Expertise/IT and Technology Companies

Service

Personal Data: Compliance and Support

The processing of customer, user and employee data is brought into compliance with the law and described in documents. Support then covers notifications to Roskomnadzor and its inspections, requests from individuals and data incidents.

We are most often instructed by:

  • Online shops, services and other operators processing customer data
  • Employers processing the data of employees and job candidates
  • Contractors and services processing data on behalf of an operator

The information on this website is provided for information purposes only and does not constitute a public offer.

What the Service Includes

Timing and Fees
–timing on request
from ₽fee on request

Timing and fees are indicative and are confirmed when the engagement is agreed.

01 / Overview
The operator's obligations

The operator's obligations do not depend on who technically processes the data: where processing is entrusted to a service provider or contractor, the operator remains responsible to the data subject.

The data of employees and job candidates is processed under the same rules as customer data, but with its own purposes, retention periods and access procedures connected with the employment relationship.

02 / Outcome
Service Outcome
  • Audit reportDeviations from the requirements, their materiality and the order in which they are to be remedied.
  • Operator documentsProcessing policy, regulations, orders, consent forms and the procedure for staff access.
  • Notifications to RoskomnadzorA notification of personal data processing and a notification of cross-border transfer, if such transfer takes place.
  • Contracts with data recipientsProcessing instructions and terms of contracts with contractors, services and group companies.
  • Incident response procedureAllocation of responsibility, the sequence of steps and the texts of notifications.

The outcome of the service is the work performed within the scope agreed with the client.

03 / Projects
Selected Projects
01 / 04

Purchase of a group of companies

Purchase of a producer of digital solutions for equipment management and monitoring

Challenge

Advising the buyer on the acquisition of shares in a foreign company that owns a Russian manufacturer of industrial equipment and digital solutions for equipment management and monitoring. The acquisition of the foreign company was governed by English law.

What was done

Comprehensive legal due diligence of the Russian business was carried out, covering its contractual relationships and intellectual property rights, and the foreign ownership structure was analysed. The findings were reflected in the terms of the transaction and the arrangements for its closing.

Purchase of an interest

Purchase of an interest in an app developer with an audience of more than 1.5 million users a week

Challenge

Advising the buyer on the acquisition of an interest in a company developing a healthy lifestyle app. The app's weekly audience exceeded 1.5 million users worldwide.

What was done

Comprehensive legal due diligence was carried out, covering business operations, corporate history, intellectual property rights, employment relationships and the legal risks material to the transaction. The findings were reflected in the structuring of the transaction and the preparation of the contractual documentation.

Investment transaction

Investment in a developer of 3D interior design solutions

Challenge

Advising on an investment transaction involving a company that develops 3D interior design solutions. The structure provided for the grant of an option right to the investor.

What was done

The project's founder was given the possibility of buying this right back before the investor exercised it. The terms of such a buy-back and the consequences of changes to the parties' arrangements on future equity participation were agreed.

Convertible loan

Convertible loan for a company developing an educational course platform

Challenge

Advising on an investment in a company developing a platform that aggregates educational courses, made by way of a convertible loan.

What was done

The terms of the financing and of the investor's future entry into the company's capital were determined, including the conversion parameters and the consequences of different scenarios for the transaction. The engagement covered agreeing the documents and the procedures required to implement the transaction.

04 / Questions
Frequently Asked Questions

A standard set describes processing that does not match the actual processing: each company has its own purposes, categories of data, recipients and retention periods.

A mismatch between the documents and practice is in itself a violation and comes to light when a data subject makes a request or during an inspection. The documents are drawn up to reflect the processes of the specific company, and the composition of the set is agreed before work begins.

Consent is one of the legal grounds for processing and is not required in every case. Data needed to perform a contract with a customer or to fulfil an employer's obligations may be obtained and used on other grounds.

Consent is requested where there is no other ground and is documented separately from other documents. The ground for each processing purpose is determined during the audit.

The operator is required to file a notification before processing begins. The information is prepared on the basis of the actual processing: purposes, categories of data and data subjects, security measures and whether there is any cross-border transfer. If a notification was filed earlier but the processes have changed, the information in the register of operators is updated.

Whether the processing falls within the cases in which no notification is required is checked separately.

Deadlines for notifying Roskomnadzor are counted in hours, and action begins immediately: recording the circumstances, determining the scope of the data affected, preparing notifications and liaising with the supervisory authority.

At the same time, the measures taken are documented: they are taken into account when the question of liability is considered. The deadlines and addressees of notifications are checked as at the date of the incident.

An hourly rate, a fixed fee or a combined model is used; in some cases part of the fee depends on the outcome achieved. The fee is determined by the time actually spent, the complexity of the matter and the overall timeframe of the project, and is agreed before work begins.

Key Contacts
Deni Murdalov Deni Murdalov Partner, PhD (Law), LL.M. Ilya Smirnov Ilya Smirnov Partner

Request a free consultation

Describe your matter and the circumstances in which it arose. The consultation establishes the possible structure of the work and the scope of legal support required.

Email us
Other Services in This Practice
Investments and Transactions Software Development Agreements Licence Agreements and Service Access Rights to Code Website and App Documents Ministry Accreditation Tax Incentives Russian Software Register Product Registration Documents and Consultations

Discuss your matter

Describe your situation and we will reply within 24 hours.

Discuss your matter

Describe your situation and we will reply within 24 hours.

Request sent

We will contact you within 24 hours