Versions: Law No. 99-Z of 7 May 2021, as amended by Laws No. 175-Z and No. 134-Z; OAC Order No. 66, as amended, including by Orders No. 259, No. 98 and No. 102.
This guide is not a legal opinion. The requirements are summarized closely to the official Russian text; the exact wording is in the official publications listed under "Sources". Whether your organization processes personal data, which class its information systems have and which measures apply is for your legal team and responsible officers to decide.
In short
- Law No. 99-Z requires the operator to take legal, organizational and technical measures to protect personal data (Art. 17).
- The law itself does not list technical measures: technical and cryptographic protection follows the procedure set by the OAC, according to the classification of information systems (Art. 17, item 3, paragraph six). That procedure is OAC Order No. 66.
- The operator notifies the authority of breaches of personal data protection systems without delay, no later than three working days (Art. 16).
Who must protect the data
- The operator: an organization or person that processes personal data. It must ensure their protection during processing (Art. 16, item 1).
- The authorized person: processes personal data on the operator's behalf and must also take protective measures (Art. 17, item 1).
Data must be protected against unauthorized or accidental access, modification, blocking, copying, distribution, disclosure and deletion, and against other unlawful actions (Art. 17, item 1).
Which measures the law makes mandatory
Article 17 lists mandatory measures (item 3). They include:
- a procedure for access to personal data;
- technical and cryptographic protection under the procedure set by the OAC, according to the classification of information resources (systems).
The full list of mandatory measures is in the text of Article 17.
Where the technical requirements are: OAC Order No. 66
Order No. 66 sets the procedure for technical and cryptographic protection of restricted information, including personal data. Annex 3 to the Regulation on technical and cryptographic protection lists the requirements by typical information system class: "+" means mandatory, "+/–" means recommended.
The system class is determined under Order No. 66, and it decides which measures are mandatory. Below are the requirements most often relevant to systems that hold personal data.
| Measure (Order No. 66 list) | Mandatory for |
|---|---|
| Change default credentials (para. 4.1) | All classes |
| Identification and authentication (para. 3.2), lock after inactivity (para. 3.7) | Mandatory |
| Multi-factor authentication (para. 5.6) | Recommended ("+/–") for all classes |
| Software updates and control of their timeliness (para. 7.8) | All classes |
| Collect and keep security event records for at least a year (para. 1.2) | Mandatory |
| Centralized event collection and storage (para. 1.3) | 3-ин, 3-спец, 3-бг, 3-юл, 3-дсп |
| Information flow control (para. 7.11), firewalling of internal and external traffic (para. 7.12) | 3-ин, 3-спец, 3-бг, 3-юл, 3-дсп; recommended for classes 4-* |
| Intrusion detection and prevention (para. 7.13), control of external connections (para. 7.16) | 3-ин, 3-спец, 3-бг, 3-юл, 3-дсп |
| Management network isolated from the data network (para. 7.9) | 3-ин, 3-спец, 3-бг, 3-юл, 3-дсп |
| Encryption in transit over public telecom networks (para. 5.1) | 3-ин, 3-спец, 3-бг, 3-юл, 3-дсп |
Class codes are kept in Cyrillic, as in the Order.
Cryptography. Cryptographic protection tools must meet the state standards linked to TR 2013/027/BY. So check whether your encryption tools meet these standards: a configured TLS does not guarantee it by itself.
Notification deadlines
| Who | To whom | Deadline | Basis |
|---|---|---|---|
| Personal data operator | Authority for the protection of data subjects' rights | Without delay, no later than 3 working days | Law No. 99-Z, Art. 16 |
| Information system owner | OAC | Within 24 hours of detecting a security event | Order No. 66, para. 4.4 of the Regulation on submitting information |
The same breach may require both notifications. Without event logs neither is possible: the breach simply goes unnoticed. All reporting deadlines are collected in the Decree No. 40 guide.
What can be checked technically
Some measures are visible when you scan your own infrastructure:
- a database reachable from the internet: firewalling and control of external connections; if it holds personal data, also potential non-compliance with the duty to protect it from unauthorized access (Art. 17);
- outdated protocols and ciphers, invalid certificates on services that carry the data: protection in transit (para. 5.1);
- default passwords, services without authentication: paras. 4.1 and 3.2;
- outdated software: para. 7.8.
What is in the database, the system class, the access procedure and log retention are not visible to a scanner; they are proven by documents. What a scanner can and cannot see is covered in SGRC or vulnerability scanner.
How Cyber-Cortex helps
Cyber-Cortex maps technical findings to the paragraphs of Decree No. 40, OAC Orders No. 130 and No. 66 and Law No. 99-Z, and to ISO/IEC 27001, NIST CSF 2.0 and CIS Controls, with an explanation of why. Example: a database reachable from the internet is linked to the firewalling requirements and, if it holds personal data, to Art. 17 of Law No. 99-Z. Findings indicate potential non-compliance; the conclusion is for your organization's responsible officer.
Terms are explained in the glossary.