Amendments to the Law on Personal Data Protection

2009-12-22

The Russian State Duma adopted amendments to the Law on Personal Data Protection in the first reading. Following the changes, the period of bringing information systems into compliance with the law is prolonged until 1 January 2011.
In addition, the document cancels the mandatory requirement to use cryptographic means to protect personal data.
According to the law adopted in 2006, information systems with personal data created before the entry of the law into force had to be brought into compliance with the requirements of the law no later than 1 January 2010. However, personal data operators have said that they would not be able to bring information systems in line with the new requirements on time.
The bill requires operators of personal data to take the necessary organisational and technical measures to protect personal data against unauthorised or accidental access or other illegal actions.