• By and large, the entities must obtain prior express consent from data subjects to lawfully collect and process personal data․ The consent is not necessary in the cases directly provided by the legislation or if the data is being collected from public sources.
• The data subject may give his or her consent in person or through the representative, where the power of attorney specifically provides for such a power.
• The data subject's consent shall be considered to be given and the processor shall have the right to process, where:
  • personal data are indicated in a document addressed to the processor and signed by the data subject, except for the cases when the document, by its content, is an objection against processing of personal data;
  • the processor has obtained data on the basis of an agreement concluded with the data subject and uses it for the purposes of operations prescribed by this Agreement;
  • the data subject, voluntarily, for use purposes, verbally transfers information on his or her personal data to the processor. 
• Personal data may be processed without the data subject's consent, where the processing of data is directly provided for by law.
• The processor of personal data or the authorised person, for obtaining the data subject's written consent, shall notify the data subject of the intention to process the data.
• The data subject shall give his or her consent in writing or electronically, validated by electronic digital signature; in case of an oral consent — by means of such reliable operations which will obviously attest the consent of the data subject on using the personal data.

The processor of personal data for obtaining the data subject's consent notifies of the intention to process the data. The notification shall include:

• surname, name, patronymic of the data subject;
• legal grounds and purpose of the processing of personal data;
• list of personal data subject to processing;
• list of operations to be performed upon personal data for which the subject's consent is requested;
• scope of persons to whom personal data may be transferred;
• name (surname, name, patronymic, position) of the processor or his or her representative requesting the data subject's consent and registered office or place of registration (actual residence);
• information on requiring by the data subject rectification, destruction of personal data, terminating the processing of data or on carrying out other operation relating to the processing;
• validity of the consent requested, as well as the procedure and consequences of withdrawing the consent.

Characteristics for processing publicly available personal data

• A regime of publicly available information of personal data (phone directories, address books, biographical directories, private announcements, declaration of income, etc.) may be established by the data subject's consent or in cases provided for by law. The name, surname, year, month and day of birth, place of birth, place of death, year, month and day of death, as well as the personal data which by conscious operations carried out by the data subject aimed at making publicly available becomes publicly available for certain scope of persons or public at large, shall be considered as publicly available.
• Information on the data subject, except for information provided for by previous clause, may be removed from publicly available sources of personal data at the request of data subject or through judicial procedure.
• The data being processed on the basis of an agreement may be removed from publicly available sources of personal data by mutual consent or through judicial procedure.

Characteristics for processing sensitive personal data

• The processing of special category personal data without the person's consent shall be prohibited, except when the processing of data is directly provided for by law.
• The processing of personal data provided for by the previous clause shall immediately be terminated, where the grounds and purpose of the processing of data were eliminated.

Characteristics for processing personal data of persons with incapacity or limited capacity and minors under the age of 16

In case of incapacity or limited capacity of the data subject or of being a minor under the age of 16, consent for processing his or her personal data shall be given by a legal representative / parent of the data subject

Characteristics for processing biometric personal data

Biometric personal data shall be processed only by the data subject's consent, except for cases provided for by law and where the purpose pursued by law is possible to implement only through processing of these biometric data.

Processing of personal data by an authorized person assigned by the processor of data

Personal data may also be processed by an authorized person assigned by the processor. The assignment shall be in writing, which shall include

• legal grounds and conditions;
• the purpose of the processing of personal data;
• the list of personal data subject to processing;
• the scope of data subjects;
• the scope of persons to whom personal data may be transferred;
• technical and organizational measures for the protection of personal data and other necessary information.

Personal data shall be processed only within the scope of the assignment. The processor of data shall be responsible for the processing of personal data within the scope of the assignment. Where the assignment does not comply with the requirements of the Law, the authorized person must inform in writing thereon to the processor of data and refuse the processing.

Blocking or destruction of personal data

The data subject shall have the right to get familiarized with his or her personal data, and require the processor to rectify, block or destruct his or her personal data, where the personal data are not complete or accurate or are outdated or has been obtained unlawfully or are not necessary for achieving the purposes of the processing.

In case of doubts with regard to the rectification, blocking or destruction of personal data by the processor, the data subject shall have the right to apply to the authorized body for the protection of personal data to make clear the fact of his or her personal data being rectified, blocked or destructed and by the request to be provided with information.

In case of incomplete, inaccurate, outdated, unlawfully obtained personal data or those unnecessary for achieving the purposes of the processing, the processor of personal data shall be obliged to carry out necessary operations for making them complete, keeping up to date, rectifying or destructing.

The processor shall be obliged to destruct or block personal data that are not necessary for achieving the legitimate purpose.