The company was tasked with swiftly aligning its processes with the Federal Law No. 152 "On Personal Data" due to legislative amendments.
Specifically, the company initiated an update of the organization's personal data processing and protection, as well as the responsibility of its divisions for the processing and storage of personal data. The client also set the goal of updating and preparing organizational documents.
To address these issues, the company sought the expertise of ICL Services.
Key Challenges
- Audit the client's processes and internal documents for compliance with the Federal Law No. 152 "On Personal Data" and its bylaws.
Implemented our solution
The project commenced in August 2023 and was carried out in three stages.
1. Audit of processes and documents
Initially, we performed an audit that included interviewing client representatives and analyzing existing internal documents on personal data processing.
2. Identification of information systems for personal data (ISPDn)
Subsequently, the ICL Services team identified the client's existing information systems for personal data (ISPDn). For each system, the processing objectives, the composition of processed personal data, and other characteristics were clarified, and the risks and threats to ISPDn were reassessed.
3. Assessment of non-compliance and risks
We identified development areas necessary for compliance with Russian law, determined their criticality and risk level, enabling the client to prioritize improvements to their system and ensure personal data protection from a legal standpoint.
Moreover, upon completion of the main work, our experts provided the client with specific recommendations for enhancing and improving the efficiency of existing processes, measures, and protective means.
The work of ICL Services not only helped the client identify areas for development in personal data processing but also provided specific recommendations for enhancing their efficiency and effectiveness.
The company can now initiate actions to ensure full compliance with the requirements of the Federal Law No. 152, minimizing risks during regulatory inspections and potential personal data leaks.
Results
- Conducted an examination and evaluation of the client's current personal data processing procedures.
- Assessed the risks associated with non-compliance with the requirements of the Federal Law No. 152 and provided a comprehensive report.
- The client was able to allocate resources to enhance areas of development and increase the efficiency of processes, measures, and protective means (time-wise).
- The client has allocated funds for a project aimed at aligning the personal data protection system with legal requirements.
Services provided
Expert on implementing and supporting information security solutions