Privacy risk management

DATA OPTIMISM

Playing to win, maximising benefit

Data as the new oil: the more, the more valuable

analytics, personalisation and AI training

accumulated volume multiplies a leak's cost

DATA PESSIMISM

Playing to avoid failure, minimising damage

Data as toxic material: the sooner destroyed, the less vulnerability

smaller surface for leaks and sanctions

the business loses the value of data

• Classic privacy compliance
• Lean data processing
• Secure data processing technologies

• Mikhail Mishustin, Prime Minister of Russia, 12.03.2020
• Milosh Wagner, Deputy Head of RKN, 20.06.2023

• Diagram labels in Russian
• A regulatory moat surrounds everything, and each pillar is built to its requirements

WHO FACES THE RISK

Assess risk for both sides, or the decision will be one-sided

This part. Whether to process, how much and on what terms. Next part. How an attacker reaches the data and what protection is needed

People behave differently depending on context. Merge data from different contexts and they can no longer keep apart roles meant for different people

Job

professional network profile: position, experience, contacts

Friends

social media: jokes, holidays, arguments

Family

kids' photos, family events, address

Private life

dating apps and what a person shows only there

Rule: do not pool data from different sources and purposes without need: the law bars merging databases with incompatible purposes (Art. 5(3) of Law 152-FZ)

OPERATOR RISK CATEGORY

High

Significant

Medium

Moderate

Low

Since 01.07.2021 RKN sorts operators into five risk categories (Resolution No. 1046), criteria rewritten by No. 1286 of 27.08.2025

HARM ASSESSMENT

high

medium

low

Harm assessment is mandatory for every operator; degree set by RKN Order No. 178 of 27.10.2022, Art. 18.1(1)(5) of Law 152-FZ

SANCTIONS

up to ₽500m

turnover fine for a repeat leak, Art. 13.11 of the CAO, from 30.05.2025

Takeaway. The risk-based approach is already built into regulation, so a company needs its own documented assessment

• always, mandatory for every operator
• When
• if processing may create a high risk to rights and freedoms

• degree of harm to the subject (high, medium, low) by Order No. 178 situations
• What is assessed
• a specific operation, its necessity, proportionality, risks and measures

• harm assessment act
• Result
• a DPIA report with measures, reviewed when risk changes

• no separate procedure; the operator picks the measures
• High risk
• prior consultation with the supervisory authority

Takeaway. The report meets the formal requirement; a per-process risk assessment drives the choice of measures and is closer to a DPIA

Degree of harm, Order No. 178

High

biometrics outside cases directly set by law

special categories outside cases directly set by law

minors' PD in (pre)contractual relations outside direct statutory provisions

depersonalisation (incl. research) outside Art. 6(1)(9) of Law 152-FZ

instructing a foreign entity to process Russians' PD

collecting PD using databases outside Russia

Medium

dissemination of PD beyond direct statutory provisions, incl. via an incident

processing for purposes other than the original purpose of collection

direct marketing from someone else's PD database

consent via a simple on-site web form (click-wrap)

consent covering an (un)defined set of persons for mutually incompatible purposes

• Low
• keeping public PD sources under Art. 8 of Law 152-FZ

appointing a non-employee as person responsible for organising PD processing

Rule: where several grounds apply, take the highest degree; if no type of processing fits, Roskomnadzor's oral position is to record in the report that no degree of harm was identified

Harm assessment report

Mandatory details

operator's name and address

date of the report and of the assessment

names, positions and signatures of the assessors

degree of harm; if several, the highest is chosen

the list of harm cases is closed

Roskomnadzor

What the operator decides

when to assess: by activity, per PDIS or in aggregate

assessment method, object, reasons and period

commission membership and procedure

ratio of harm to measures taken

PD security is outside the order; that is for the FSB and FSTEC

Gaps: the order sets no report retention period or grounds and frequency of review, so set them in an internal regulation. PDIS details are not required in the report (RKN Kamchatka Krai Office, 14.12.2023)

01

02

03

04

05

06

Those who neglect documents are wax in the hands of those who do not

1

• 1.1
• Person's status re PD

• 1.2
• Processing purpose

• 1.3
• PD sensitivity

• 1.4
• Collection sources

• 1.5
• Subject categories

• 1.6
• Third-party involvement

• 1.7
• Cross-border transfer

• 1.8
• Scale of processing

• 1.9
• Processing scenarios

• 1.10
• Visibility (multiplier)

2

• 2.1
• Purposes and proportionality

• 2.2
• Legal bases for processing

• 2.3
• Transfers to third parties

• 2.4
• PD life cycle

• 2.5
• Interaction with subjects

• 2.6
• Dealing with authorities

• 2.7
• Staff training

• 2.8
• Deviations and incidents

• 2.9
• Processing security

• 2.10
• Management and records

• 3
• Risk management

• 3.1
• Assessing the risk level

• 3.2
• Choosing a response method

• 3.3
• Defining measures

• 3.4
• Planning measures

Method and calculator

STEP 1. THREE FACTOR SCORE LEVELS

1.5 Subject categories

equal party, independent of the operator

weaker party, dependent on the operator

lacking or with limited legal capacity

1.8 Scale of processing

irregular and affects few subjects

regular or affects many subjects

regular and affects many subjects

STEP 2. COST OF SANCTIONS BY CONTROL AREA

• 2.4
• PD life cycle

• 2.9
• Processing security

• 2.2
• Legal bases for processing

• 2.3
• Transfers to third parties

• 2.8
• Deviations and incidents

• 2.1
• Purposes and proportionality

• 2.5
• Interaction with subjects

• 2.6
• Dealing with authorities

• 2.7
• Staff training

• 2.10
• Management and records

describe the processing first, then assess

choose the scope yourself, from the marketing process to one site

requirements: RKN Order No. 253, Resolutions No. 1046 and 24, sector acts

• check compliance via checklists and closed questions
• Controls checklist

• 0
• 5

5

10

10

Processing exposure

Deviation criticality

before measures 6 and 5

after 1 year 3 and 2

after 2 years 2 and 1

Example process: points show exposure and criticality

Scores are reviewed regularly, as risk factors change over time

Set risk tolerance with the owner of the processing and the risk

• FOUR METHODS
• MEASURES AND PLAN, TYPICAL ALLOCATION

• Measure type
• Who does it
• When

• Adjusting relations with subjects
• process owner, DPO
• fast

• Adjusting relations with third parties
• procurement, lawyers
• fast

• Adjusting internal documentation
• DPO
• fast

• Minimising the processing
• process owner
• slow

• Changing IT systems and infrastructure
• IT and IS
• slow

Three plan questions what we do, who does it, by when

Residual risk is assessed after measures too and accepted by the risk owner

Remove from the process whatever adds no value to the result but adds risk

smaller volume and range of data

fewer processing methods, shorter terms

fewer people with access

same result, less risk

WHAT THE COMPANY GAINS

RKN APPROACHES TO PROPER PD PROCESSING

• 01
• minimise the list of PD collected and processed

• 02
• store PD categories with incompatible purposes separately

• 03
• keep names and contacts apart from interaction data

• 04
• do not hoard PD just in case or build profiles without need

• 05
• use processors less often; instructing them does not remove liability

COMPUTING WITHOUT REVEALING

IDENTIFICATION WITHOUT EXCESS

WHERE USED

• cybersecurity
• AI training
• data analytics
• public services

CASE

Bank of Russia approved MPC

In 2024 banks were allowed to assess a borrower's debt burden from inflows to its accounts at other banks. It runs on an account-scoring platform with secure multi-party computation, without disclosing bank secrecy

LEGAL STATUS

PETs are not regulated as such, and PD and secrets keep their status after use

step 1

Process card

purposes, PD, subjects, third parties and scenarios

Order No. 178

Harm assessment report

degree of harm, mandatory for every operator

steps 2 and 3.1

Risk assessment report

exposure, criticality, deviations and risk level

step 3.2

Risk owner's decision

response method and acceptance of residual risk

steps 3.3 and 3.4

Action plan

what we do, who does it, by when

shelf life

Review date

when and after which changes it is updated

WE PASS ON

high-risk processes and PDIS, where modelling starts

PD/subject categories and volume for the Res. No. 1119 protection level

third parties, processors, CBT: system boundaries and interfaces

owner's risk tolerance, i.e. acceptable residual risk

WE GET BACK

relevant threat type and attacker model, refining area 2.9 score

protection measures, added to the plan as IT changes

One cycle, two views. Risk management decides whether to process; the threat model decides how to protect what you chose to process

Privacy risk is wider than security threats, so purposes, grounds, scope and subject rights rate alongside protection

The regulator thinks in risks: supervision risk categories, harm assessment, fines scaled to the leak

Risk level combines processing exposure and deviation criticality, and is reviewed regularly

The cheapest risk-reduction measure is minimising processing, and every risk decision leaves a document

t.me/prv_adv