Regulations on the Processing and Protection of Employees’ Personal Data

This Regulation on the Processing and Protection of Personal Data of Employees and Other Persons (hereinafter referred to as the Regulation) is a local regulatory act and regulates the procedure for processing the personal data of employees in the Limited Liability Company “National Cable Carriers” (hereinafter referred to as the Employer or the Operator), including the procedure for storing, transferring, blocking, and destroying personal data, measures to protect it, and other issues related to the processing of the personal data of employees (hereinafter referred to as Employees or Personal Data Subjects) and other personal data subjects (hereinafter referred to as Personal Data Subjects) specified in the Regulation.

1. General provisions

The Regulations are developed in accordance with the Constitution of the Russian Federation, the Labor Code of the Russian Federation, the Federal Law dated 27.07.2006 No. 152-FZ “On Personal Data” and other regulatory legal acts, as well as the adopted “        ”               __       2025  year. The Operator has adopted the Personal Data Processing Policy in order to ensure the protection of the rights and freedoms of Personal Data Subjects when processing their personal data, including the protection of the right to privacy and personal and family secrets.
The Regulation uses terms and definitions in accordance with their meanings established in the Federal Law dated 27.07.2006 No. 152‑FZ “On Personal Data”.
The Regulation is mandatory for all employees of the Operator.
The processing of personal data includes the collection, recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, and destruction of personal data — that is, any information relating to a directly or indirectly identified or identifiable natural person (the Subject of Personal Data).
The processing of personal data of Personal Data Subjects may be carried out solely for the purpose of ensuring compliance with laws and other regulatory legal acts, assisting Personal Data Subjects in employment (personnel selection), facilitating the Employees’ education, ensuring the Employees’ personal safety, monitoring the quantity and quality of work performed, and ensuring the safety of property.
The Personal Data Subjects to whom this Regulation applies include the Operator’s Employees, their relatives (members of their families), job applicants (candidates for employment with the Operator), and former employees of the Operator.
The composition of personal data by categories of personal data subjects.
The personal data of Employees, including former employees, processed by the Operator, includes:
last name, first name, patronymic, date and place of birth, gender, information about citizenship;
place of permanent and temporary registration, place of actual residence;
type, series, and number of the identity document, date of issue, name of the issuing authority;
TIN;
SNILS.

• information about marital status, family composition, details of the marriage registration certificate, and the child’s birth certificate;
  information about employment, including work experience, previous places of employment, hiring, transfer, dismissal, and other events, as well as income, including income from previous places of employment;
  information about military service, details of the military ID;
  information about education, including details of educational documents, information about qualifications, professional training, and professional development;
  phone number, email address.
  information about business and other personal qualities of an evaluative nature;
  special personal data, namely information about health status;
  biometric personal data, namely a photographic image of the subject of personal data.
  The personal data of the applicant processed by the Operator includes:
  last name, first name, patronymic, date and place of birth, gender, information about citizenship;
  place of permanent and temporary registration, place of actual residence;
  type, series, and number of the identity document, date of issue, and the name of the issuing authority;
  information about employment history, including length of service and previous places of employment;
  information about education, including details of documents confirming education, qualifications, and professional training, as well as information about professional development;
  phone number and email address;
  information about business and other personal qualities that are evaluative in nature;
  biometric personal data, namely, a photographic image of the subject of personal data.
  The personal data of the Employees’ relatives (members of their families) processed by the Operator includes:
  surname, first name, patronymic, date and place of birth, gender, information about citizenship;
  place of permanent and temporary registration, place of actual residence;
  details of the marriage certificate (for a spouse), birth certificate (for a child);
  phone number;
  Documents containing personal data and processed by the Operator, in addition to the employment contract, additional agreements to it, and orders regarding the Subject of Personal Data, include:
  A questionnaire completed by the employee (applicant);
  a copy of the identity document;
  the employee’s personal card in form No. T‑2;
  the employment record book (or a copy thereof);
  information about employment history;
  documents confirming education and qualifications;
  information about certification;
  information about professional development;
  information about professional retraining;
  information about registration, actual place of residence, and contact phone numbers;
  a copy of the marriage certificate.
  a copy of the child's birth certificate;
  a copy of the military ID;
  a copy of the education document;
  a copy of the SNILS;
  a copy of the pension certificate;
  taxpayer identification number.

• 2. Processing of personal data

  2.1. Principles and conditions for processing personal data

  2.1.1. Personal data must be processed in compliance with the following principles:

  personal data must be processed on a lawful and fair basis;
  processing must be limited to achieving specific, pre‑defined and lawful purposes, which must be consistent with the content and volume of the personal data being processed. Only personal data that meets the processing purposes may be processed.
  During processing, the accuracy, sufficiency, and, where necessary, relevance of personal data in relation to the purposes of processing must be ensured. The operator must take the necessary measures to delete or clarify incomplete or inaccurate data, or ensure that such measures are taken;
  personal data must be stored in a form that allows the Personal Data Subject to be identified, for no longer than is required by the purposes of processing personal data, unless the period for storing personal data is established by federal law or by a contract in which the Personal Data Subject is a party, beneficiary, or guarantor. The processed personal data must be destroyed or anonymized upon achievement of the processing objectives or if the need to achieve these objectives is no longer required, provided that otherwise is provided for by federal law.
  The following is not permitted:

  processing of personal data that is incompatible with the purposes for which the personal data was collected;
  merging of databases containing personal data that is processed for purposes that are incompatible with each other;
  excessive processing of personal data in relation to the stated purposes of their processing.
  2.1.2. All personal data of the Employee must be obtained from the Employee themselves. If they can only be obtained from a third party, the Employee must be notified in advance and their written consent must be obtained. The Employer must inform the Employee about the purposes, предполагаемые sources and methods of obtaining personal data, as well as the nature of the personal data to be obtained and the consequences of the Employee’s refusal to give written consent to its acquisition.

  2.1.3. If the Employee’s personal data subject to processing by the Employer changes, the Employee is obliged to notify the Employer of such changes within five days from the date of the changes.

  2.1.4. The Employer has no right to:

  obtain and process information about the Employee that, in accordance with the legislation of the Russian Federation in the field of personal data, belongs to special categories of personal data, except in cases provided for by law;
  obtain and process the Employee’s personal data regarding their membership in public associations or their trade union activities, except in cases provided for by law;
  when making decisions that affect the Employee’s interests, rely on the Employee’s personal data obtained solely as a result of its automated processing or electronic receipt.
  2.1.5. Personal data is processed using automation tools and without using automation tools.

  2.1.6. The Operator stores the Personal Data Subjects’ Personal Data in the following information systems:

  the Operator’s Employees’ Personal Data Information System;
  the Personal Data Information System of persons who are not the Operator’s Employees, but whose Personal Data the Operator must process in accordance with labour legislation.
  2.1.7. The person responsible for organizing the processing of personal data is, in particular, obliged to:

  To carry out internal monitoring of the Operator’s and its employees’ compliance with Russian legislation on personal data, including requirements for the protection of personal data;
  to inform the Operator’s employees of the provisions of Russian legislation on personal data, the Personal Data Processing Policy adopted on August 25, 2025, the Operator’s current Regulations and other local acts concerning the processing of personal data, and the requirements for the protection of personal data, and to monitor changes in them;
  To organize the reception and processing of appeals and requests from subjects of personal data or their representatives, and (or) to monitor the reception and processing of such appeals and requests;
  to participate in organizing an internal investigation in the event of unlawful processing of personal data;
  to participate in the commission for the destruction of personal data.

• 2.1.8. The Employer is not required to obtain consent for the processing of personal data in the following cases:

  the personal data is obtained from documents (information) submitted when entering into an employment contract or as a result of a mandatory preliminary medical examination;
  the obligation to process, including the publication and posting of employees’ personal data on the Internet, is provided for by the legislation of the Russian Federation;
  when transferring an employee’s personal data to third parties in cases where this is necessary to prevent a threat to the employee’s life and health, as well as in other cases provided for by the Labour Code of the Russian Federation or other federal laws.
  when implementing the access control regime on the territory of the Employer’s office buildings and premises;
  in other cases provided for by the legislation of the Russian Federation.
  2.1.9. The Employer is not required to obtain the applicant’s consent to process their personal data when a recruitment agency acting on behalf of the applicant, with whom the applicant has entered into an appropriate agreement, is handling the matter, as well as when the applicant independently publishes their resume on the Internet, making it available to an unlimited number of people.

  2.1.10. The form of the Employee’s consent to the processing of personal data is set out in Appendix No. 1 to the Regulations (“Form of Employee Consent to the Processing of Personal Data”).

  2.1.11. The form of the Applicant’s consent to the processing of personal data is set out in Appendix No. 2 to the Regulations (“Form of Applicant’s Consent to the Processing of Personal Data”).

  2.2. Storage of Personal Data

  2.2.1. Storage of personal data processed without the use of automation tools.

  2.2.2.1. Personal data processed without the use of automation tools must be separated from other information, in particular by recording it on separate physical media for personal data, in special sections, or in the margins of forms (blanks).

  2.2.1.2. Personal data processed without the use of automation tools is stored on the following physical media:

  paper media;
  Machine-readable media, namely: (hard drives, flash drives, personal computers, etc.).
  2.2.1.3. When personal data is recorded on material media, it is not allowed to record personal data on a single material medium if the purposes for processing such data are заведомо incompatible.

  For the purpose of processing different categories of personal data, a separate material medium must be used for each category.

  It is necessary to ensure separate storage of personal data (material media) that is processed for different purposes.

  When storing physical media, the following conditions must be observed to ensure the safety of personal data and prevent unauthorized access to it:

  installing safes with locks for storing physical media containing personal data;
  allowing access to the premises where physical media containing personal data are stored only to persons included in the list of persons who have access to personal data in order to perform their employment (official) duties.
  2.2.1.4. Personal data is clarified by updating or modifying the data on the material carrier; if this is not permitted due to the technical characteristics of the material carrier, it is clarified by recording information about the changes made to the data on the same carrier or by producing a new material carrier with clarified personal data.

  2.3. Transfer of personal data

  2.3.1. When transferring an Employee’s personal data, the Employer must comply with the following requirements:

  not to disclose the Employee’s personal data to a third party without the Employee’s written consent, except in cases where this is necessary to prevent a threat to the Employee’s life and health, as well as in other cases provided for by law;
  not to disclose the Employee’s personal data for commercial purposes without their written consent.
  To inform persons receiving the Employee’s personal data that this data may be used only for the purposes for which it was communicated, and to require these persons to confirm that this rule has been observed. Persons receiving the Employee’s personal data are obliged to maintain a regime of secrecy (confidentiality). This provision does not apply to the exchange of Employees’ personal data in accordance with the procedure established by the Labor Code of the Russian Federation and other federal laws.
  To transfer the Employee’s personal data within the same organization in accordance with the Regulations, to which the Employee must be ознакомлен by signature;
  to allow access to the Employees’ personal data only to specially authorized persons, and these persons must have the right to receive only those personal data of the Employee that are necessary to perform specific functions;
  not to request information about the Employee’s health status, except for those details that relate to the issue of whether the Employee is capable of performing their job function.
  transfer the Employee's personal data to his representatives in accordance with the procedure established by law, and limit this information to only those personal data of the Employee that are necessary for the performance of their functions by these representatives.
  2.3.2. The Employee's consent to the transfer of personal data is not required.:

  to third parties in order to prevent threats to the life and health of the Employee;
  in the SFR, to the extent prescribed by law, tax authorities, military commissariats, and bodies and organizations that must be notified of a serious accident, including a fatal one;
  at the request of trade unions in order to monitor compliance with labor legislation by the Employer;
  at the request of the prosecutor’s office, law enforcement agencies, and security agencies;
  at the request of state labor inspectors in the course of their supervisory and control activities;
  at the request of the court.
  in cases related to the performance of the Employee’s official duties (for example, when sent on a business trip);
  to provide information to the credit institution servicing the Employees’ payment cards, if the card issue agreement was concluded directly with the Employee and it includes provisions on the Employer’s transfer of the Employee’s personal data, or the Employer has a power of attorney to represent the Employee’s interests when concluding an agreement with the credit institution for the issuance of the card and its subsequent servicing, or the relevant form and remuneration system is specified in the collective agreement;
  in other cases provided for by the legislation of the Russian Federation.
  2.3.3. The Operator does not carry out cross‑border transfer of personal data.

  2.3.4. Persons who have access to personal data.

  2.3.4.1. The list of persons who have access to personal data processed by the Operator, including in the information system, for the purpose of performing their official (employment) duties, is approved by an order of the Operator.

  2.3.4.2. Persons who have access to personal data processed by the Operator, including in the information system, in order to perform their job duties, are obliged to:

  not disclose personal data to third parties and not distribute personal data without the consent of the Personal Data Subject, unless otherwise provided for by federal law;
  2.3.4.3. The Operator’s employees who have access to personal data, including the person responsible for organizing the processing of personal data, sign a non‑disclosure agreement regarding the employees’ personal data in the form established in Appendix No. 3 to the Regulations (“Form of the Non‑Disclosure Agreement Regarding Personal Data”).

  2.4. Blocking and destruction of personal data

  2.4.1. Blocking of personal data.

  2.4.1.1. The Operator must block personal data in the following cases and within the following timeframes:

  in the event of identifying unlawful processing of personal data upon the request of the Personal Data Subject or their representative, or at the request of the Personal Data Subject or their representative, or an authorized body for the protection of the rights of personal data subjects — from the moment of such a request or upon receipt of the specified request, for the period of the verification;
  in case of detection of inaccurate personal data when contacting the Personal Data Subject or his representative, or at their request or at the request of the authorized body for the protection of the rights of personal data subjects — from the moment of such request or receipt of the specified request for the verification period, if the blocking of personal data does not violate the rights and legitimate interests of the Personal Data Subject or third parties;
  if it is not possible to destroy personal data within the period specified in Parts 3 - 5.1 of Article 21 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" — until the moment of destruction.
  2.4.1.2. The blocking of personal data is carried out in the following order:

  an order is issued by the Employer’s General Director;
  the order is communicated to the relevant heads of the Employer’s structural units regarding the need to block the personal data (temporarily stop processing, including a ban on transferring the data to third‑party organizations) of the relevant subject. The heads of the Employer’s structural units, in turn, notify the relevant Employees of their units about the data being blocked.
  The blocking of the subject’s personal data is carried out by responsible employees — specialists in the employer’s information and technical support — using the internal tools of the personal data information system, on the basis of an order.
  2.4.1.3. The Operator must also stop processing personal data in the following cases:
  if unlawful processing of personal data carried out by the Operator is detected — within a period not exceeding three working days from the date of such detection;
  the purpose of processing personal data has been achieved.
  The reasons that led to the processing of special categories of personal data in the cases provided for in Part 2 and Part 3 of Article 10 of Federal Law No. 152‑FZ dated July 27, 2006, “On Personal Data,” have been eliminated, provided that no other requirements are established by federal law.
  The subject of personal data has revoked consent to the processing of their personal data.
  The subject of personal data has contacted the Operator with a request to stop processing — within no more than ten business days from the date of receipt of the relevant request. This period may be extended, but not for more than five working days, if the Operator sends the Subject of Personal Data a reasoned notice indicating the reasons for extending the period.
  2.4.2. Destruction of Personal Data

  2.4.2.1. The Operator must destroy personal data, in particular, in the following cases and within the following timeframes:

  upon achievement of the purposes of personal data processing or in case of loss of the need to achieve these goals — within a period not exceeding thirty days from the date of achievement of the purpose of personal data processing, unless otherwise provided by an agreement to which the Personal Data Subject is a party, beneficiary or guarantor, or by another agreement between the Operator and the Personal Data Subject, or if the Operator does not have the right to process personal data without the consent of the Personal Data Subject on the grounds provided for by federal laws;
  When the Subject of personal data or their representative submits information confirming that such personal data was obtained illegally or is not necessary for the stated purpose of processing — within a period not exceeding seven working days from the date such information is submitted;
  in the event of unlawful processing of personal data, if it is impossible to ensure the lawfulness of such processing — within a period not exceeding ten working days from the date the unlawful processing is identified.
  In the event that the Subject of Personal Data withdraws consent to the processing of their personal data, if the retention of personal data is no longer required for the purposes of their processing, this must be done within a period not exceeding thirty days from the date the withdrawal is received. This is possible provided that the matter is not otherwise stipulated by a contract to which the Subject of Personal Data is a party, beneficiary, or guarantor, or by any other agreement between the Operator and the Subject of Personal Data, or in the event that the Operator is not entitled to process the personal data without the consent of the Subject of Personal Data on grounds provided for by federal laws.
  2.4.2.2. Destruction is carried out by a commission appointed by the Employer’s General Director, consisting of persons authorized to process the personal data being destroyed.

  2.4.2.3. When personal data is processed without the use of automation tools, the document confirming the destruction of personal data is the Personal Data Destruction Certificate.

  When processing personal data using automation tools, the documents confirming the destruction of personal data are the Personal Data Destruction Certificate and the Log Export from the information system of personal data (hereinafter referred to as the Log Export).

  When processing personal data both with and without the use of automation tools, the documents confirming the destruction of personal data are the Personal Data Destruction Certificate and the Log Export.

  2.4.2.4. The document confirming the destruction of personal data and the journal log extract must be stored for 3 years from the date of destruction of the personal data.

  2.4.2.5. The document confirming the destruction of personal data must contain:

  the name and address of the Operator;
  the surname, first name, patronymic (if available) of the Subject, or other information relating to a specific individual whose personal data was destroyed;
  last name, first name, patronymic (if any), position of the person(s) who destroyed the personal data of the Personal Data Subject, as well as their (his) signature;
  list of categories of destroyed personal data of the Personal data Subject;
  the name of the destroyed material media containing the personal data of the Personal Data Subject, indicating the number of sheets for each material medium in the case of personal data processing without the use of automation tools;
  the name of the personal data information system from which the personal data of the Personal Data Subject was destroyed (in the case of personal data processing using automation tools);
  the method of destruction of personal data;
  the reason for the destruction of personal data;
  the date of destruction of the Subject’s personal data.
  2.4.2.6. The log export must contain:
  the surname, first name, patronymic (if available) of the Subject, or other information relating to a specific individual whose personal data was destroyed;
  a list of the categories of the Subject’s personal data that were destroyed;
  the name of the personal data information system from which the Subject’s personal data was destroyed.
  the reason for the destruction of personal data;
  the date of destruction of personal data.
  If the Log export does not allow specifying the required information, it is entered into the Personal Data Destruction Certificate.

  3. Protection of personal data

3.1. The Employer, at its own expense, ensures the protection of Employees’ personal data from its unlawful use or loss.

3.2. When processing personal data, in order to protect it from unlawful or accidental access to it, destruction, alteration, blocking, copying, provision, dissemination, as well as from other unlawful actions, the Operator is obliged to take the necessary legal, organizational and technical measures or ensure that they are taken, namely:

to identify threats to the security of personal data when it is processed in information systems for personal data (hereinafter referred to as the information system);
Implement organizational and technical measures to ensure the security of personal data during its processing in information systems, which are necessary to meet the requirements for the protection of personal data, the compliance with which ensures the levels of personal data protection established by the Government of the Russian Federation;
use information security tools that have undergone the conformity assessment procedure in accordance with the established procedure;
use information security tools that have undergone the conformity assessment procedure in accordance with the established procedure and include an information destruction function to destroy personal data;
assess the effectiveness of the measures taken to ensure the security of personal data before the information system is put into operation;
keep records of machine‑readable media containing personal data.
Ensure the detection of facts of unauthorized access to personal data and take measures, including those for detecting, preventing, and eliminating the consequences of computer attacks on information systems, as well as for responding to computer incidents in them;
ensure the restoration of personal data modified or destroyed as a result of unauthorized access to it;
establish rules for access to personal data processed in the information system, and also ensure the registration and accounting of all actions performed with personal data in the information system.
Monitor the measures taken to ensure the security of personal data and the level of protection of information systems.
3.3. To ensure the fourth level of protection of personal data when it is processed in information systems, the following measures have been established:

Access to the premises where the personal data information system is located is restricted as follows: locks are installed on the doors.
Personal data carriers are stored in locked cabinets and safes.
The operator uses the following means of protecting personal data: antivirus software.
3.4. Monitoring of compliance with the Requirements for the Protection of Personal Data during their processing in information systems of personal data, approved by Decree of the Government of the Russian Federation dated 01.11.2012 No. 1119, is carried out at least once every 3 years in the following order.

3.5. If the fact of unlawful or accidental transfer (provision, dissemination, access) of personal data is established, which has resulted in a violation of the rights of Personal Data Subjects, the Operator is obliged to notify Roskomnadzor within 24 hours of the incident, of the alleged causes that have led to a violation of the rights of Personal Data Subjects, from the moment such incident is identified by him or Roskomnadzor or another interested person. about the alleged harm caused to the rights of Personal Data Subjects, about the measures taken to eliminate the consequences of the relevant incident, as well as provide information about the person authorized by the Operator to interact with Roskomnadzor on issues related to the identified incident.

In the event of unlawful or accidental transfer of personal data that results in a violation of the rights of Personal Data Subjects, the Operator must conduct an internal investigation and notify Roskomnadzor within 72 hours of establishing the specified fact about the results of the internal investigation into the identified incident, as well as provide information about the persons whose actions caused the identified incident (if any).

The Operator is obliged, in accordance with the Procedure approved by Order No. 77 of the FSB of Russia dated 13.02.2023, to ensure interaction with the state system for detecting, preventing, and eliminating the consequences of computer attacks on the information resources of the Russian Federation, including informing the FSB of Russia about computer incidents that have resulted in the unlawful transfer (provision, dissemination, access) of personal data.

3.6. In order to ensure the protection of personal data stored by the Employer, Employees have the right to:

• to full information about their personal data and the processing of such data;
  to free and unrestricted access to their personal data, including the right to receive copies of any record containing the Employee’s personal data, except in cases provided for by federal law;
  to designate their representatives for the protection of their personal data;
  to access medical documentation reflecting their health status, with the assistance of a medical professional of their choice;
  to request the deletion or correction of incorrect or incomplete personal data, as well as data processed in violation of the requirements of the law. If the Employer refuses to delete or correct the Employee’s personal data, the Employee has the right to submit a written statement to the Employer expressing their disagreement, along with the relevant justification for such disagreement. The Employee has the right to supplement the statement with their own point of view regarding personal data of an evaluative nature;
  to require the Employer to inform all persons who were previously provided with incorrect or incomplete personal data about the Employee, of all deletions, corrections, or additions made to it;
  to challenge in court any unlawful actions or inaction of the Employer in the processing and protection of personal data.
  3.7. Persons guilty of violating the provisions of Russian legislation in the field of personal data when processing an Employee’s personal data are held liable for disciplinary and material liability in accordance with the procedure established by the Labor Code of the Russian Federation and other federal laws, and are also held liable for civil, administrative, and criminal liability in accordance with the procedure established by federal laws.

  4. Final provisions
   
  4.1. The provision comes into force on “       “…” and applies to relations that arose after it came into force. In relations that arose before it came into force, the Regulation applies to rights and obligations that arose after it came into force.

  4.2. The Regulation or its individual provisions cease to be effective for the following reasons:

  the repeal (recognition as invalid) of the Regulation or its individual provisions by another local regulatory act;
  The entry into force of a law or other regulatory legal act containing labor law norms, a collective agreement, or an agreement (if these acts establish a higher level of guarantees for employees compared to those established by the Regulation).
  4.3. Upon hiring (before signing the employment contract), the Employer is obliged to familiarize the Employee with the Regulation, signed by the Employee. Familiarization with the Regulation for remote Employees may be carried out through the exchange of electronic documents.

  4.4. List of annexes to the Regulation:

  4.4.1. Appendix No. 1. Employee Consent Form for the Processing of Personal Data.

  4.4.2. Appendix No. 2. Applicant Consent Form for the Processing of Personal Data.

  4.4.3. Appendix No. 3. Form of the Obligation to Disclose Personal Data of Employees.