Personal Data Protection under Federal Law No. 152
We ensure compliance with the requirements of Federal Law No. 152 “On Personal Data,” including all related regulations and amendments introduced by Federal Law No. 242.
Eliminate risks
Eliminate risks
Our Services
-
Personal Data Protection (FL-152)
We implement solutions and processes that meet all legal requirements: audit, threat modeling, development of personal-data processing policies, and employee training. -
Critical Information Infrastructure Protection (FL-187)
Comprehensive CII protection: categorization, technical and organizational measures - all turnkey. -
Compliance with Russian Legislation
We create and implement information-protection systems for financial institutions and other sectors, taking into account current regulations and reporting requirements. -
Prevention of Confidential Data Leaks
We identify risks and implement DLP systems and monitoring to protect critical information. -
Cloud Service Security
We audit cloud infrastructures, encrypt data, configure access control, and develop recommendations for secure use. -
Outsourcing of Personal-Data Protection and Information-Security Functions
We provide a qualified external specialist who will handle information-security support, legal compliance, and interaction with regulatory authorities.
Your company processes personal data if its website contains:
- A contact form
- Cookies
- A personal account
- Social-media integration
- A dynamic IP address
- Analytics services
Your company meets the following criteria:
- It has one or more employees
- It conducts surveys or research among its clients
- It uses a CRM system
- It uses electronic document management (KEDO)
- It has partner programs
- It stores information in Google Docs
By Contacting IT Novation for Personal-Data Protection, You Receive:
Compliance with FL-152
Comprehensive solutions ready for inspections
Time and resource savings for your company
A reduction in the risks of data leaks and financial losses by up to 98%
An individual approach tailored to your tasks and business characteristics
Peace of mind and confidence in data security
A complete package of documents for inspections and certifications
Liability for Violating Personal-Data Processing Requirements
Ensure lawful and reliable personal-data protection with IT Novation — minimize risks and build a solid foundation of trust with your clients.
FAQ
Personal data is any information relating directly or indirectly to an identified or identifiable individual (a personal-data subject). This may include a first name, last name, address, phone number, and other information that makes it possible to identify a person.
The supervisory authorities in the field of personal-data security are Roskomnadzor, the FSB, and the FSTEC of Russia.
A subject has the right to receive confirmation that their data is being processed, information about the source of the data, the purposes and methods of processing, and the processing period. They may withdraw consent to processing at any time.
No. Under the law, consent must be given in writing.
Organizations must ensure the confidentiality, integrity, and availability of personal data. This includes the use of technical protection tools, such as encryption and firewalls.
Personal-data processing means any action or set of actions performed with personal data, including collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer, anonymization, blocking, deletion, and destruction.
Personal data may be transferred to third parties only with the consent of the data subject, unless otherwise provided by law. The operator is responsible for the recipient’s actions.
Fines may range from RUB 150,000 to RUB 500,000 for legal entities for violating the purpose and scope of data processing. For data leaks, fines may reach 3% of revenue, but not less than RUB 25 million and not more than RUB 500 million.
Required documents include a personal-data processing policy, a harm assessment, a threat model, technical specifications for a protection system, and instructions for employees.
Consent to personal-data processing may be withdrawn at any time, without any conditions or justification.
Roskomnadzor conducts an unscheduled inspection if a client files a complaint or a data leak occurs. It is better to prepare in advance than to pay fines.
Certification is mandatory if you store data in government systems (for example, healthcare institutions). In other cases, it is optional.
It is recommended to audit the personal-data processing system at least once a year, as well as when significant changes are made to data-processing processes or when legal requirements change.
© IT Novation Company. All rights reserved.
Codes for types of activity in the field of information technology:
1.01; 1.08; 2.01; 4.01; 11.01; 27.01; 28.01.
1.01; 1.08; 2.01; 4.01; 11.01; 27.01; 28.01.
About us
Services
Our solutions for business
DocShell 4
В реестре отечественного ПО №5835 от 20.09.2019
В реестре отечественного ПО №5835 от 20.09.2019
Feedback form
We process cookies to make our website more user-friendly for you.
Configure cookies
Cookies that are essential for the website to function correctly are always enabled.
Other cookies can be configured.
Other cookies can be configured.