Personal Data Processing Policy

1. General provisions

Personal Data Processing Policy of PJSC Gazprom (as amended by Order of PJSC Gazprom No. 453 dated December 12, 2024) (PDF, 58.2 KB)

1.1. This Personal Data Processing Policy has been developed in order to outline the legal basis, purposes and methods of personal data processing at Gazprom, as well as the categories and list of personal data subject to processing, and contains other provisions with regard to the processing and protection of personal data in accordance with the current laws of the Russian Federation.

1.2. This Policy uses the definitions set out in Federal Law No. 152-FZ dated July 27, 2006, on Personal Data (hereinafter referred to as “Law No. 152-FZ”).

1.3. For the implementation of this Policy, local regulations are developed at Gazprom that specify more precisely the provisions to be observed with regard to personal data processing and protection.

1.4. This Policy serves as the basis for the development of, and introduction of updates into, local regulations by Gazprom's subsidiaries and entities to define their personal data processing policies.

2. Principles and legal basis of personal data processing

2.1. Personal data processing at Gazprom is performed in compliance with the principles stipulated by Article 5 of Law No. 152-FZ.

2.2. The legal basis for personal data processing at Gazprom is as follows:

provisions of the statutory acts pursuant to and in compliance with which Gazprom processes personal data, including the Constitution of the Russian Federation, the Labor Code of the Russian Federation, the Civil Code of the Russian Federation, the Code of Civil Procedure of the Russian Federation, the Tax Code of the Russian Federation, the Code of Arbitration Procedure of the Russian Federation, the Code of Administrative Offences of the Russian Federation, Federal Law No. 208-FZ dated December 26, 1995, on Joint Stock Companies, Federal Law No. 14-FZ dated February 8, 1998, on Limited Liability Companies, Federal Law No. 402-FZ dated December 6, 2011, on Accounting, Federal Law No. 27-FZ dated April 1, 1996, on Individual (Personalized) Record Keeping in the Systems of Compulsory Pension Insurance and Compulsory Social Insurance, Federal Law No. 400-FZ dated December 28, 2013, on Insurance Pensions, Federal Law No. 39-FZ dated April 22, 1996, on the Securities Market, Law No. 152-FZ, Federal Law No. 149-FZ dated July 27, 2006, on Information, Information Technologies and Information Protection;
other statutory acts of the Russian Federation and authorized government bodies;
Articles of Association of Gazprom and local regulations of Gazprom;
agreements concluded between Gazprom and a data subject or a third party under which the data subject is a beneficiary or guarantor;
consents of data subjects to the processing of personal data, with such consents being drawn up and executed in line with the requirements of the laws of the Russian Federation with regard to the corresponding category of personal data.

3. Purposes of personal data processing at Gazprom, categories and list of personal data subject to processing, categories of data subjects that have their personal data processed, methods and timeframes of personal data processing and storage, destruction procedure for personal data

3.1. Gazprom processes the personal data of data subjects for the purposes of:

exercising the functions, powers and duties imposed upon Gazprom by the laws of the Russian Federation and the Articles of Association of Gazprom;
regulating labor relations with Gazprom's employees and other relations directly connected with such labor relations;
recruiting personnel to fill positions at Gazprom and building talent pool at Gazprom and its subsidiaries and entities;
providing additional guarantees and remunerations to Gazprom's employees and their families, as well as to other data subjects entitled to social security support measures under local regulations of Gazprom;
drafting, signing, executing and terminating civil contracts to which Gazprom is a party;
protecting the rights and legal interests of Gazprom in administrative and judicial proceedings;
dealing with requests/inquiries received from citizens of the Russian Federation and other individuals;
arranging access and in-house security procedures at Gazprom's facilities;
organizing events of social importance and corporate events at Gazprom;
exercising sponsorship and charitable activity at Gazprom;
providing information about the activities of Gazprom, its subsidiaries and entities on the Internet sites of Gazprom;
developing reference materials for in-house information support at Gazprom, its subsidiaries and entities.

3.2. The structural units of Gazprom develop the procedures for personal data processing (hereinafter referred to as the “Structural Units' Specific Procedures”) which, depending on the tasks and functions performed by such structural units, can specify the purposes of personal data processing as are defined by Gazprom, as well as contain additional information on the specifics of personal data processing in the structural units of Gazprom for the purposes set out in this Policy.

3.3. The categories of data subjects who have their personal data processed at Gazprom in order to ensure the achievement of the purposes of personal data processing indicated in Clause 3.1 hereof are as follows:

employees of Gazprom;
employees of Gazprom's subsidiaries and entities;
family members and close relatives of Gazprom's employees, including those who are insured (are subject to insurance) under voluntary health insurance agreements concluded by Gazprom;
candidates for positions at Gazprom;
family members and close relatives of candidates for positions at Gazprom;
candidates for the top managerial positions at Gazprom's subsidiaries and entities;
pensioners of Gazprom;
Gazprom's pensioners' family members who are insured (are subject to insurance) under voluntary health insurance agreements concluded by Gazprom;
former employees of Gazprom;
individuals who are nominated for corporate awards of Gazprom;
counterparties of Gazprom (when such counterparties are individuals);
representatives of counterparties of Gazprom (when such counterparties are legal entities);
individuals who are in the chain of ownership of Gazprom's counterparties, including beneficiaries;
shareholders of Gazprom and their authorized representatives;
candidates nominated for the election into the governing bodies of Gazprom;
persons who are shareholders and/or participants of objects of long-term financial investments of Gazprom, its subsidiaries and entities;
owners of depositary receipts representing shares in Gazprom, as well as other persons exercising rights under the depositary receipts;
insiders of Gazprom;
persons who are members of the management bodies of Gazprom/members of the bodies that exercise control over the financial and business operations of Gazprom;
persons who hold positions in the management bodies of the entities controlled by Gazprom the information about which is to be included into the issuer's reports;
holders of Gazprom's bonds;
individuals who are bidders in the process of procurement of goods, works and services being held by Gazprom;
individuals participating in a court case or arbitration related to the protection of the rights and legal interests of Gazprom, its subsidiaries and entities (persons participating in the case, their representatives, defenders, defendants, affected parties, witnesses, experts, and other persons, as well as the officials of the state bodies who are authorized to consider administrative cases);
visitors admitted to the facilities of Gazprom;
individuals who send requests/inquiries to Gazprom;
users of the Internet sites of Gazprom;
other individuals who submit their personal data for the purposes of the processing of such data specified in Clause 3.1 hereof.

3.4. The categories and list of personal data processed at Gazprom for each category of data subjects indicated in Clause 3.3 hereof are determined in line with the laws of the Russian Federation, international agreements of the Russian Federation and local regulations of Gazprom with due consideration of the purposes of personal data processing indicated in Clause 3.1 hereof, and include

surname, name and patronymic name (if any) (including former surnames, names and/or patronymic names (if any) if they were changed); date and place of birth; date of death; data contained in personal identification documents; gender; citizenship (including citizenship (nationality) of a foreign state); registration address; actual address of residence; taxpayer identification number; personal pension account number; data contained in military registration documents; data contained in the documents confirming education and qualification; place of employment; data on the position held; address of distance (remote) work; data on professional activity; income details; data on inclusion into the talent pool; data on the assignment of the category of veterans under the Federal Law on Veterans; data on the participation in management bodies of legal entities; data on marital status; data on family structure; data about having access to the information constituting a state secret; data contained in the documents on the receipt of awards/honors; data on social benefits provided under the laws of the Russian Federation, as well as under collective agreements and local regulations of Gazprom, its subsidiaries and entities; data on foreign language skills; data on holding a research degree and/or an academic title; data on research papers and inventions; data on membership in elected bodies; data on the results of certification; data on disciplinary measures imposed; data contained in the labor contract; data on the employment with the state service or municipal service; data on stay(s) abroad; other data contained in the statement of personal history; telephone number (office (business), personal); e-mail address; data on persons dependent; personal account number of the bank card; photograph; data generated during the use of the sites of Gazprom (cookie files); other data that correspond to the purposes of personal data processing indicated in Clause 3.1 hereof and have been provided by the data subject;
personal data that belong to the category of the “special categories of personal data”: data on the presence or absence of criminal record; data on health condition in the cases provided by the laws of the Russian Federation.

Special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, and private life are not subject to processing at Gazprom.

The processing of biometric personal data at Gazprom is not allowed without written consent from the data subject, except for the cases provided by the laws of the Russian Federation.

The processing of personal data the dissemination of which is permitted by the data subject is carried out at Gazprom upon obtaining consent from the data subject to disseminate such data in line with the prohibitions and conditions regarding personal data processing as specified by the data subject.

3.5. For each of the purposes outlined in Clause 3.1 of this Policy, one of the following personal data processing methods is used – automated, manual or combined, namely:

automated: with the use of computer equipment and special network directories designed for working with confidential information and/or in personal data information systems;
manual: through maintaining logs and personal files in accordance with the relevant register of files and recording personal data on other paper media in compliance with the annexes to the Structural Units' Specific Procedures;
combined: by both methods indicated above.

3.6. The timeframes for the processing and storage of personal data of the data subjects indicated in Clause 3.3 of this Policy are determined in accordance with the laws of the Russian Federation and local regulations of Gazprom that govern such matters, as well as in accordance with the provisions of an agreement under which the data subject acts as a party, beneficiary or guarantor, and in the absence of such laws, local regulations and agreement – in accordance with the period specified in the consent to personal data processing given by the data subject.

Personal data are processed and stored for no longer than required for the purposes of personal data processing, unless otherwise provided by the laws of the Russian Federation.

3.7. Gazprom exercises control over the timeframes for the processing and storage of personal data.

The documents and/or other physical media on which personal data are stored, as well as personal data stored in personal data information systems, network file directories or on rewritable external electronic media are destructed as soon as the purposes of processing are achieved or on other legal grounds listed below:

if the achievement of the purposes of personal data processing is no longer required, unless otherwise provided by the relevant agreement under which the data subject acts as a party, beneficiary or guarantor and/or other applicable statutory acts of the Russian Federation;
if unlawful processing of personal data is detected;
if the data subject withdraws the consent to personal data processing, unless otherwise provided by the laws of the Russian Federation;
upon the expiration of the personal data processing period that was set at the time of the collection of personal data;
if a demand to stop the processing of personal data is received from the data subject, except for the cases specified in Law No. 152-FZ.

The procedure and methods of personal data destruction are determined by local regulations of Gazprom that pertain to personal data and confidential document control, depending on the methods of personal data processing and the physical media on which personal data are recorded and stored.

4. Conditions of and procedure for personal data processing at Gazprom

4.1. The processing of personal data at Gazprom is allowed in the cases provided in Article 6 of Law No. 152-FZ.

4.2. Gazprom shall not disclose to third parties or disseminate personal data without consent of the data subject, unless otherwise provided by Law No. 152-FZ.

4.3. Gazprom has the right to entrust a third party to process personal data with consent from the data subject on the basis of an agreement with such third party in accordance with the requirements of Part 3 of Article 6 of Law No. 152-FZ.

4.4. For the purposes of in-house information support, Gazprom may generate reference guides and other sources containing personal data of the data subject with the subject's written consent, unless otherwise provided by the laws of the Russian Federation.

4.5. Access to personal data processed at Gazprom is provided exclusively to the employees of Gazprom occupying the positions indicated in the list of positions at the structural units of Gazprom's administration, branches and representative offices the filling of which involves the processing of personal data (hereinafter referred to as the “List”).

4.6. Neither personal data of Gazprom's employees nor personal data of other data subjects that have their personal data processed at Gazprom can be transferred to third parties without written consent of the aforementioned data subjects, except for the cases where such transfer is required to prevent threat to life and health of data subjects, as well as in other cases provided by the Labor Code of the Russian Federation or by other federal laws.

4.7. Gazprom performs trans-border transfer of personal data in accordance with the requirements of Law 52-FZ and international agreements of the Russian Federation.

5. Rights of data subjects

The rights of data subjects are stipulated by the current laws of the Russian Federation and include the right to:

obtain information about their personal data undergoing processing at Gazprom to the extent provided by Article 14 of Law No. 152-FZ. The data subject may send a written request to Gazprom by regular mail to the address published in the “Contact us” section of Gazprom's official Internet site or by e-mail at gazprom@gazprom.ru in accordance with the procedure specified in Law No. 152-FZ;
access their personal data undergoing processing at Gazprom, including the right to obtain a copy of any record containing their personal data, unless otherwise provided by Law No. 152-FZ;
refine, block or destroy their personal data undergoing processing at Gazprom if such personal data are incomplete, outdated, inaccurate, illegally obtained or inessential for the stated purpose of processing;
revoke their consent that was granted to Gazprom with regard to personal data processing;
take action to protect their rights as provided by law;
appeal against Gazprom's action or inaction violating the laws of the Russian Federation with regard to personal data to a body authorized to protect the rights of data subjects or to a court;
submit a request urging Gazprom to cease the transfer (dissemination, provision, access) of their personal data the dissemination of which was previously permitted by the data subject;
exercise other rights provided by the laws of the Russian Federation.

6. Measures taken by Gazprom to fulfill operator duties during personal data processing

6.1. Gazprom takes essential and sufficient measures to ensure the fulfillment of operator duties in accordance with the laws of the Russian Federation on personal data that include the following:

appointing a person responsible for the arrangement of personal data processing at Gazprom;
issuing local regulations related to the processing and protection of personal data;
publishing this Policy on Gazprom's Internet sites, including the pages of Gazprom's sites which are used to collect personal data;
obtaining consent from data subjects to process their personal data, unless otherwise provided by the laws of the Russian Federation;
informing data subjects or their representatives about the availability of personal data related to such subjects; providing access to these personal data upon the relevant inquiry and/or request from the aforementioned data subjects or their representatives, unless otherwise provided by the laws of the Russian Federation;
exercising internal control over the compliance of personal data processing with the provisions of Law No. 152 and relevant statutory acts, requirements to personal data protection, this Policy, and Gazprom's local regulations;
assessing the damage that can be caused to data subjects in the event of violation of the laws of the Russian Federation on personal data, as well as assessing the balance between the aforementioned damage and Gazprom's measures aimed at ensuring the fulfillment of obligations provided by the laws of the Russian Federation on personal data;
arranging training and guidance support for the employees of Gazprom occupying the positions indicated in the List;
separating personal data processed manually from other information, including by recording such data on separate physical media for personal data, in special sections or fields of form sheets (letterheads);
providing for the separate storage of personal data and corresponding physical media processed for different purposes and containing different categories of personal data;
ensuring the safety of personal data transmitted via open communication channels;
safekeeping physical media on which personal data are stored in accordance with the conditions of preserving the personal data and preventing unauthorized access thereto;
terminating personal data processing and destructing personal data in the cases provided by the laws of the Russian Federation on personal data;
other actions provided by the laws of the Russian Federation on personal data.

6.2. The measures for the protection of personal data undergoing processing in personal data information systems are established in accordance with Gazprom's local regulations, which govern issues related to personal data protection in the course of processing by means of personal data information systems of Gazprom.

7. Internal control over compliance of personal data processing with provisions of Law No. 152 and relevant statutory acts, requirements to personal data protection, this Policy, and Gazprom's local regulations

7.1. Internal control over the compliance of personal data processing with the provisions of Law No. 152 and the relevant statutory acts, requirements to personal data protection, this Policy, and Gazprom's local regulations is exercised by the person responsible for the arrangement of personal data processing at Gazprom in accordance with the procedure outlined in Gazprom's local regulations on personal data.

7.2. Persons who violate the provisions of the laws of the Russian Federation and local regulations of Gazprom on personal data shall bear disciplinary, administrative, civil, and criminal responsibility in accordance with the laws of the Russian Federation.