The project client is a large Russian educational organization specializing in supplementary professional education, part of a major corporate group headquartered in Moscow.
The company needed to conduct an annual audit of its personal data processing activities, engaging an independent external integrator.
A previous audit performed by another contractor had left behind numerous non-compliance issues and outdated documentation. The company found that the 17 declared personal data processing processes did not reflect its actual operational activities.This created risks during inspections by Roskomnadzor and hindered effective process management.
Thus, it was necessary to bring the documentation up to standard and obtain practical recommendations for optimizing all processes. Key Challenges
- Conduct interviews with all organizational units to identify personal data processing activities.
- Update the register of PD processing activities and ensure its compliance with applicable legislation.
- Develop and update the set of organizational and administrative documents, including the Personal Data Processing Policy.
- Conduct an inventory and risk assessment related to PD processing.
- Populate the internal Compliance Platform automation tool with up-to-date data.
- Address findings previously issued by the parent organization's cybersecurity department.
- Prepare a report with recommendations for process optimization and enhancing information security maturity.
Implemented our solution
- The project was divided into several stages.
Assessment and Planning
In the first stage, ICL Services specialists reviewed the project specifications and requested the organizational structure to create a detailed interview schedule. An interview questionnaire was developed and approved by the client.
Information Gathering
Next, a key stage involved conducting a series of employee interviews. An expert from the ICL Services Information Security Center conducted 42 interviews with representatives from various departments and units, including business schools, training and innovation divisions, the IT department, and operations.
In total, approximately 300 employees were interviewed, providing a comprehensive picture of operational activities and identifying all points where personal data is collected and processed.
Data Analysis
The information gathered was systematized. For each process, the processing objectives, legal grounds, information systems used, and the list of personal data operations were documented. The analysis revealed that the actual number of processing workflows had increased from 17 to 23.
Documentation Development and Updating
Based on the collected data, the Personal Data Processing Registry was updated, and a document titled "Description of Personal Data Processing Workflows" was developed. All organizational and administrative documents—including the Personal Data Processing Policy—were also brought into compliance.
Platform Population
Another project task involved populating the internal Compliance Platform with up-to-date data and conducting a risk assessment using the platform's functionality. This stage also included an inventory and assessment of regulatory risks.
Preparation of Recommendations
Following the audit, a detailed report was produced, outlining identified non-compliance issues and practical recommendations. For instance, among ICL Services’ key proposals were the optimization of the contract approval process involving the cybersecurity department and a recommendation to expand the staff to ensure effective oversight of personal data processing.
Results
- The project enabled the client to establish a foundation for the secure and efficient management of personal data.
- The process registry and all necessary documentation were updated, thus minimizing risks associated with Roskomnadzor inspections and potential fines.
- The number of identified processes increased from 17 to 23, and the number of personal data subject categories rose from 6 to 15 - this provided management with a clear picture of data processing within the organization.
- Recommendations developed for procedural changes and the allocation of responsibilities will help improve operational efficiency and reduce the workload on key personnel.
- Populating the Compliance Platform with up-to-date data transitioned risk and documentation management to an automated format.