Starting from September 2022 Russian companies need to file more reports on personal data.
Previously, companies that processed personal data in most common cases should have not provided any reports on that.
From now on, a company shall notify the Russian personal data authority (Roskomnadzor) on its intention to process personal data also in the following common cases:
- for employment relations,
- for execution of contracts,
- for visitors’ passes,
- if personal data is processed by a social or religious organization,
- if processed personal data is allowed for disclosure by its owner,
- if personal data contains name and surname only.
The notification shall include: name and address of the company; name of the person responsible for personal data processing; measures taken by the company to secure the personal data; start and duration of processing; information about cross-border transmission of personal data; location of the database; categories of personal data and methods of processing, etc.
Notifications are filed electronically. After the notification Roskomnadzor will enter the company into the register of personal data operators. If a company processes personal data without a computer (on paper only), it shall not report to Roskomnadzor.
Please contact mlegal to comply with the new personal data regulations and avoid penalties.