Why data is a continuity issue
Loss or leak of data can stop processes (people have nothing to work with) and lead to legal consequences. This is why data protection is part of both cybersecurity and business continuity. The target for acceptable data loss (RPO) is set in the BIA and met through backups (DRP).
What Federal Law No. 152-FZ requires
Federal Law No. 152-FZ “On Personal Data” requires operators to protect personal data, restrict access, respond to incidents and, in some cases, notify the regulator. Violations and leaks carry liability, and the law is moving towards stricter rules and turnover-based fines (linked to revenue). This moves the risk out of the “technical” category and into “money and the owner's responsibility”.
Basic measures to reduce the risk
- Minimisation: keep only the data you need and restrict access.
- Backups, including isolated ones.
- An incident and data leak response plan (see “what to do in a cyberattack”).
- Staff training and basic cyber hygiene.
Company data: threats and continuity measures
| Data type | Main threat | Continuity measure |
|---|---|---|
| Customer base | Ransomware, theft, accidental deletion | Backups under the 3-2-1 rule, recovery test |
| Financial data | Loss of access to the accounting system | RPO of no more than one day, exports of key reports |
| Documents and contracts | A single copy on one disk | Cloud plus an offline copy, version control |
| Access rights and passwords | The administrator leaves, keys are lost | Company password manager, duplicated access rights |
| Personal data | Leak and fines from the regulator | Storage minimisation, encryption, notification plan |
Frequently asked questions
What are the fines for personal data leaks?
Liability under Federal Law No. 152-FZ is getting stricter. Turnover-based fines (linked to revenue) are being discussed and introduced. The exact amounts depend on the current version of the law, so check the legislation in force or ask a lawyer.
How are data protection and business continuity linked?
Data loss stops processes and creates legal risk. Business continuity sets the acceptable data loss (RPO) and makes sure data can be restored from backups.
Is your team ready for the first hour of a crisis?
You test a plan by running a scenario. Reading it is not enough. The assessment shows the gaps, and the corporate format works through them with your team on your own processes.
