Processing of personal data in accordance with the Federal Law No. 152-FZ

In Russia, the way in which organizations process the personal data of their employees, clients, counterparties, and other individuals is regulated by the Federal Law "On Personal Data" (No. 152-FZ).

Yandex 360 processes any data received from its clients in strict compliance with this law:

• Out data centers employ modern and reliable data protection technologies.

• Internal regulations and processes at Yandex are designed to prevent any unauthorized access to client data.

• Yandex 360 stores data in data centers located in Russia. The use of Yandex 360 services doesn't require any data localization measures from our clients.

What it means to be a data controller

To comply with the Federal Law No. 152-FZ when implementing Yandex 360 products into your company processes, we recommend taking the following measures:

• Analyze your business processes involving the processing of personal data and organize them: define the purposes and procedures of data processing, the types of data processed, as well as where and how this data is stored. Make sure you have legitimate grounds for processing personal data.

• Develop local documents regulating the processing and protection of personal data: a public policy and internal instructions. Publish the policy on the organization's websites and in applications.

• Assess the potential harm to personal data subjects. Conduct a simulation of security threats to personal data in information systems.

• Appoint a person responsible for organizing the processing of personal data.

• Submit a notification of data processing to Roskomnadzor if you haven't done so already.

Details

To learn more about the terms of personal data processing in Yandex 360 services, see Section 11 of the Offer and Data processing agreement.