Page 1

GOVERNMENT OF THE RUSSIAN FEDERATION

POSTANOVLENIE

dated September 15, 2008 N 687
Moscow

On the approval of the Regulation on the specifics of processing personal
data carried out without the use of automation tools

In order to implement the Federal Law "On Personal
data "

Government of the Russian

Federation

postage:
1. To approve the attached Regulation on processing features
personal data carried out without the use of funds
automation.
2. To federal executive bodies within a month
bring your acts on the processing of personal data,
carried out without the use of automation tools, in
compliance with this regulation.
3. This regulation comes into force upon expiry
one month from the date of its official publication.

Prime Minister
Russian Federation

V. Putin

__________________________

Page 2

APPROVED BY
government decree
Russian Federation
of September 15, 2008
N 687

POLOLENIE
about the peculiarities of processing personal data,
carried out without the use of automation

I. General Provisions

1. Processing of personal data contained in
information system of personal data or extracted from
such a system (hereinafter - personal data) is considered
carried out without the use of automation
(non-automated), if such actions with personal
data, such as use, refinement, dissemination,
destruction of personal data in relation to each of the subjects
personal data are carried out with the direct participation
person.
2. The processing of personal data cannot be recognized
carried out using automation tools only on
on the grounds that personal data is contained in the information

Page 3

personal data system or have been extracted from it.
3. Rules for the processing of personal data carried out without
use of automation tools established by regulatory
legal acts of federal executive bodies,
executive authorities of the constituent entities of the Russian Federation, and
also by the local legal acts of the organization, must be applied
taking into account the requirements of these Regulations.

II. Features of the organization of the processing of personal data,
carried out without the use of automation

4. Personal data during their processing, carried out without
use of automation tools should be separated from other
information, in particular by fixing them on separate
material carriers of personal data (hereinafter - material
carriers), in special sections or in the fields of forms (forms).
5. When fixing personal data on tangible media
fixation on one material medium is not allowed
personal data, the purposes of which are obviously not
compatible. To process various categories of personal data,
carried out without the use of automation tools, for each
category of personal data, a separate
material medium.
6. Persons who process personal data without
use of automation tools (including employees
the operator organizations or persons carrying out such processing on
contract with the operator) must be informed of the fact
their processing of personal data, the processing of which

Page 4

carried out by the operator without the use of automation tools,
categories of processed personal data, as well as about
the peculiarities and rules for the implementation of such processing,
established by regulatory legal acts of federal bodies
executive power, executive bodies of the constituent entities
Of the Russian Federation, as well as local legal acts
organizations (if any).
7. When using standard forms of documents, the nature
information in which it implies or admits the inclusion in them
personal data (hereinafter referred to as the standard form), must be observed
the following conditions:
a) the standard form or related documents (instructions for
filling it out, cards, registers and journals) must contain
information about the purpose of the processing of personal data, carried out without
use of automation tools, name (title) and address
operator, surname, name, patronymic and address of the subject of personal
data, source of receipt of personal data, processing time
personal data, a list of actions with personal data,
which will be performed in the process of their processing, a general description
methods used by the operator to process personal data;
b) the standard form must provide a field in which
the subject of personal data can put a mark on his
consent to the processing of personal data, carried out without
use of automation tools, - if necessary, obtaining
written consent to the processing of personal data;
c) the standard form must be drafted in such a way that
each of the subjects of personal data contained in the document,
had the opportunity to get acquainted with their personal data,

Page 5

contained in the document, without violating the rights and legitimate interests
other subjects of personal data;
d) the standard form should exclude the merging of fields,
intended for entering personal data, the purpose of processing
which are known to be incompatible.
8. When keeping journals (registers, books) containing
personal data required for a single pass
the subject of personal data to the territory on which it is located
operator, or for other similar purposes, must be observed
the following conditions:
a) the need to maintain such a journal (register, book)
should be provided for by the operator's act containing information about
the purpose of the processing of personal data, carried out without
use of automation tools, methods of fixation and composition
information requested from subjects of personal data,
list of persons (by name or position) who have access to
material carriers and those responsible for maintaining and preserving
journal (register, book), terms of processing personal data, and
also information on the procedure for passing the subject of personal data to
the territory in which the operator is located, without confirmation
authenticity
personal

personal

data,

reported

data;
b) copying contained in such journals (registers,
books) information is not allowed;
c) personal data of each subject of personal data
can be entered in such a journal (book, register) no more than one
times in each case of a pass of the subject of personal data for

Page 6

the territory in which the operator is located.
9. If the purposes of processing personal data are incompatible,
fixed on one material medium, if the material
the carrier does not allow the processing of personal data
separately from other personal
data, measures should be taken to ensure that the
processing of personal data, in particular:
a) if necessary, use or distribution
certain personal data separately from those located on the same
the material medium of other personal data is carried out
copying of personal data subject to distribution or
use, in a way that excludes simultaneous copying
personal data not subject to dissemination and
use, and a copy is used (distributed)
personal data;
b) if necessary, the destruction or blocking of a part
personal data is destroyed or material is blocked
media with preliminary copying of information not subject to
destruction
simultaneous

or

blocking, in a way that excludes

copying of personal data subject to destruction or
blocking.
10. Destruction or depersonalization of a part of personal data,
if allowed by the material medium, it can be made
in a way that excludes further processing of these personal
data while maintaining the possibility of processing other data,
fixed on a material medium (deletion, extinction).
11. The rules provided for in paragraphs 9 and 10 of this

Page 7

The provisions also apply if it is necessary to ensure
separate processing fixed on one material
carrier of personal data and information that is not
personal data.
12. Clarification of personal data in the implementation of them
processing without the use of automation is performed
by updating or changing data on a tangible medium, and
if this is not allowed by the technical features of the material
carrier - by fixing on the same material carrier
information about the changes made to them or by making
a new material medium with updated personal data.

III. Measures to ensure the security of personal data during their
processing carried out without the use of automation

13. The processing of personal data, carried out without
use of automation tools should be carried out in such a way
so that with respect to each category of personal data
it was possible to determine the storage location of personal data
(material carriers) and establish a list of persons carrying out
processing of personal data or having access to them.
14. It is necessary to provide separate storage of personal
data (material carriers), the processing of which is carried out
for various purposes.
15. When storing tangible media, the
conditions to ensure the safety of personal data and
excluding unauthorized access to them. List of measures
necessary to ensure such conditions, the procedure for their acceptance, and

Page 8

also a list of persons responsible for the implementation of these measures,
set by the operator.

____________

subject

