29. Safety of personal data during its processing at JSCo «RZD» shall be ensured in accordance with the laws of the Russian Federation and the requirements of the authorized state body for protection of the rights of personal data subjects, the federal executive body for safety control, and the federal executive body for technical intelligence countermeasures and technical protection of information.

30. JSCo «RZD» shall take necessary organizational and technical measures to protect personal data from accidental or unauthorized access, destruction, change, blocking of access and other unauthorized actions.

31. Protection measures implemented by JSCo «RZD» during personal data processing shall include:

• adoption of local regulatory documents and other documents in the field of personal data processing and protection;
• appointment of officials responsible for the personal data safety in business units and information systems of JSCo «RZD»;
• organization of training of, and methodological work with, employees that process personal data at JSCo «RZD»;
• arrangement of the necessary conditions for work with tangible media and information systems in which personal data is processed;
• arrangement of accounting of tangible media bearing personal data and information systems in which the personal data is processed;
• storage of tangible media bearing personal data with observance of the conditions which ensure safety of personal data and exclude unauthorized access thereto;
• isolation of personal data processed without the use of automation aids from other information;
• separate storage of tangible media bearing personal data, which contain personal data of different categories or personal data processed for different purposes;
• prohibition on transmission of personal data via open communication channels, computer networks and Internet without the use of the measures established at JSCo «RZD» for ensuring personal data safety;
• protection of documents containing personal data on paper and other tangible media during their transfer to third parties with the use of postage service;
• internal control over compliance at JSCo «RZD» with the laws of the Russian Federation and regulatory documents of JSCo «RZD» during personal data processing.

32. The liability for violation of the requirements of the laws of the Russian Federation and regulatory documents of JSCo «RZD» with regard to personal data processing and protection shall be determined in accordance with the Russian Federation laws.