Article 31. Rights and obligations of the owner and (or) operator

The owner and (or) operator have the right to process personal data.

The owner and (or) operator must:

comply with personal data laws;

provide upon request of the subject information regarding the processing of his personal data;

approve the composition of personal data necessary and sufficient for their performance of tasks;

take measures to destroy personal data in case of achievement of the purpose of their processing, as well as in other cases established by this Law;

provide evidence of the consent of the subject to the processing of his personal data in cases stipulated by law;

change and (or) add personal data subject to documentary confirmation of the reliability of the new data or destroy it if it is impossible to make such changes and (or) additions;

temporarily suspend processing or destroy personal data if there is information about a violation of the conditions for their processing;

provide the opportunity for the subject to submit documents in electronic form to temporarily suspend the processing and (or) destruction of his personal data;

notify in writing the subject, as well as other participants in the processing of personal data in cases of changes, destruction of personal data and restrictions on access to them;

notify in writing the subject in case of transfer of personal data to a third party;

register owned and (or) processed personal data bases;

take the necessary legal, organizational and technical measures to protect personal data.

The owner and (or) operator has the right to entrust the processing of personal data to a third party in the following cases:

the presence of the consent of the subject in writing, including in the form of an electronic document;

if the decision is made pursuant to an agreement between the owner and the entity or fulfillment of the conditions of a previously concluded agreement;

prescribed by law.

The obligations of the owner and (or) operator, as well as a third party to protect personal data, arise from the moment of collection of personal data and are valid until their destruction or anonymization.

The owner and (or) operator determines the structural unit or official responsible for the work related to the processing and protection of personal data, and ensures its work in accordance with the sample procedure for processing of personal data.