That Roskomnadzor did not come suddenly

Again, lawmakers improve our life! The portal of legal information published the Decree of the Government of the Russian Federation dated February 13, 201 No. 146 “ On Approval of the Rules for Organizing and Executing State Control and Supervision of the Processing of Personal Data ”.

It establishes the procedure for organizing and conducting checks of personal data operators. The rules do not apply to monitoring the implementation of organizational and technical measures to ensure the security of personal data. It is clear that the responsibility to control and supervise was assigned to Roskomnadzor. He will have to adjust his tight schedule now.

Supervision will be in four forms:

• will be scheduled and suddenly checked;
• will not allow and eliminate the consequences of violations;
• will be controlled without contacting the operators;
• will do prevention violations.

Usually checked no more than once every three years. It happens, not more often than once every two or even one year under the following conditions:

• if the operator processes personal data in the State Information System;
• collects biometric and special personal data categories;
• transfers data abroad without protecting the rights of the owners of this data;
• processes data in the service of a foreign government agency, a foreign legal entity, a foreign individual who is not registered in our country.

If a violation has been identified, and the operator has not completely corrected everything, citizens are complaining, and the prosecutor demands, then the test will suddenly come to a head. If the head of Roskomnadzor reads the denunciation of the jambs revealed without an operator, consider that everything will be unexpected again.

But if everything goes according to plan, Roskomnadzor will notify no later than three working days before the start of the inspection. Something went wrong - you will have only 24 hours to calm down and prepare for the check. Scheduled inspection should be no longer than 20 business days, although in rare cases, everything can be. Sudden check lasts 10 business days.

Documents are checked by receiving them from the operator. Suddenly they are not checked. The operator issues documents within 5 days of receipt of the request.

After write the act of verification. At the exit in the operator's magazine they write that they checked everything. If there is no such sign yet, they will write about it in the act. So be sure to prepare it. At the bottom of the act indicate what exactly is broken. If not violated, write that everything is ok.

When control without an operator:

• when monitoring compliance with the requirements for posting information on the Internet and the media;
• when analyzing information about the activities of the operator and see if the operator complies with the requirements.
• For prevention, Roskomnadzor must:
• post a list of requirements on your website;
• inform operators about how things are going in the field of protecting the rights of owners of personal data;
• sum up the checks for the year;
• report on your site about the most frequent violations;
• post instructions on how not to mess up with information on holding seminars, conferences and banquets;
• describe the requirements of legislation in human language in the media and in other ways;
• Stitch operators that you can not break anything.

You can check whether everything is fine, now. Roskomnadzor laid out the relevant requirements here .