Proper personal data processing: how to classify and protect data and stay compliant with Federal Law GDPR

70% of CIS companies process personal data in violation of the rules. The main cause of problems is not malicious intent, but employee mistakes, people who simply do not know how to work with personal data correctly under the law. Here is how businesses can bring order to personal data handling: what exactly counts as personal data, how to classify it, on what grounds to collect it, and what to do to avoid fines.

Personal data- any information that identifies a person. This includes not only a passport and SNILS, but also an IP address, location coordinates (geolocation), and online activity history if they are tied to a specific user. Examples of personal data in business: - full name, taxpayer ID, passport details; - contact phone number, email address, legal/registered address; - bank details; - workplace, job title.

If at least one of these items helps identify the client, it is personal data, and you are required by law to protect it. Not personal data: - Anonymous data that cannot be linked to a person. - Aggregated data without specifics, such as average order value. - General work contacts like info@company.ru. Why companies need to classify personal data correctly Not all personal data is equally sensitive. The law divides it into categories, and each category has its own level of protection.

Correct classification helps: - Avoid overloading business processes with unnecessary measures. - Avoid fines for mishandling sensitive data. Main categories of personal data:

Important! Assigning data to the correct category is the operator's (company's) responsibility. A classification mistake, such as mishandling biometric or special data, leads to the most serious fines and reputational risks.

Understanding the law is important. But the main thing is knowing how to apply it in practice. Here is a simple process that will help your company build a safe and legally compliant personal data processing system. Step 1. Find a lawful basis for each operation Collecting data "just in case" is not allowed. Each purpose must have a specific basis under Federal Law GDPR: - Customer consent - when the person has explicitly allowed the information to be used.

Consent must be separate, clear, and voluntary. - Performance of a contract with the data subject- for example, user registration or product delivery. Consent is not required here. - Under the law - if the data is needed for tax accounting, employment, military registration, and so on. - In emergencies - to protect life or health, for example when sharing medical data with a doctor. Example: A store collects a name, address, and phone number for delivery - this is contract performance.

To send advertising to the customer later, you need separate consent. You cannot combine everything into one checkbox. Step 2.

Obtain consent correctly. A consent form is a legal document that must include: - The company's name and contact details. - A clear list of the data collected. - Specific purposes (for example: "newsletters", "creating a personal account"). - How you process the data - manually and/or automatically. - The consent period and the withdrawal procedure. Important: Do not pre-check the consent box by default - the user must give permission themselves. Step 3.

Publish the Personal Data Processing Policy in a publicly accessible place. The policy is a public document where you explain how you handle data. Include: - the purposes of processing; - what information you collect; - who you may share it with (for example, a delivery service); - customer rights and how to exercise them. A policy is not consent. It is needed for transparency, while consent is needed for lawful processing. Step 4.

Notify the supervisory authority about the start of personal data processing. A company that processes personal information must submit the relevant notice to Roskomnadzor. The fine for failing to do so can reach 300,000 rubles. To submit the notice: 1. Fill out the form - the standard form can be downloaded from the Roskomnadzor website. 2. Send a notification - through the Roskomnadzor website, Gosuslugi, or by mail to your local Roskomnadzor office. 3. Wait for confirmation - the review usually takes up to 30 days.

After that, your organization will be added to the registry of operators that process personal data. Know the exceptions: You do not need to notify Roskomnadzor in only a few cases, for example if you process data only of your own employees for labor relations or if the processing is carried out entirely without automation tools (manually).

Step 5. Protect data in practice, not just on paper. Security has 3 levels: organizational measures, technology, and documents. - Organizational measures: appoint a person responsible for personal data, create instructions, and train the team, especially marketing and support. - Technique:use HTTPS, keep software updated, encrypt databases with sensitive data, restrict access, and make backups. - Localization: data of CIS citizens must be stored in CIS.

Even if you use cloud services.

Step 6. Set up intake and handling of customer requests. Customers can: - find out what you store; - correct or delete data; - withdraw consent. To avoid missing deadlines and losing credibility: - create a separate email address or a website form; - define a procedure - who is responsible, when, and how; - prepare email templates (confirmation, deletion, refusal, etc.). The legal response period is 30 days.Better, faster: 10-15 days. Step 7.

Audit and contractors - Audit: At least once a year, check how the information is actually processed. Update the purposes, data set, and processes. Contractors: if you share data with someone (an email service, a call center), make sure you have a contract and they have proper safeguards.

When a company has millions of customers and employees, a mistake in data protection can be extremely costly. Below are two cases showing how CIS businesses are moving from a formal approach to real, systemic protection. X5 Group: how a breach became the trigger for reforms Situation: In 2022, the retailer had a leak of applicant data. The cause was a contractor, but X5 was still responsible.

The incident exposed weaknesses in the control system and became the starting point for major changes. Solution:comprehensive security reinforcement - the company deployed software solutions (DLP) that track and block attempts to copy or send information without authorization in real time. At the same time, it carried out large-scale employee training at all levels - from frontline staff to management - on personal data handling rules.

They also reviewed work with contractors: the contracts now include clear information security requirements and penalties for violations. Result: - Reduced the risk of repeated leaks and multimillion-ruble fines. - Restored customer trust by showing a serious approach to security. - Improved data-handling discipline from top management to cashiers. How an industrial giant protected the data of 20,000 employees Situation: A large industrial holding with tens of thousands of employees was operating on outdated processes.

Data was stored in different places, breaches were discovered after the fact, and there was almost no control.

This made it difficult to pass inspections and take part in tenders. Solution: the partner team implemented comprehensive personal data protection, namely: - Set up a single center for monitoring and controlling personal data and appointed a responsible person with access to management. - Launched proactive leak monitoring: the system scans the dark web and public sources on its own for any appearance of company data. - Conducted full audit: where and how the data is stored, and who has access to it.

Set up access control (DAM). - Introduced automatic anonymization in test environments - now real data does not reach developers. - Required all employees to complete information security training. Result: - Significantly reduced the number of incidents. - Gained an advantage in negotiations with partners and banks: a secure business is an attractive business. - Lowered incident response costs: instead of dealing with consequences, they now focus on prevention. The cases show: Investing in proper personal data handling is not a cost, but an investment in business resilience.

Companies that implement protection technologies, audit data, and train employees not only reduce the risk of breaches and fines, but also increase trust in the business. This directly affects reputation, speeds up deals, helps pass inspections, and opens the way to new contracts.