- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,558
Overview of requirements and approved methods of depersonalization of PD in accordance with the Order of RKN No. 140.
More than six months have passed since the entry into force of the Order of Roskomnadzor No140. But the topic of depersonalization of personal data is still relevant for business and government organizations. According to Roskomnadzor, over the past year, the agency has received more than 100 thousand appeals related to the protection of the rights of personal data subjects. Among the frequent violations is the processing of data without legal grounds, excessive information collection and the absence of documents that regulate work with personal data.
In September 2025, the requirements of the Order of Roskomnadzor No. 140 came into force, which tightened the rules and methods of depersonalization of personal data (DDV). The document obliged operators to revise the approach to the process of avoiding communication between information and a particular entity. The key requirement of the regulator - depersonalization must deprive PD of properties that allow you to identify the subject of PD.
The requirements of the order apply to all operators of PD. For basic violations are provided for fines up to 300 thousand rubles, for repeated - up to 500 thousand. To comply with the requirements, companies need to perform a number of organizational and technical measures: to conduct an audit of the PD processing, apply the methods of depersonalization approved by the regulator and ensure the reliability and irreversibility of the procedure. Also, operators are required to limit the access of third parties to depersonalization methods, to conduct the logging of operations and maintain local regulations in the current state.
RKN No. 140 orders establish five permitted methods of depersonalization of personal data. Experts note that the choice of method depends on the purpose of processing and the architecture of the information system. At the same time, the regulator requires not only the formal use of one of the methods, but also to prove the irreversibility of depersonalization. In practice, this means that simple masking or hashing without monitoring tables of compliance may not be enough to comply with the current requirements
To automate the processes of depersonalization, specialized solutions have already been presented on the market. For example, the “Garda Data Masking” uses methods approved by the order, supports automatic PD search using AI, ensures the transparency of all stages, audits of operations and the formation of reporting on the requirements of the regulator. The system creates a copy of a database in which real data is replaced by generated plausible values while maintaining structure and connections.
To check the readiness to comply with the requirements of the Order of RKN No140, the developer of the decision on the depersonalization of personal data offers to get acquainted with the checklist of conformity. It contains the main organizational and technical measures, as well as examples of the implementation of five methods of amenification.
More than six months have passed since the entry into force of the Order of Roskomnadzor No140. But the topic of depersonalization of personal data is still relevant for business and government organizations. According to Roskomnadzor, over the past year, the agency has received more than 100 thousand appeals related to the protection of the rights of personal data subjects. Among the frequent violations is the processing of data without legal grounds, excessive information collection and the absence of documents that regulate work with personal data.
In September 2025, the requirements of the Order of Roskomnadzor No. 140 came into force, which tightened the rules and methods of depersonalization of personal data (DDV). The document obliged operators to revise the approach to the process of avoiding communication between information and a particular entity. The key requirement of the regulator - depersonalization must deprive PD of properties that allow you to identify the subject of PD.
The requirements of the order apply to all operators of PD. For basic violations are provided for fines up to 300 thousand rubles, for repeated - up to 500 thousand. To comply with the requirements, companies need to perform a number of organizational and technical measures: to conduct an audit of the PD processing, apply the methods of depersonalization approved by the regulator and ensure the reliability and irreversibility of the procedure. Also, operators are required to limit the access of third parties to depersonalization methods, to conduct the logging of operations and maintain local regulations in the current state.
RKN No. 140 orders establish five permitted methods of depersonalization of personal data. Experts note that the choice of method depends on the purpose of processing and the architecture of the information system. At the same time, the regulator requires not only the formal use of one of the methods, but also to prove the irreversibility of depersonalization. In practice, this means that simple masking or hashing without monitoring tables of compliance may not be enough to comply with the current requirements
To automate the processes of depersonalization, specialized solutions have already been presented on the market. For example, the “Garda Data Masking” uses methods approved by the order, supports automatic PD search using AI, ensures the transparency of all stages, audits of operations and the formation of reporting on the requirements of the regulator. The system creates a copy of a database in which real data is replaced by generated plausible values while maintaining structure and connections.
To check the readiness to comply with the requirements of the Order of RKN No140, the developer of the decision on the depersonalization of personal data offers to get acquainted with the checklist of conformity. It contains the main organizational and technical measures, as well as examples of the implementation of five methods of amenification.
