Is it necessary to certify a program that works with personal data?

Question

Law in IT

Good day to all!
I have a question. My father works in a professional lyceum (municipal organization). Once upon a time I wrote him a program for accounting for students. The database contained full name, year of birth, group, orders for enrollment, expulsion, etc. The program searched the database (by full name, group, rikaz) and allowed you to create all sorts of certificates and reports on the database in one click. The program is simple. It is being worked on by several people.
Since the database contains personal data, does it need to be somehow certified or attested?

Answer 1

Good day.
It is necessary to certify the computer itself, from which PD is processed. Or forcibly oblige all subjects of personal data to renounce confidentiality (as the website of Russian Railways, State Services does ..)
Another option is to prescribe low danger indicators for personal data in the "Threat Model" developed for any personal data system (computer).