App. No. 3 to MSU Order No. 1030 August 24, 2017

REGULATION ON PERSONAL DATA PROCESSINGMoscow, 2017

CONTENTS

1.

GENERAL PROVISIONS ...................................................................................................... 32.

SUBJECTS AND PURPOSES OF PERSONAL DATA PROCESSING ............................... 4

3.

PERSONAL DATA PROCESSING ....................................................................................... 4
3.1 Persons responsible for personal data processing ......................................................... 4
3.3 Receiving of personal data ............................................................................................. 5
3.4 Filing, specification and use of personal data ............................................................... 5
3.5 Transfer of personal data ............................................................................................... 5
3.6 Storage of personal data................................................................................................. 5
3.7 Personal data processing notice..................................................................................... 6

4.

SPECIFICS OF THE ORGANIZATION OF PERSONAL DATA PROCESSINGCARRIED OUT WITHOUT USE OF AUTOMATION MEANS ......................................... 6

5.

PERSONAL DATA PROTECTION ....................................................................................... 7

6.

PROCEDURE FOR PROCESSING APPLICATIONS AND INQUIRIES ON
PROCESSING OF PERSONAL DATA ................................................................................. 8

7.

FINAL PROVISIONS ............................................................................................................. 82

1.

GENERAL PROVISIONSThe Regulation on the Processing of Personal Data at Lomonosov Moscow State University(hereinafter referred to as the Regulation) are developed in accordance with Federal Law of July 27,
2006 No. 152-FZ “On Personal Data” (hereinafter referred to as FZ-152), the Labor Code of theRussian Federation (hereinafter referred to as the TK RF), as well as with the List of ConfidentialInformation approved by the Decree of the President of the Russian Federation of March 6, 1997
No. 188.
This Regulation determines the procedure for personal data processing, and establishes general
requirements for ensuring the security of personal data processed at Lomonosov Moscow State
University (hereinafter referred to as the Operator) both with the use of automated means and without
such use.
In this Regulation, following terms and definitions are used:automated processing of personal data – computer-assisted processing of personal data;

blocking of personal data – temporary suspension of the processing of personal data (except forcases where processing is necessary to specify personal data);

personal data information system – personal data contained in a database as well as
information technologies and hardware used for data processing;

anonymization of personal data – actions performed on personal data that do not permit theidentity of the individual concerned to be verified solely from such anonymized data;processing of personal data – any operation or a set of operations performed manually or using
automated means, including collection, recording, systematization, accumulation, storage,specification (updating, amendment), retrieval, use, transfer (distribution, provision, access),depersonalization, blocking, deletion, and (or) destruction of personal data;

operator – state agency, municipal agency, legal entity or individual, who independently or
jointly with the other persons organizes and (or) processes personal data, as well as determines
the purposes and scope of personal data processing, and the set of activities (operations) applied
to personal data;

personal data – any information referring directly or indirectly to a particular or identified
individual (the subject of personal data);

provision of personal data – actions aimed at disclosing personal data to a definite person or adefinite range of persons;distribution of personal data – actions aimed at disclosing personal data to an indefinite rangeof persons (transfer of personal data) or at acquaintance with the personal data of an unlimited
number of persons, including the disclosure of personal data in the media, its posting in3

information and telecommunication networks or providing access to personal data in any otherway;

cross-border transfer of personal data – transfer of personal data to a foreign state agency, foreign
legal entity or individual located in a foreign state;destruction of personal data – actions performed on personal data contained in the respective
database that prevent such data from being restored and (or) actions aimed at the physical destructionof the tangible medium of personal data.

This Regulation shall be applied to all structural divisions of Lomonosov Moscow State University.
This Regulation is to be communicated to each employee of the Operator, who processes personaldata, against his acknowledgement of receipt.
2.

SUBJECTS AND PURPOSES OF PERSONAL DATA PROCESSING

Purposes for personal data processing, reasons for its processing, possible activities (operations)applied to personal data, timescales for personal data processing, and the composition of thecategories of personal data processed by the Operator are indicated in the List of processed personaldata.
3.

PERSONAL DATA PROCESSING

3.1 Persons responsible for personal data processing
In order to organize the processing of personal data, the Operator appoints a responsible person.
To determine the level of security of personal data information systems, to check the readiness ofinformation security tools to secure personal data, as well as for the destruction of personal data, thehead of the Operator by an order appoints a Commission for compliance with the requirements of thelegislation of the Russian Federation in the field of personal data (hereinafter referred to as theCommission).
The Commission is guided by the Regulation on the Commission for compliance with therequirements of the legislation of the Russian Federation in the field of personal data, approved by theorder of the head of the Operator.
3.2

Access of employees to the processing of personal data

The admission of the Operator’s employees to the processing of personal data is carried out based on
the appointment order in accordance with the List of positions and third parties authorized to accesspersonal data.
4

The Operator’s employees get the access to processing of personal data in order with their official(labor) duties after completing the following operations:familiarization against personal signature with the Operator’s guidelines and regulations of theRussian Federation on the processing and security of personal data;registration of a written commitment not to disclose personal data, the form of which is approvedby the order of the management of the Operator.

Operator employees authorized to access personal data have the right to receive only the personal dataneeded to perform their official (labor) duties.
3.3 Receiving of personal data
The personal data of the subject shall be received from the subject directly or from his legal
representative. In the event that the personal data is not received from the subject of personal data
directly, the Operator is obliged to notify the subject of the receipt of his personal data before
personal data processing.
3.4 Filing, specification and use of personal data
Filing, accumulation, specification and use of personal data is carried out through the preparation andmaintenance of accounting documents and databases of personal data subjects.
The Operator’s employees admitted to personal data must ensure their processing with the exclusionof unauthorized access to personal data by third parties.
3.5 Transfer of personal data
The transfer of personal data of subjects to third parties can be carried out only with the written consent
of the subject, except as otherwise permitted by federal legislation.
The transfer of personal data of subjects to third parties requires an Agreement with the third party oncompliance with the safety of personal data transferred for processing, the form of which is approvedby order of the head of the Operator.
The transfer of personal data of subjects between the divisions of the Operator should be carried out
only between employees admitted to the processing of personal data.
3.6 Storage of personal data
The storage of personal data of subjects is carried out on paper and computer media in speciallyallotted repositories of the Operator’s divisions, as well as in the Operator’s information systems,
5which ensure the safety of personal data and their protection from unauthorized access.
The destruction of personal data in information systems, on machine and paper media must be carriedout within thirty days from the date of achievement of the purpose of processing (maximum storageperiod) of personal data. Should the destruction of personal data within thirty days from the date ofachieving the purpose of processing personal data be impossible, the blocking and destruction of such
personal data is ensured within a period not exceeding six months.
The procedures and rules for recording, storage and destruction of personal data are described in theRegulation for the recording, storage and destruction of personal data carriers.
3.7 Personal data processing notice
In accordance with Art. 22 of FZ-152, the Operator notifies the Authorized Agency for the Protectionof the Rights of Personal Data Subjects about the processing of personal data.
In case of change of the information specified in the notification, as well as in case of termination ofthe processing of personal data, the Operator notifies the Authorized Agency.
4.

SPECIFICS OF THE ORGANIZATION OF PERSONAL DATA PROCESSING CARRIEDOUT WITHOUT USE OF AUTOMATION MEANS
Personal data processed manually should be separated from other information via fixation on separate
tangible media, in special sections or in the form fields.
When fixing personal data on tangible media, it is not allowed to record on the same tangible medium
personal data, the processing purposes of which are obviously incompatible. When processing various
categories of personal data without using automation tools, a separate tangible medium must be used
for each category of personal data.
In standard forms of documents, the nature of the information in which suggests or allows theinclusion of personal data, the following conditions are to be observed:
the standard form must contain information on the purpose of personal data processing, the nameand address of the Operator, last name, first name, patronymic and address of the subject of personaldata, the source of receipt of personal data, the processing time of personal data, the list of operations
with personal data that will be performed in processing, a general description of the methods of
personal data processing used by the operator;
the standard form is to provide for a field for a signature of consent to personal data processing of6

the subject of personal data when written consent to the processing of personal data is necessary;the standard form is to be drawn in a way to allow for each of the subjects of personal datacontained in the document to get acquainted with their personal data contained in the document
without violating the rights and legitimate interests of other subjects of personal data;the standard form is to exclude the combination of fields intended for entering personal data, theprocessing purposes of which are obviously incompatible.
In the event that the purposes of the processing of personal data recorded on one material medium areincompatible, if the tangible medium does not allow processing personal data separately from otherpersonal data recorded on the same medium, measures should be taken to ensure the separate
processing of personal data.
It is necessary to ensure the separate storage of personal data, the processing of which is carried out
for various purposes.
The destruction or depersonalization of a part of personal data, if allowed by tangible medium, can becarried out in a way that excludes further processing of the personal data while preserving thepossibility of processing other data recorded on a material medium.
Specification of personal data during its processing without the use of automation tools is carried out
by updating or changing the data on the tangible medium, or, in the event that is not allowed by thetechnical specifications of the tangible medium, by logging the record of all changes on the sametangible medium, or by creating a new tangible medium with the updated personal data.
Persons processing personal data without the use of automation tools are to be informed of:the fact of personal data processing that is carried out without the use of automation tools;

the categories of processed personal data;the specifics and rules of personal data processing without the use of automation tools.

5.

PERSONAL DATA PROTECTION

Personal data is processed by the Operator both using automation tools and without their use.
The procedure for processing and protecting personal data in the information systems of theOperator is determined by the Regulation on ensuring the security of personal data.
Protection of personal data against unauthorized use or loss is provided by the Operator at hisexpense.
7

The Operator’s employees who, as part of their job duties, have access to personal data, are obliged
to observe the confidentiality of personal data at all stages of their processing.
In the absence of an employee engaged in personal data processing there should be neither
documents nor tangible media containing personal data at his workplace.
Access of the Operator’s employees and other persons to the premises were personal data is stored islimited by organizational measures and the use of an access control system.
Given the massiveness and common places of processing and storage, the “Confidential” marking is
not applied to the documents containing personal data.
Organization of the processing of personal data of subjects and control of compliance with measuresof their protection in the structural divisions of the Operator, whose employees are engaged inpersonal data processing, are carried out by their immediate supervisors.
Measures for the protection of personal data are carried out in accordance with the Action Plan tobring it in compliance with the requirements of the legislation of the Russian Federation in the fieldof personal data, approved by the head of the Operator.
Development and implementation of measures to ensure the security of personal data processed in
information systems can be carried out by third-party organizations licensed for personal dataprocessing on a contractual basis.
6.

PROCEDURE

FORPROCESSINGAPPLICATIONSANDINQUIRIESONPROCESSING OF PERSONAL DATA
The procedure for processing requests from the subjects of personal data is described in theRegulation on responding to requests from subjects of personal data.
The procedure for processing requests from authorized bodies in the field of personal data is
described in the Regulation on interaction with public authorities in the field of personal data.
7.

FINAL PROVISIONSOther rights and obligations of employees involved in personal data processing are determined by the
User’s Manual of personal data information systems.
Persons guilty of violating the rules and requirements regulating the processing and protection of
personal data bear material, disciplinary, administrative, civil or criminal liability in accordance withthe procedures established by federal laws.
8

Disclosure of personal data, loss of documents and other media containing personal data, as well asother violations of the obligations for protection an processing of personal data established by theseRegulations, other local regulations (orders, orders) of the Operator, entails imposing on an employee
engaged in personal data processing disciplinary sanctions – warning, reprimand, or dismissal.
In the event shall an employee involved in personal data processing commits the aforesaid
disciplinary offense, he bears full financial responsibility of damage caused to the employer by hisactions (Clause 7 of Art. 243 of TK RF).
Operator’s employees who have access to personal data, guilty of their illegal disclosure or use
without the consent of the subjects of personal data out of personal interest or of mercenary motives
and causing major damage, are criminally liable in accordance with Art. 183 of the Criminal Code ofthe Russian Federation.
The amendment of this Regulation shall be is carried out in accordance with the Regulation forsupervisory measures and responding to information security incidents.

9