Page 1

RECOMMENDATIONS FOR THE COMPOSITION OF A DOCUMENT DEFINING
OPERATOR'S POLICY REGARDING THE PROCESSING OF PERSONAL
OF DATA, IN THE ORDER SET BY THE FEDERAL LAW OF 27
JULY 2006 No. 152-FZ "ON PERSONAL DATA"

1. These Recommendations have been developed in order to develop unified
approaches to the structure and form of the document defining the operator's policy in
regarding the processing of personal data (hereinafter - the Policy).

2. Basic concepts used in the Recommendations:
- personal data - any information relating directly or indirectly
a specific or identifiable individual (subject of personal data);
- operator of personal data (operator) - a state body,
municipal authority, legal entity or individual, independently or
together with other persons organizing and (or) carrying out the processing
personal data, as well as determining the purposes of personal data processing,
the composition of personal data to be processed, actions (operations),
committed with personal data;
- processing of personal data - any action (operation) or a combination
actions (operations) with personal data performed using funds
automation or without using them. The processing of personal data includes
yourself, including:
- collection;
- recording;
- systematization;
- accumulation;
- storage;
- clarification (update, change);
- extraction;
- use;
- transmission (distribution, provision, access);
- depersonalization;
- blocking;
one

Page 2

- deletion;
- destruction.
- automated processing of personal data - processing of personal
data using computer technology;
- dissemination of personal data - actions aimed at disclosing
personal data to an indefinite circle of persons;
- provision of personal data - actions aimed at disclosing
personal data to a certain person or a certain circle of persons;
- blocking of personal data - temporary termination of processing
personal data (unless the processing is necessary for
clarification of personal data);
- destruction of personal data - actions as a result of which it becomes
it is impossible to restore the content of personal data in the information
personal data system and (or) as a result of which material
carriers of personal data;
- depersonalization of personal data - actions, as a result of which it becomes
it is impossible to determine without using additional information
the ownership of personal data by a specific subject of personal data;
- personal data information system - a set of information contained in
databases of personal data and information processing
technologies and technical means;
- cross-border transfer of personal data - transfer of personal data
to the territory of a foreign state to the authority of a foreign state,
foreign individual or foreign legal entity.

3. It is recommended to include the following structural components in the Policy:
1. General Provisions
In this section, it is recommended to describe the purpose of the Policy, as well as enable
the basic concepts used in it (processing of personal data, operator, subject
personal data, confidentiality of personal data, etc.), list
basic rights and obligations of the operator and the subject (s) of personal data.
2. Purpose of collecting personal data
2

Page 3

The processing of personal data should be limited to the achievement of specific,
predetermined and legitimate purposes. Processing of personal data is not allowed,
incompatible with the purposes of collecting personal data.
The purposes of the processing of personal data may arise, inter alia, from the analysis
legal acts regulating the activities of the operator, the goals actually
activities carried out by the operator, as well as activities that are provided for
the constituent documents of the operator, and specific business processes of the operator in
specific information systems of personal data (for structural
divisions of the operator and their procedures in relation to certain categories of entities
personal data).
3. Legal basis for the processing of personal data
The legal basis for the processing of personal data is the aggregate
legal acts, in pursuance of which and in accordance with which the operator carries out
processing of personal data.
As a legal basis for the processing of personal data, there may be
indicated:
- federal laws and regulatory legal acts adopted on their basis,
regulatory relations related to the activities of the operator;
- statutory documents of the operator;
- contracts concluded between the operator and the subject of personal data;
- consent to the processing of personal data (in cases not directly
stipulated by the legislation of the Russian Federation, but corresponding
operator's authority).
Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" cannot
serve as a legal basis for the processing of personal data by the operator, since
this Law regulates relations related to the processing of personal data, and
also sets out the requirements for operators when processing personal
data.
4. The volume and categories of processed personal data, categories of subjects
personal data

3

Page 4

The content and volume of processed personal data must comply with
stated goalsprocessing.one
The processed personal data should not be
excessive in relation to the stated purposes of their processing.
The categories of subjects of personal data may include, including:
- operator's employees, former employees, candidates for filling vacancies
positions, as well as relatives of employees;
- clients and contractors of the operator (individuals);
- representatives / employees of the operator's clients and counterparties (legal entities).
Within each of the categories of subjects and in relation to specific goals
it is recommended to list all personal data processed by the operator, as well as,
if applicable, describe separately all cases of handling special categories
personal data and biometric personal data.
5. The procedure and conditions for the processing of personal data
In this section, it is recommended to indicate a list of actions performed
the operator with the personal data of the subjects, as well as those used by the operator
methods of processing personal data and terms of processing personal data.
If it is necessary to interact with third parties in order to achieve
the purposes of processing personal data, it is recommended to indicate the conditions of transfer
personal data to third parties (for example, the existence of a contract of order for
2
processing of personal data ), including those
outside the Russian

Federations (cross-border transfer). In this case, it is recommended to indicate a specific
the name and location of the relevant third parties, the purpose of the
(cross-border) transfers, the amount of personal data transferred, a list of actions
for their processing, methods and other conditions of processing, including requirements for protection
processed personal data.
In addition, the operator has the right to transfer personal data to the bodies of inquiry and
investigation, other authorized bodies on the grounds provided for by the current
the legislation of the Russian Federation.
It is also recommended that you include compliance information
confidentiality of personal data established by Art. 7 of the Federal Law "On

one
Art. 6 No. 152-FZ "On personal data"

2

Part 3 of Art. 6 No. 152-FZ "On personal data"

four

Page 5

personal data ", as well as information on the operator's taking measures provided for
h. 2 tbsp. 18.1, part 1 of Art. 19 of the Federal Law "On Personal Data".
A condition for terminating the processing of personal data may be the achievement
purposes of processing personal data, expiration of consent or revocation
the consent of the subject of personal data to the processing of his personal data, as well as
identification of illegal processing of personal data.
It is recommended that personal data be stored in a form that allows
determine the subject of personal data for no longer than the purpose of the processing requires
personal data, except for cases when the storage period of personal data is not
established by federal law, an agreement, a party to which, a beneficiary or
the guarantor of which is the subject of personal data.
Timelines are recommended storage of3 personal data.
When storing personal data, the operator of personal data
is obliged to use databases located on the territory of the Russian Federation in
in accordance with Part 5 of Art. 18 of the Federal Law "On Personal Data".
It is recommended to indicate other conditions for storing personal data, including,
when processing personal data without using automation tools.
6. Updating, correcting, deleting and destroying personal data,
responses to requests of subjects for access to personal data
In case of confirmation of the fact of inaccuracy of personal data or
unlawfulness of their processing, personal data are subject to their actualization
by the operator, and processing should be terminated accordingly . four
Upon reaching the goals of processing personal data, as well as in case of revocation
the subject of personal data consent to their processing, personal data are subject to
destruction if:
- otherwise is not provided for by the contract, the party to which, the beneficiary or
the guarantor of which is the subject of personal data;
- the operator is not entitled to carry out processing without the consent of the subject of personal
data on the grounds provided for by the Federal Law "On Personal
data "or other federal laws;

3

The specific date (day, month, year) and the basis (condition), the occurrence of which will entail the termination of the processing of personal data.

four
Art. 21 No. 152-FZ "On personal data"

five

Page 6

- otherwise is not provided by another agreement between the operator and the subject
personal data.
The operator is obliged to inform the subject of personal data or his representative
information about the processing of personal data of such a subject carried out by him on
the request of the latter fi. ve
It is recommended to include in the Policy the regulation (s) for responding to requests /
requests from subjects of personal data and their representatives, authorized bodies
about the inaccuracy of personal data, the unlawfulness of their processing, revocation
consent and access of the subject of personal data to his data, as well as
appropriate forms of inquiries / appeals.

five
Art. 20 No. 152-FZ "On personal data"

6

