I run a small business: does personal data protection concern me? FAQ
You may have heard that fines for personal data breaches have been significantly increased.
As lawyers, we often hear from our clients that the issue of personal data ("PD") does not concern them. After all, they do not process the data of individuals - clients, they do not have databases, etc.
But this is not the case. Here is a summary and thesis of why PD is about every company:
"We don't have clients - individuals"
Every company has customers and clients, there is always the full name of at least the CEO or manager, phone number, email. This is already personal data.
-If you correspond with someone via email or messenger, you are already processing personal data.
"But we only work under contract, and I read that when you work under contract, you don't need consent"
It is true that in most cases consent is not required when you process personal data under a contract.
-But this does not mean that you can do whatever you want with the data. The requirement to approve the personal data processing policy and to appoint a data protection officer (the so-called "DPO") remains.
"I only have the data of my employees, I don't need to notify Roskomnadzor about their processing"
Yes, it is not always necessary to notify the RCN.
-However, this does not negate the requirement to
- Adopt a policy on the processing of personal data,
- appoint a DPO
- protect personal data (including technical and organisational measures).
I'd rather wait. The fine is only 5,000 roubles anyway
That's right, now the fine for not notifying the RCN is 5,000 roubles.
-But in six months' time the fine will rise to 100,000-300,000 rubles. This motivates us to take at least basic measures to protect personal data.
'As long as I am not in the register, I am not an operator, at least I will not face high fines for operators of PIDs'
This is a misconception.
-Failure to notify the RCN and not being on the register does not in any way avoid other fines. On the contrary, it can be seen as a sign of even greater negligence.