12.1. When processing personal data, the Organization implements the necessary legal, organizational, and technical (software and hardware) measures to protect personal data against unauthorized or accidental access, destruction, modification, blocking, copying, disclosure, dissemination, and other unlawful actions.
12.2. The Organization's Personal Data Protection Policy is implemented through legal, organizational, and technical measures, including, but not limited to:
- identifying the categories of personal data processed by the Organization;
- identifying the persons authorized to process personal data;
- granting access to personal data exclusively to duly authorized personnel;
- appointing responsible persons for organizing personal data processing, for the conditions that ensure the safety of personal data and prevent unauthorized access to them, and for maintaining the security of personal data within the information system;
- adopting internal regulations governing personal data processing, as well as internal procedures aimed at preventing and detecting violations of the legislation of the Russian Federation and mitigating the consequences of such violations;
- assessing the potential harm that may be caused to personal data subjects in the event of violations of the Federal Law of the Russian Federation “On Personal Data”, comparing such harm with the measures implemented by the Operator to ensure compliance with the obligations set out in that federal law;
- conducting internal monitoring and/or audits to verify compliance of personal data processing with the Federal Law of the Russian Federation “On Personal Data”, the regulations adopted pursuant thereto, the requirements for personal data protection, this Personal Data Processing Policy, and the Organization's internal regulations;
- designating locations for the processing and storage of physical media containing personal data;
- ensuring that employees directly involved in personal data processing are familiar with the legislation of the Russian Federation on personal data, including personal data protection requirements, with the documents that set out the Organization's personal data processing policy and with its internal regulations on personal data processing, and providing training for such employees where necessary;
- using software products that comply with personal data protection requirements;
- identifying the types of personal data security threats relevant to the information system;
- timely detection of personal data security threats and implementation of appropriate protective measures;
- using information security tools that have successfully undergone the required conformity assessment procedures;
- maintaining backup copies of information resources;
- approving the list of personal data information systems;
- maintaining records of machine-readable media containing personal data;
- timely detection of unauthorized access to personal data and implementation of appropriate response measures;
- implementing other measures that do not conflict with the legislation of the Russian Federation.
Current version as of 13 August 2025