The State Duma has adopted a bill that will allow banks and other financial organizations to transfer work with confidential data to third-party IT companies. Contractors will be able to process banking secrets, personal client data, and other restricted information, including through cloud services. Separate consent from each client for such a transfer will not be required. The law is expected to come into force one year after its official publication.
The rules apply not only to banks but also to insurance companies, non-state pension funds, and credit history bureaus. However, data transfer will be allowed not to any contractors, but only to accredited IT companies and state-owned banks with a universal license.
A separate rule is provided for subsidiaries of foreign banks — they will be able to entrust data processing to a foreign credit organization. This will require approvals from the Central Bank, FSB, and Rosfinmonitoring, as well as compliance with a number of conditions, notes Ilya Shalenkov, partner at Kept.
Before transferring data, the bank must notify the Central Bank and provide a conclusion based on the results of the contractor's security audit. Such an audit must be conducted by an organization licensed by FSTEC or FSB. Information can be transferred 60 days after notification, if the regulator does not prohibit the transfer during this time. The contractor's servers must be located in Russia, and the company itself must undergo an annual audit. In addition, according to Shalenkov, it must report cybersecurity incidents within two hours.
Olga Blednova, an expert in digital transformation of the financial sector, believes that the law legislatively formalizes a practice that banks already use — attracting IT contractors and cloud services. Previously, the transfer of banking secrets to third-party companies was restricted, so some similar solutions, according to her, had to be used in legal uncertainty.
Banking secrecy will remain restricted access information, and performers will have to comply with established data protection requirements.