Website hosting, how not to violate 152-FZ?

Question

Law in IT

Hello!
I am interested in such a question as how to host a site with a hosting provider (in the Russian Federation) and at the same time not violate 152-FZ and the provisions of PP 1119 on:
- organizing a security regime for the premises in which the information system is located, preventing the possibility of uncontrolled penetration or stay in premises of persons who do not have the right to access these premises;
- ensuring the safety of personal data carriers;

I have a small wordpress site, MySql database, Ubuntu OC from pdn: login, e-mail, ip, cookies, and the name of the organization can sometimes appear as the name of the individual entrepreneur. I don’t understand how to execute PP 1119 in this case? How do people generally work? Really all in the protected clouds leave? There are not so many of them, and sites with PD are all the time. Especially if you read the contracts with these clouds, they are also not responsible for anything.

Answer 1

well the provider let also executes.
translate these norms into an agreement with him

Answer 2

Not an answer to the question, just as an option, to score on the fact that there are 152-fz.
Any Yandex metrics do not receive the user's consent that the metric captures data on their movement with the mouse on the site and matches cookies (although they do not give all the information to the site owner, but they themselves process and take into account when displaying ads in direct).
You may not be registered with Yandex at all and search exclusively with Google, but the metrics on sites without asking your permission collects information about which sites you visit and takes it into account when generating advertising in direct.

Answer 3

from pdn: login, e-mail, ip, cookies

This is not PD. From the word at all. Is it possible to find who it is by the login vasyapiskin with soap [email protected] and the IP of the Dutch VPS? No...

Answer 4

If it is not possible to refuse the collection of personal data, then the information resource becomes an information system of personal data, and the owner of the information resource becomes the operator of personal data. The operator is responsible for fulfilling the requirements for the protection of personal data, and in accordance with 152 FZ, the operator has the right to entrust the processing of personal data to another person on the basis of an agreement. The contract must define a list of actions performed with personal data, as well as the obligation of such a person to maintain confidentiality and ensure the protection of personal data, indicating the requirements for the protection system in accordance with Article 19 of Federal Law 152-FZ. The Cloud4Y Cloud Provider Agreement contains all the necessary obligations for the protection of personal data,
You can read more here https://www.cloud4y.ru/cloud-hosting/oblako-fz-152/

Answer 5

Why the hell do you need all this?
Email IP and cookies are not personal data