Data subject rights and requests

Information and access

on request (Arts 14, 20) and before processing PD not obtained from the subject (Art. 18(3))

Rectification, blocking, destruction

of incomplete, inaccurate, outdated, unlawfully obtained or unneeded PD (Art. 14(1), Art. 21)

End of processing

withdrawing consent (Art. 9(2), 21(5)) and demanding an end to processing (Art. 21(5.1)), except grounds in Art. 6(1)(2)-(11)

Objection

against advertising calls and mailings (Art. 15(2)) and decisions based solely on automated processing (Art. 16)

Portability

not provided in Russia, applies only to an operator under GDPR (Art. 20)

Nature of the right

Three effects for operators

• 1
• the operator proves the processing basis; the subject need not prove unlawfulness (Art. 9(3))

• 2
• the operator also proves that, when and what it replied: an unproven reply in a dispute equals none

• 3
• an RKN complaint and a lawsuit run in parallel, and a complied-with order does not remove compensation risk (Art. 17, Art. 24(2))

Limits: subject rights are limited by three groups of interests: third-party rights, special information regimes and the public interest. A limit is backed by a specific rule and cited in the reasoned reply

+

152-FZ

Rights under Russian law

access to processing information and to own data, Art. 14

rectification, blocking and destruction of data, Art. 14

demand to stop processing, Art. 21(5.1)

opt-out of advertising calls, mailings and political campaigning, Art. 15

objection to decisions based solely on automated processing, Art. 16

appeal against operator actions, Art. 17

damages and compensation for moral harm, Art. 24(2)

Convention 108+ and GDPR

On top of the Russian set

processing limitation

objection to processing as such

informing a person of a leak of their data

portability: a data copy in a format for another service

right to be forgotten, in Russia only for search engines (Art. 10.3 of 149-FZ)

In Russia: the law requires notifying RKN of a leak, not people, but voluntary notice to affected persons helps the Company in disputes

• Term
• What to do
• Provision
• Extension

• immediately
• stop promotion and political campaigning
• Art. 15(2)
• no

• from the request
• block the disputed data during the review
• Art. 21(1)
• no

• 3 working days
• stop unlawful processing and transfer under Art. 10.1
• Art. 21(3), Art. 10.1(14)
• no

• 7 working days
• rectify or destroy PD from the date of supporting data
• Art. 20(3), Art. 21(2)
• no

• 10 working days
• information, refusal, stopping on demand, reply to a body
• Arts 14, 20, Art. 21(5.1)
• +5 working days

• 30 days
• purpose achieved, consent withdrawn, objection under Art. 16
• Art. 21(4), (5), Art. 16(4)
• no

• 6 months
• blocking limit if destruction in time is impossible
• Art. 21(6)
• no

How to count

counting starts the day after receipt (Civil Code Art. 191), an end on a non-working day is moved (Art. 193). Art. 21 mixes working and calendar days, and dissemination consent ends on receipt of the demand (Art. 10.1(13))

Extension

give reasons on the merits and notify before the deadline: a letter on working day 11 merely records the delay. The 30-day extension of Law 59-FZ does not apply to a private operator

1

There is a decision

a finding on a specific person to act on: refusal, price, access term, risk category

2

Effects are significant

legal effects or other impact on rights, including approval on changed terms

3

Automation is exclusive

the human lacks all the material and power to depart from the system's prompt

4

Conclusion in writing

the classification is recorded with reasons, the check stops at the first "no"

If Art. 16 applies, the process follows one of four routes

route A

Human in the loop

access to the material, authority to deviate and a decision log

route B

Written consent

separate form and alternative, not available in HR (Art. 86(6) Labour Code)

route C

Federal law

a law permits the decision and itself sets rights safeguards

route D

Dropping automation

the decision returns to a human in full

2026 context: the AI law 243-FZ of 26.07.2026 adds no requirements for automated decisions, and ad segmentation does not trigger Art. 16

Oblivion

Demand on a search engine

Art. 10.3 of 149-FZ, outside 152-FZ: a PD complaint to RKN has no subject (position of 28.01.2022)

addressee is the search engine operator, no advertising criterion from 01.10.2024 (158-FZ)

three grounds: unlawful dissemination, inaccuracy, irrelevance

10 working days; links leave search results, the material stays

unexpired prosecution periods and unspent convictions are not forgotten

the applicant proves inaccuracy; the request itself stays undisclosed

Data of the deceased

Powers of heirs

Art. 9(7) of 152-FZ: data remain PD, processing rules are not relaxed

consent comes from heirs of the called class who accepted the estate (Const. Court 1176-O of 30.05.2024)

actual acceptance of the estate suffices, no waiting for a certificate

the subject's lifetime will outweighs the heirs' will

children, spouse and parents protect image and private life (Civil Code Arts 152.1, 152.2)

an heir does not own the data: consent is weighed against the deceased's interests

1

List the demands

from the request section

2

Set rule and deadline

day type and extension per track

3

Check the addressee

if instructed, its own part

4

Enter in the log

an assignee for each track

• How the applicant writes
• What it is in law
• Provision
• Details

• "why do you need my data"
• request for information
• Art. 14(7), Art. 20(1)
• required

• "fix my phone number"
• rectification on supporting data
• Art. 20(3), Art. 21(2)
• not required

• "delete my data"
• destruction, withdrawal or cessation
• Art. 20(3), Art. 21(5), (5.1)
• not required

• "stop calling me"
• stop promotion, immediately
• Art. 15(2)
• not required

• "take my photo off the site"
• stop transferring disseminated PD
• Art. 10.1(12)
• own list

• "why the algorithm refused"
• objection to an automated decision
• Art. 16(3), (4)
• not required

Practice: Art. 14(3) details are needed only for an information request and a letter's demands are handled separately: the Moscow Arbitration Court quashed the regulator's refusal that recast the request (A40-208475/2025, first instance)

• Inbound channels
• postal address
• all public e-mail addresses
• responsible person address in the register

• personal account
• website forms
• chat and call centre
• front office
• consent's withdrawal method

Same-day registration

date and time, channel, full text and proof of receipt: time runs from receipt, not registration

First line

"delete my data" in a chat is a timed demand, not a service complaint. Pass it to the responsible person at once

Cleaning before forwarding

excess scans and third-party data are not forwarded; the original stays in a restricted folder

Request reached the processor

do not stay silent: confirm processing under instruction, disclose own part, refer to the operator

Important: an answer "only via the personal account" or "come with your passport" is already a refusal: the Moscow Arbitration Court held a demand to appear a breach of Art. 14(3) (A40-208475/2025, first instance). A letter sent via two channels is not abuse, and since 01.09.2025 the withdrawal method in a separate consent is a verifiable channel

Mirroring

Check the link to the account

the personal account does it by login, the phone by an SMS code or security questions

a passport copy from a client known by phone number is collection with no basis

a reply on a name match alone discloses PD to an outsider, i.e. an incident

RKN rejected collecting data beyond the list with subsequent consent (28.01.2022)

a typo in one detail is judged against the whole document set

Data is lacking: two questions and four outcomes

measures needed, high risk

Request what is missing

a request for a bank client's data without document details

no measures needed, high risk

Refuse with reasons

a paper request to an online service with no link to an account

no measures needed, low risk

Comply

withdrawal of mailing consent by an unregistered user

measures needed, low risk

Depending on circumstances

comply or take measures, reply within the deadline

Rule: a refusal for failed identification names the missing detail and goes out within the main deadline: requesting it does not suspend the period, and silence equals non-provision of information

• Who applies
• Proof
• What to check
• What not to demand

• Proxy by power of attorney
• a simple written power of attorney, the principal may submit it too (Digital Ministry, 10.07.2019)
• authority for this exact action: information, consent withdrawal and destruction are distinct powers
• notarial form and new information about the principal

• Legal representative
• birth certificate, act appointing a guardian or custodian
• status matching the subject's age and legal capacity
• documents beyond those proving the status

• Advocate
• advocate's request citing the agreement, warrant or power of attorney (Justice Ministry order No. 288)
• inquiry regime: own deadline and liability under Art. 5.39 CAO
• data of third parties who are not principals without their consent (RKN position of 22.09.2023)

• Heir
• documents on accepting the estate, incl. actual acceptance
• the called class and the claim: access or consent to processing
• a completed estate case and certificate

Boundary: checking authority must not become separate data collection: the operator needs a document on authority, not information beyond what the reply requires

Reply skeleton, Art. 14(7)

For each point, text or "not applicable"

• 1
• confirmation of processing

• 2
• legal grounds and purposes

• 3
• processing methods

• 4
• persons with access and recipients, not staff

• 5
• the applicant's PD and their source

• 6
• processing and storage periods

• 7
• how rights are exercised

• 8
• cross-border transfer

• 9
• processor: name and address

• 10
• Art. 18.1 measures and other legal information

Reply mirrors incoming form

paper for paper, electronic for electronic, the applicant's choice is binding (Art. 14(3)). Demanding a visit to the office is an offence under Art. 13.11(4) of the CAO

A policy reference is not a reply

the policy describes processing in general, but the applicant asks about themselves. A technical PDIS export is not an accessible form either

Completeness per letter

an incomplete reply is the same offence as silence; completeness cannot be built from several letters

A quick brush-off is worse

The Second Cassation Court took the date of an incomplete reply sent the next day as the moment of the offence (No. 16-1734/2025, ₽40,000 fine upheld)

Free, with no "you already know"

access is free, and the applicant's awareness from a contract or account is no ground to refuse

vs

Works

Ground named by law

Art. 14(8): defence, security, operational-search activity, anti-laundering and other cases of federal law

third-party rights: mask their data and issue the document for the applicant's part

a repeat request for the same data within 30 days without grounds (Art. 14(4)-(6))

unconfirmed identity, naming the missing detail

another ground from Art. 6(1)(2)-(11) against a demand to stop processing

Does not work

Ground invented by the operator

excessive request: the law has no filter like Art. 12 GDPR

"information is confidential and issued only on a court request"

trade secret with no legal basis and internal operator rules

special status, e.g. a financial manager: the 3rd CCGJ confirmed the duty to reply but closed the case as time-barred (16-2744/2025)

depersonalisation instead of destruction or ending processing

• Refusal skeleton
• date of receipt
• demand in the applicant's words
• rule and paragraph
• why the rule applies

• what is issued on partial refusal
• right to appeal to RKN or a court
• signature

sent within 10 working days

1

Block at once

the disputed data from the request, without waiting for documents, not the person's whole file

2

Check the ground

rectify a faulty record, destroy if PD were unlawfully obtained or no longer needed for the purpose

3

Meet the track deadline

on another Art. 6(1)(2)-(11) ground, name the rule and the retention term

4

Notify recipients

the subject gets the result, third parties with the old version by reasonable measures (Art. 21(1)-(3))

5

Confirm with an artefact

attach the destruction act under order No. 179 to the reply, keep the blocking export with it

RKN demand

Handled on a par with the subject's demand

same sanction: Art. 13.11(5) of the CAO - ₽50-90k for a legal entity, repeat offence (part 5.1) - ₽300-500k. An offence exists only if the data fit the disposition: the appeal court quashed a warning to a homeowners' association whose data the applicant himself disclosed (A56-105866/2025, 28.06.2026)

Data from a GIS

Correct at the source too

if the error came from a state system, address the demand to its operator too: the Digital Ministry named this route for the MAX messenger (31.08.2026)

17 of 75

checklist questions

triggered by an incoming request

2 years

correspondence

copies of requests and replies sought for 2 years

3 years

act and export

destruction proofs kept (para. 8 of order No. 179)

1 year

limitation

Art. 13.11(4), (5) CAO, from the incomplete reply date

Minimum log fields

incoming number, date and time, channel

applicant, status, identity check method

verbatim request section

rule and deadline per track

extension with notice details

assignee and result per track

date, method and proof of dispatch

notice to third parties and repetition

Typical failures

the pipeline stops at customer service with no owner

applicant and regulator get different versions

reply kept without act or export

the reply went by post with no proof

150 000 ₽

rare high amount

eight SIMs issued on a subscriber's passport unknown to him (2-6115/2025)

5 000 ₽

of ₽100,000 claimed

to one claimant in a mass leak, appeal of 01.08.2023

225 000 ₽

damages from the complainant

for over 200 selective complaints against one publication (A19-1402/2024)

Usual compensation

advertising without consent or breach of an employee's right to information is valued at around ₽10k, property damage is almost never recovered

Collective claims

per press reports, after a delivery service leak 33 customers claimed ₽100,000 each: the combined claim brings both the amount and a public story

For the operator: in a case on advertising complaints the court treated formal, systematic and selective complaints as abuse, a mechanism transferable to RKN complaints. Reply costs are proved by contracts and acts

• What is left
• How it is resolved
• Basis

• Account and correspondence
• not regulated by law and disputed; in practice the user agreement and handed-over login and password decide
• contract with the platform

• Content and assets
• exclusive rights to protected content and digital financial assets pass to heirs; notaries do not see the account as IP
• Plenum 9 paras 90-91, 259-FZ, Notaries

• Medical documents
• to the spouse, close relatives on a closed list and persons named by the patient, absent a lifetime ban
• Art. 13(3.1), 323-FZ, Const. Court 1-P

• Account information
• the appeal court found a printout given to a client's mother, who later inherited, insignificant, but inheritance does not lift secrecy
• 10-3796/2025, Art. 183(2) Crim. Code

Without the heirs' consent

Lawful circulation

death registration, notaries and archive

funeral services and burial registers

insurance and court procedures

as far as the function needs (Arts 5, 7 of 152-FZ); 4th AAC: a body transporter's access to the deceased's data is a competitive edge (A10-4767/2014)

Term: protection of the deceased's data is perpetual, retention is not. Give it a purpose, scope and term, then destroy it or send it to the archive, where private-life data is closed for 75 years from the document's creation, earlier with the heirs' written consent (Art. 25 of Law 125-FZ)

• Mechanism
• What it covers
• Foreigner's data

• Protection and rights
• national treatment, Constitution Art. 62(3)
• in full

• Localisation, Art. 18(5)
• RF citizens' PD collection
• outside the rule if the set is separate

• Landing, Law 236-FZ
• foreign resource, 500k+ a day from Russia, some persons with no threshold
• included on a par with citizens' data

• CBT, Art. 12
• recipient abroad
• returning to the home country is CBT too

Citizenship unverifiable

the operator picks the method (RKN 19.01.2015, Ministry of Communications 25.08.2015), per expert view a citizenship field, site version or geolocation

Disputed

by citizenship a foreigner in Russia is outside localisation, but by location draws the operator into landing, so both scenarios are kept

Special category: citizenship, country of birth and language together reveal nationality per the expert approach, and experts class a report on staff nationality as a special category

1

Contract

conclusion and termination, 3 working days, body at the foreigner's workplace

2

Employment

filed by the employment agency, per foreigner, 3 working days

3

HQS salary

quarterly, to the body that issued the work permit

4

HQS petition

filed by the foreigner with two consents, data shown on the ministry site

The form sets the data content, and requests beyond its fields have no basis

An attached consent is not a basis, its withdrawal does not cancel the duty

Whose consent it is is disputed; Tyumen Region Interior Directorate (27.08.2026): the filer's

Migration biometrics since 29.12.2021

fingerprints and photo under 274-FZ within 30 days for those entering to work, 90 days for others staying over 90 days (Art. 5(13) of 115-FZ). This layer gives a private operator no basis

Mistake: notices are sent to the employer's location although the addressee is set by the place of work, and with a patent for two regions both bodies are notified

Art. 10(3) of Law 152-FZ

The law names the operator, not the method

convictions are processed by state bodies within their powers and by others as federal laws provide. Consent is not a condition and, per the expert approach, a candidate's signature creates no such case, though this is disputed

• Situation
• Conclusion
• Basis

• Teachers, finance, transport
• admissible for posts where the law bars convicted persons
• Art. 331 Labour Code, sector rules

• Bank
• only posts on the banking law list; for others a questionnaire breaches Art. 10(3)
• 12-1517/2016

• Self/family form
• breach of Art. 10(3) and excess under Art. 5(5); an order dropping the questionnaire does not cure past processing
• A55-21355/2018

• Criminal record certificate
• Digital Ministry (12.10.2022): presence or absence without details falls under Art. 6; RKN orally (14.08.2026) puts presence under Art. 10
• disputed

• Counterparty beneficiaries
• no direct rule on checking their convictions; consent does not close the gap
• Art. 10(3) of Law 152-FZ

Retention: after the HR decision, keep a record that the certificate was shown, with date, number and issuer. From 01.02.2027 corporate employers in the digital profile experiment (Gov. Res. No. 710 as amended by No. 1217) get Interior Ministry data via ESIA, but only a law grants the right to ask

Sole trader

Register is open by law

Art. 6 of Law 129-FZ, except ID document and residence

counterparty needs no consent (Art. 6(1)(2), (5), (7), (11)); no right to leave the register (Const. Court 1346-O)

only register data may be published without violation, anything beyond needs a basis (RKN orally, 27.08.2025)

exporting and reselling the register exceeds the disclosure purpose per the expert approach; it is not a public source under Art. 8

Self-employed

No open register

per the expert approach, only NPD status is publicly visible

customer gets name and TIN from the receipt and contract

TIN, shipping address stay personal, like a premises-less sole trader

the publicity argument fails, status is disputed, no case law

with client data, like a sole trader, he is a notifying operator (RKN orally, 22.08.2025)

Disputed

RKN's Central FD office (2022, 2025) and RKN itself orally (14.08.2026) deny sole traders subject rights over register data. Safer: treat it as PD without consent

Mailings

Art. 18 of the Advertising Law needs subscriber consent, but RKN orally (14.08.2026) allows sole traders' platform contacts unless the platform restricts it

key point

A right is fulfilled by track, deadline and evidence

the operator classifies each demand, assigns a rule and deadline, replies in full and keeps a compliance artefact

Classification comes first

the request section is split into demands, each gets its own rule, deadline and details

A ladder, not one deadline

seven values, working and calendar days, extension up to 5 working days only for ten-day deadlines

Any channel starts the clock

a channel map and same-day registration beat a single window convenient to the operator

Identity without extra data

checked with means the operator already uses, and a refusal names what is missing

Completeness and trail

reply point by point under Art. 14(7), refusal only by rule, compliance proved by act and log