152-FZ compliance turnkey
A full audit of personal-data processing, a risk map and a documentation package to pass Roskomnadzor inspections - ahead of the new turnover-based fines and criminal liability.
Any personal-data operator. If a company collects data of clients, employees or users, it must comply with 152-FZ, file a notification with Roskomnadzor and appoint an officer responsible for organising personal-data processing.
Since 30.11.2024 (FZ-420) the maximum fine for a major data leak is up to 18 mln rub., and for a repeat offence a turnover-based fine of up to 3% of revenue. Criminal liability has been introduced for the illegal handling of personal data (Art. 272.1 of the Criminal Code). The deadline to notify Roskomnadzor of an incident has been cut to 24 hours.
The audit and preparation of the document package take 4-6 weeks: weeks 1-2 - diagnostics, 3-4 - gap analysis and risks, 5-6 - documents and the Roskomnadzor notification. The exact schedule is fixed after the express diagnostics.
8-12 internal policy documents: the personal-data processing policy, a regulation, procedures, instructions, registers of personal data, consent templates, the personal-data system classification act (protection levels 1-4) and a prepared notification to Roskomnadzor.
Yes. We prepare or update the personal-data processing notification and help appoint the officer responsible for organising processing. Preparing the notification is part of the full audit.
Yes. Support is available on a retainer basis: updating the policies, monitoring compliance and supporting Roskomnadzor inspections, including the procedure for notifying of incidents within 24 hours.