

incident

deadlines

Report before the law requires

the processor can start the 24- and 72-hour clock itself; no joint notification

after

exit

Destroy and confirm

destruction on any ground of termination, blocking for up to 6 months, return of media

Art. 6(5), (6)

The operator answers to the subject

a leak at a contractor is the operator's liability to the subject and Roskomnadzor

recourse against the contractor after compensation

a foreign processor is liable to the subject jointly with the operator

Contract

Allocate consequences in advance

contractor's liability cap no lower than the operator's first probable fine

a processor can be fined in its own right, though Roskomnadzor blames the operator

group affiliation removes no obligation

• ?
• One instruction for several processors?

RKN (01.03.2023) required a separate instruction for each; orally on 14.08.2026 it allowed several with a common purpose in the contract. Cautious: separate documents

• ?
• Must a sub-processor be named?

the law is silent; RKN requires the instruction and consent to provide for engaging one. Cautious: disclose the chain as a list

• ?
• Can you instruct without consent, on legitimate interest?

a few cases allowed Art. 6(1)(5) and (7), but Art. 6(3) requires consent unless the law says otherwise. No settled practice

• ?
• Does an instruction arise without a signed contract?

written form can be met by a set of documents, e.g. an offer and correspondence; the lack of one text does not negate the instruction

• ?
• Is the operator liable for a blameless contractor leak?

Supreme Court judge upheld the Ministry of Labour fine (21.01.2026): no evidence of control and protection. Fault is judged by own measures

• ?
• Instruction or transfer for employee data?

Art. 88 of the Labour Code makes the recipient confirm purposes, impossible for a bank or insurer. Practice does not apply it

Data Transfer Agreement

Transfer agreement without an instruction

bilateral, mutual, open-ended, signed once. No direct rule, but a transfer outside an instruction rests on Art. 7, Art. 18(4)(1), Art. 20(3) and Art. 3(11)

an NDA protects trade secrets, not the lawfulness of a PD transfer

the basis stays with the transferor: a contractual one only if the subject is a party or beneficiary (Art. 6(1)(5))

Contents of the agreement

• 1
• parties as independent operators

• 2
• subject and scope of PD transferred

• 3
• assurances on bases and notice to subjects

• 4
• termination if the bases are lost

• 5
• confidentiality and security measures

• 6
• incidents: mutual 12 and 48 hours, outside after consulting

• 7
• assistance with requests and inspections

• 8
• recipient may process on its own and instruct others

• 9
• conditional CBT annex

• 10
• assurances, liability, applicable law

• 11
• open-ended term and effect on past relations

Term: tie a reasonable term to the dependent party's statutory deadlines, or an open-ended obligation falls due in 7 days (Art. 314 of the Civil Code). Cover indirect transfer via a third party too

vs

Right

salary goes to a bank on the employee's written request (Labour Code, Art. 136(3))

the employee changes bank by giving details at least 15 calendar days before payment

data for card issue go to the bank only after the employee's application

Wrong

pay salary into an employer-chosen bank without the employee's will

issue a card and pass data to the bank before application and consent

choose the receiving bank oneself every month

Caveat: Rostrud assessed under labour law and left Law 152-FZ to Roskomnadzor. Whether separate written consent is needed is disputed: Rostrud required it in 2015, Roskomnadzor orally treats an application as enough

a dataset deal

Not a sale and purchase

structures: a processing service, access or a database licence

assurances on bases per subject category (Civil Code, Art. 431.2)

those who withdrew consent are excluded at transfer, not export

unchecked purchase risks nullity (Art. 168(2) of the Civil Code); the regulator sues

M&A

No exemption for a deal

before control passes, the buyer gets depersonalised and aggregated figures

legal due diligence does not replace a PD audit

findings are covered by assurances and indemnity (Civil Code, Art. 406.1)

reorganisation needs no repeat consent

company group

A group is not a legal subject

each entity is an operator; intra-group flows are inventoried and documented

transfer to a foreign parent company is CBT

a group directory without consent only for a common function (position of 22.08.2025)

a joint venture is treated as an external perimeter

• 1
• Process and bases

transfer is recorded, fits the collection purpose, subject is informed

• 2
• Contract model

party roles and basic terms where the transfer is not by law

• 3
• Transfer records

one description and list of external interfaces: type, direction, frequency, volume

• 4
• Transparency

policy and register before transfer, contextual notice at the moment of action

• 5
• Risks and security

assessed as a high-risk operation, contract measures implemented technically

Transfer

API key, contractor account, VPN, shared folder or dashboard - once access is granted

employee account in an external system - a transfer to its operator

Not a transfer

write-only access, e.g. a bot logging requests

data received from own processor: the operator collected it

Typical gap: records often cover only file sending, while former contractors' access is unrecorded for years. In the policy, list recipients by function and authorities by name

Bold marks mandatory criteria: without them no approval

any transfer

Basic

register of operators or notification

policy with purposes and periods

no sanctions or orders in a year

responsible person appointed

ready to sign a DTA

no leaks in 3 years

IS certificates and attestations

instruction

Plus for a processor

ready to sign a DPA with audit, subcontracting and incidents

confirmed protection level under Gov. Res. 1119

incident response plan

staff training

no sanctions in a year

insurance or guarantee

CBT

Plus for a foreign recipient

not prohibited or undesirable, no CBT ban

ready to sign a CBT annex with Art. 12(5) information and destruction upon a ban

protection measures, and for off-list countries the legal regime, are obtained before CBT notification

Why: record "not applicable" with a reason and review the assessment every 3 years. Documented diligence shows all measures were taken (Art. 2.1(2) of the CAO)

Basis

legitimate interest (Art. 6(1)(7)); identification under Law 115-FZ - by law (Art. 6(1)(2))

Scope by purpose

manager and representative data suffice for authority; beneficiaries - for affiliation and AML checks

Do not collect

counterparty staff passport copies outside Law 115-FZ, social media profiles as public data

Representatives

power of attorney data are processed as part of representation, no consent of the representative

Periods

data of a rejected counterparty are destroyed; check files kept for the contract and limitation periods

Database report

the compliance service provider's basis does not pass to the client

Privacy Advocates case

Outsourcing the check to a group service company

outsourcing a pre-contract check is an instruction, with operator liability under Art. 6(5)

consent is needed from the persons checked, who have no relationship yet and may withdraw it

operator keeps provider audit, incident deadlines and destruction at the provider

company affiliation does not remove the risks

solution: keep the check in-house or make the provider an independent operator

• Stream
• Classification
• What to document

• Centralised HR and accounting records
• delegation of operator powers, i.e. an instruction (RKN orally, 28.01.2022, 22.10.2025)
• instruction agreement and employee consent to transfer

• Branch, representative office, other separate unit
• a branch is not an operator; RKN orally (22.08.2025) treats other units as separate operators, disputed under Art. 3(2)
• run such units as independent operators

• Group directory and messenger
• without consent for a common function or single process (RKN orally, 22.08.2025)
• written view is stricter: RKN letter 20.02.2025 No. 08-72692 requires consent (Art. 8); relying on oral is risky

• Training franchisee staff at a training centre
• supporting the job function (RKN orally, 22.08.2025)
• contract names the process and third party; transfers beyond the function need consent

• Access by a foreign group company to the directory or system
• CBT even without any sending (RKN letter No. 02-11-9606, 2023)
• CBT notification is updated when the countries change, localisation remains (RKN orally, 22.10.2025)

Disputed: written views are stricter than the oral one (22.08.2025), also for external transfer: RKN Kursk Office letter of 18.06.2026 No. 2467-02/46 requires each employee's consent for a contractor instruction

• Who requests
• Scope of the right
• Limit

• LLC participant
• any company documents (Arts. 8, 50 LLC Law); charter sets procedure, not list (Supreme Arb. Court No. 144, para. 3)
• status on the request date, if it conflicts with the register's list

• Shareholder
• Art. 91(1) list is open to all, Art. 91(2) documents from 1% of shares, accounting from 25%
• below 25%, Art. 91(2), (3) need a reasonable business purpose; holding period trims the request

• Member of a collective body
• own right (Civil Code, Art. 65.3(4)); courts apply Art. 91 by analogy
• for the period before election only with a showing of need

• Former participant, beneficiary, controlling person
• generally no
• former: data for share valuation or buyout (Supreme Court Review 15.11.2023, para. 4); beneficiary after loss of control: disputed (para. 7)

• Insolvency administrator
• data on the debtor, its bodies and counterparties outside the corporate regime, reply in 7 days (Bankruptcy Law, Art. 20.3)
• correspondence only via court; refusal citing Law 152-FZ was grounds for a case under Art. 14.13(4) of the CAO (A41-10789/2018)

Basis: issuing to a participant is covered by Art. 6(1)(2) of Law 152-FZ with no consent of staff or counterparties if the data protects its rights (Supreme Arb. Court letter No. 144 of 18.01.2011, para. 15)

1

Status

on request date: LLC participant per list and register, shareholder per register or depo account extract

2

Scope and period

by company form, stake and document category; for JSC by a certificate of holding period

3

Marking

ordinary information, the company's confidential information, protected secrets, third-party PD

4

Issue

ordinary at once, confidential after an agreement, secrets as an extract with removals, PD upon proven need

5

Form

requester chooses inspection, certified copies or a summary of content; issue is logged in an inventory

vs

Cannot

redacting PD: para. 7.5 of Instruction No. 7199-U concerns secrets; in A43-1536/2016 (Instruction 3388-U) an order to issue the director's contract unredacted held

per the expert approach, to cite transfer channel risk as grounds for refusal

giving account access instead of copies (Supreme Court Review, para. 13); online-bank viewing awarded once (A41-81863/2022), disputed

Allowed

require a non-disclosure agreement before issue (Art. 50(5) of the LLC Law)

issue with a warning against disclosure (Art. 65.2(4) of the Civil Code)

refuse documents with employee PD if need is not shown (Supreme Court Review 15.11.2023, para. 12); role of Labour Code Art. 88 disputed

The register is not fully open

names and TINs of founders and manager are public by law; passport data go only to state bodies, funds, courts and the DIA (State Registration Law, Art. 6)

The manager in two roles

both a company body and a data subject; the counterparty processes the signed contract without consent (RKN orally, 22.08.2025)

An interested-party transaction drags in relatives

data on spouses, parents, children and siblings of officers within Art. 81(1) of the JSC Law and Art. 45(1) of the LLC Law

Criminal record only for listed positions

e.g. Banking Law, Art. 11.1; the person's consent does not create an Art. 10(3) case of Law 152-FZ

Conflict of interest

relatives within the anti-corruption law's scope are processed under Art. 6(1)(2) (RKN letter 24.12.2025 No. 08-657776), beyond it with consent (RKN orally, 22.08.2025, 14.08.2026). A commercial entity's duty is disputed

Civ. Code Art. 431.2, Plenum 49

Assurances instead of requests

examples in para. 34 of Plenum Res. 25.12.2018 No. 49: control structure, no major-deal status, no manager conflict of interest

Advice: per the expert approach, keep management's family ties outside the general HR system and ask third parties about income only where the law requires (RKN letter 15.03.2022 No. 08-16351 on civil servants)

01

Purpose decides the role

no own purpose - processor; own purpose and subject relationship - independent operator; status is assessed flow by flow

02

Access decides the instruction

cloud, hosting and maintenance are classified by access to content, Roskomnadzor - even without access

03

A specific instruction

action list, measures, audit, tight incident deadlines, confirmed destruction

04

Between operators - a DTA

transfer basis, mutual assurances and eleven blocks instead of a plain NDA

05

Vetting before access

checklist by transfer type, mandatory criteria and review every 3 years

06

The chain to the last link

sub-processors, group companies and former contractors' access are recorded like direct transfers