Need to obtain a license to process personal data?

Question

Startups

An Internet service is being developed that can be used by both ordinary users and companies. Companies will provide data to users for a fee.
I understand that it is necessary to obtain a license for the processing of personal data? Should data be encrypted? What documents to follow? How should the user agreement be drawn up?
Tell me, please, in which direction to google.

Answer 1

First, you need to determine which category of personal data processing your company belongs to. habrahabr.ru/post/107576
Next, write out all the personal data that you receive from the User. Determine the positions and third parties (companies) that process certain data, create a commission, appoint a responsible person, describe where and how it is stored, what and how it is protected, create a Regulation on the processing of personal data, give all employees to sign, make instructions, do The company's policy regarding the processing of personal data, post it on the site, create Consent to the processing of personal data for users, take all acts on the termination of the processing of personal data. data. Yes, there are many, in general.

Answer 2

There is no "License for the processing of personal data" and never was.
Starting the processing of PD, you become an "Operator", your users are "PD subjects"
Read 152-Federal Law as fundamental.
Government Decree No. 1119, in order to determine what level of PD security you need to provide FSTEC
Order No. 21, in order to understand what measures (in addition to those described in 152-FZ and PP-1119) you need to apply.
378