Withdrawing Data Consent After Dismissal

Short version: if a dismissed employee withdraws consent to the processing of personal data (PD, meaning information that identifies a person), the employer must stop unnecessary processing and destroy data it no longer needs within 30 days.

Personnel records and tax data stay: withdrawal does not apply to them.

Leaving the letter unanswered is risky, because the law sets deadlines and inspectors impose fines.

A typical scene: an HR manager or director receives the letter and decides to wipe the personnel file, or, on the contrary, drops the letter into a folder. Both choices create risk.

Below I cover which data the law requires an employer to keep and which to stop processing, the deadlines, the liability, and ways to build protection. The rules were checked against current texts as of October 2026.

Contents

• What withdrawal of consent means
• Withdrawal or demand: the response deadline
• What data to keep after dismissal
• What data to delete
• Action plan, day by day
• Act on destruction of data
• Fines and liability
• Case law
• How to protect your company
• Questions and answers

What Withdrawal of Consent Means

Consent to the processing of PD may be withdrawn (part 2, Art. 9 of Federal Law No. 152-FZ “On Personal Data”). The employer is called an operator under the law (an organization that processes data). It may keep processing without consent if the law provides another ground: paras. 2 to 11, part 1, Art. 6.

The employer must prove that such a ground exists (part 3, Art. 9). The reply to the employee and the internal documents serve as that proof.

Withdrawal or Demand: How to Determine the Response Deadline

The wording of the letter determines the rule and the deadline. Record the date of receipt on the day the letter arrives. A sample of the letter employees send is covered in the article for employees.

Employees rarely write by the book. More often it is something like “please delete everything and stop contacting me.”

If HR treats such a letter as a withdrawal (the data must then be destroyed within 30 days), while an inspector sees a demand under part 5.1, Art. 21 (processing must then stop within 10 business days), the deadline will be missed.

When in doubt, work to the nearest deadline:

1. Stop unnecessary processing and reply in writing within 10 business days.
2. If the employee attaches information showing the data is not needed, meet a 7-business-day deadline.
3. If you yourself see that there is no ground for processing, stop it within 3 business days and destroy the data within 10 business days (part 3, Art. 21).

A letter from the employee does not take away the employer’s right to process data on another lawful ground. This is provided in part 2, Art. 9 (for a withdrawal) and in part 5.1, Art. 21 (for a demand). When refusing to provide information, the employer gives a reasoned written reply that cites the provision of law (part 2, Art. 20).

What Data an Employer Keeps After Dismissal

Keeping data “just in case” with no ground is not allowed.

The main evidence for a court (hiring, dismissal and disciplinary orders, the employment contract, tax records) is already kept under the first two rows, and withdrawal of consent does not reach it.

The last row covers only non-archival materials and rests on a legitimate interest. It is acceptable only if the employee’s rights and freedoms are not infringed. We could not find case law on this ground in employment disputes, so this is the employer’s position. You will have to prove the balance of interests:

1. Prepare a written assessment.
2. Restrict access to such materials.
3. Set a specific destruction date.

Do not tie the date mechanically to the last day of the period: a court may restore a missed deadline (part 5, Art. 392 LC RF).

If a claim, a complaint to the labor inspectorate, or a lawsuit arrives before that date, the materials stay until the case ends (para. 3, part 1, Art. 6). If there is no dispute, they are deleted after the set date.

What Data to Delete After Consent Is Withdrawn

Under part 5, Art. 21 of Federal Law No. 152-FZ, after consent is withdrawn the operator stops processing and, if keeping the data is no longer necessary, destroys it within 30 days of receiving the withdrawal. The period may differ if the contract or another agreement with the employee provides so.

If destruction within the period is impossible, the data is blocked (access is temporarily closed) and destroyed within no more than six months, unless federal laws set a different period (part 6, Art. 21).

For each category of data, ask one question: does Art. 6 provide another ground that allows processing without consent? If it does not, processing stops. In practice, check five places:

Transfers the law requires (to the tax authority and state funds) are not canceled by the withdrawal.

Photos were usually posted with the employee’s consent, so they come down after withdrawal. If there was no consent, a person’s image may not be used: it is allowed only with that person’s consent, and an image distributed online may be demanded removed (paras. 1 and 3, Art. 152.1 of the Civil Code of the Russian Federation).

Employer Action Plan, Day by Day

The plan is built for the shortest possible deadline, so it works well as a company standard.

Steps 2 and 3 go quickly only if a data and purpose matrix is already in place (see the protection section below). Without a matrix, the inventory turns into a scramble, and the deadline is easy to miss.

1. Day of receipt. Register the letter, note the date and the way it arrived, and classify the wording using the table above. Assign a responsible person.
2. Days 1 to 2. List the employee’s data: where it sits (paper, HR software, accounting, email, messengers, website), for what purpose, and on what ground.
3. Within 3 business days. Sort the data into three groups: keep (citing the law), stop using, destroy. Record the ground in writing.
4. Within 5 business days. Stop unnecessary processing. Send contractors a written request to do the same. If you have concluded that processing is unlawful, the deadline to stop is 3 business days from that moment (part 3, Art. 21).
5. Within 10 business days. Prepare and send the employee a written reply: what was destroyed, what is kept, on what ground, and until when. The law does not always require a written reply, but you need it as evidence.
6. Within 30 days. Destroy data with no ground for retention and prepare destruction records: an act, and for data in software also an export from the event log. The content of these documents is described in the section on the act below.
7. If destruction is impossible. Block the data and destroy it within no more than six months (part 6, Art. 21).
8. Wrap-up. Put the letter, the data inventory, the decision for each group, the reply to the employee, the act, and the export into one file. This is your evidence base in case of an inspection.

If you need more time, send the employee a reasoned notice before the period ends. This is possible for demands under part 5.1, Art. 21 and for requests for information.

A single employee’s withdrawal, as a rule, does not change the information given in the processing notification. There is no need to report it to Roskomnadzor.

A notification is required in two cases (part 7, Art. 22 of Federal Law No. 152-FZ):

1. The information in the notification changes: report it by the 15th of the month following the change.
2. The company stops processing: report it within 10 business days.

Sample Reply to the Employee After Withdrawal of Consent

Dear [Name]! We received your letter dated [date] on [date]. Processing of your personal data for [purpose, for example, displaying your photo on the website] has stopped, and the data has been destroyed [date, act No. ___]. We continue to keep part of the data because the law requires it: personnel records (Art. 22.1 of Federal Law No. 125-FZ) for [period] and tax accounting data (subpara. 8, para. 1, Art. 23 of the Tax Code of the Russian Federation) for five years. This data is used only to meet those obligations, and access to it is restricted. [Position, signature]

Received a withdrawal and the clock is already running? Write to me through the request form or by messenger at +7 (902) 899-07-58. I will identify the rule and deadline, sort the data into “keep” and “destroy,” and prepare the reply to the employee.

Act on the Destruction of Personal Data: What to Include

The content of the act is set by para. 3 of the Requirements for Confirming the Destruction of PD (Roskomnadzor Order No. 179). The act states:

1. The name and address of the operator, that is, the employer.
2. The name and address of the person who processed the data on the operator’s instruction, if processing was outsourced.
3. The employee’s full name or other information that identifies the person.
4. The full name, position, and signature of the persons who destroyed the data.
5. The list of categories of destroyed data.
6. For paper: the name of the medium and the number of sheets. For data in software: the name of the information system the data was deleted from.
7. The method of destruction.
8. The reason for destruction, for example, withdrawal of consent by the employee.
9. The date of destruction.

An electronic act signed with an electronic signature is equivalent to a paper act (para. 4 of the Requirements). If the employer processes data in software, an export from the event log is attached to the act.

Keep the act and the export for three years from destruction (para. 8 of the Requirements). Roskomnadzor Order No. 179 (in Russian) of October 28, 2022 is valid until March 1, 2029. Roskomnadzor is the federal authority that oversees personal data processing.

Need a ready act and a check that nothing is missing? Send a request: I will prepare the act for your situation and check it against the Order’s requirements.

Fines and Employer Liability

An employer faces fines, a claim from the employee, and consequences for the employees at fault.

Administrative Fines

The fines are set by Art. 13.11 of the Code of Administrative Offenses (CAO), as amended on September 1, 2026. Which part applies depends on the circumstances. For the heavier fines for data leaks, see our analysis of a case of a ₽400K fine instead of ₽10M.

For individual entrepreneurs the fines are: ₽10,000–20,000 under part 3, ₽20,000–30,000 under part 4, and ₽20,000–40,000 under parts 5 and 6.

Repeat violations are fined more heavily. Under part 1.1 legal entities face ₽300,000–500,000, under part 2.1 from ₽1 million to ₽1.5 million, and under part 5.1 the same ₽300,000–500,000 (officials face ₽30,000–50,000 under part 5.1).

Compensation for Moral Harm

Moral harm caused by a violation of the rights of a PD subject or of the processing rules must be compensated (part 2, Art. 24 of Federal Law No. 152-FZ). The claimant may also invoke the labor rule: moral harm caused by the employer’s unlawful actions is compensated in money, and in a dispute the court sets the amount regardless of any property damage (Art. 237 LC RF).

The Supreme Court Plenum states that when setting the amount, a court considers the importance of the violated non-material interests to the employee, the scale of the violation, and the employer’s degree of fault (para. 47 of Resolution No. 33 of November 15, 2022, in Russian). A claim for compensation may also be filed at the claimant’s place of residence (para. 58 of the same resolution), so an employer sometimes has to defend itself in the court where the former employee lives.

Internal Liability

Persons at fault for violating personal data law when processing employee data face disciplinary and financial liability, as well as civil, administrative, and criminal liability (Art. 90 LC RF). It is worth writing this duty into the job descriptions of the responsible person and of HR staff.

Case Law: Storage, Destruction, Compensation

Below are rulings whose text has been checked against the primary source.

Ruling of a Supreme Court judge of March 21, 2017, No. 91-AD17-2 (in Russian)

The case. An organization was held liable under Art. 13.11 CAO (in the wording in force at that time). It was charged with failing to destroy borrowers’ questionnaires after the purpose of processing was reached (part 4, Art. 21) and with unsafe storage.

What the court held:

1. Storing paper media with PD in cardboard boxes in an unlocked cabinet violates part 1, Art. 19 of Federal Law No. 152-FZ. Arguments about restricted access to the room and the absence of unlawful access had no legal significance.
2. Failure to destroy data is not a continuing violation. The limitation period runs from the day after 30 days from the date the purpose was reached.
3. The date the purpose was reached was not established in the case. Irremovable doubts were resolved in favor of the organization (Art. 1.5 CAO), and the finding of non-destruction was removed from the court acts.

Caveat. The conclusion on storage was made under the previous wording of Art. 13.11. Today part 6 governs paper media and requires consequences (see the fines table).

What an employer should do:

1. Document the dates of receipt of the withdrawal, of reaching the purpose, and of destruction: for a withdrawal (part 5, Art. 21) the period also runs from a specific date.
2. Write down and follow the way media are stored. Locks and media records remain a duty under part 1, Art. 19, even though a fine under part 6 arises only when there are consequences.

Supreme Court Plenum Resolution of November 15, 2022, No. 33 (in Russian)

What it says.

1. Paragraph 46: an employee may claim compensation for any violation of labor rights by the employer’s unlawful action or inaction.
2. Paragraph 47: the amount depends on the importance of the violated non-material interests to the employee, the scale of the violation, and the employer’s degree of fault.

Ruling of a Supreme Court judge of May 15, 2025, No. 18-AD25-20-K4 (in Russian)

The case. A former employee complained to Roskomnadzor that her employer had given an employment center information about her work history without her consent. The center requested it for a court case in which it sought to recover unemployment benefits from her. Roskomnadzor refused to open a case under part 2, Art. 13.11 CAO.

What the court held:

1. The Supreme Court upheld the refusal. The employer lawfully provided the work history and declined to issue a copy of the work record book containing excess data.
2. The employee had given consent, but the court added that participation in court proceedings and the administration of justice permit processing without consent (para. 3, part 1, Art. 6 and subpara. 6, para. 2, Art. 10 of Federal Law No. 152-FZ).

What an employer should do. Answer a request from a court or a state body in a court case within what is needed: provide the work history, but not copies of documents with excess data. Processing in connection with court proceedings is allowed without consent, so a withdrawal of consent, as a rule, does not get in the way.

Ruling of the Supreme Court of February 18, 2025, No. 5-KG24-144-K2 (in Russian)

The case. A citizen demanded that a bank stop processing his data and making advertising calls, but the calls continued. He asked the court to declare the bank’s actions unlawful and to award ₽5,000 in moral harm compensation. Three court instances refused. The case is not an employment case, but the logic applies to any operator.

What the Supreme Court held:

1. Calls after receipt of a demand to stop are unlawful. The tortfeasor’s fault is presumed until he proves otherwise (para. 12 of Plenum Resolution No. 33; para. 2, Art. 1064 of the Civil Code of the Russian Federation).
2. The claimant must prove the fact of the violation and that the defendant committed it.
3. The claimant’s reference to personal data law instead of Civil Code norms is not a ground to refuse: the court determines which norms apply.
4. The decisions were set aside and the case was sent for a new hearing.

What an employer should do. After receiving a demand to stop processing, do not continue “until it is sorted out.” A court will presume the employer’s fault, and the employer will have to prove the absence of fault.

How to Protect Your Company From Roskomnadzor Fines

Protection is built in advance, before the first withdrawal.

The goal is to reduce the chance of claims and to keep documents ready for an inspection.

The law lists the measures an operator must take (Art. 18.1 of Federal Law No. 152-FZ). For an employer they come down to this set:

1. A responsible person and a policy. The head of the company appoints by order the person responsible for organizing PD processing and approves a processing policy, which must be published. HR keeps the request log and the templates. Roles are recorded in the order and in the job descriptions.
2. A data and purpose matrix. For each purpose, set out in an internal document the data composition, the system where it sits, the ground under Art. 6, the retention period, and the destruction procedure. Such a document may not restrict the rights of PD subjects (part 1, Art. 18.1).
3. Signed acknowledgment. Employees must be familiarized, against signature, with the documents on how their PD is processed and on their rights (Art. 86 LC RF). The procedure for storing and using the data is set by the employer (Art. 87 of the same code).
4. Consents and grounds. State the purposes in the consent, and for each category of data record the Art. 6 ground that will still apply after withdrawal.
5. Processor contracts. The law requires an instruction to process data to define lists of data and operations, purposes, confidentiality, and protection measures (part 3, Art. 6). Add a duty to destroy data on your request within a short period and to confirm this by a document. Otherwise a cloud accounting service or a CRM (customer relationship management software) may drag out its reply, and the employer gets the fine. Review your current contracts.
6. System settings. Separate access rights in the CRM and accounting software, set accounts to close on the day of dismissal, and set unnecessary copies to be deleted. After that, a withdrawal stops being manual work for a lawyer on each departing employee. If an employee leaves for a competitor, the client base is additionally protected by a trade secret regime.
7. Request log and templates. Start a log and keep ready forms: a reply to a withdrawal, a notice of extension, and an act of destruction.
8. Safe storage. Locks, media records, and restricted access (part 1, Art. 19). If careless storage leads to a leak or loss, the organization faces a fine under part 6, Art. 13.11.
9. Training and internal control. Train HR and accounting staff on the law and run internal checks. Assess the harm that violations of the law may cause to employees.

If a complaint has already reached Roskomnadzor, the operator must provide the regulator with the necessary information within 10 business days of receiving the request (part 4, Art. 20).

The period may be extended by 5 business days with a reasoned notice.

Attach to the reply to the regulator:

1. The letter to the employee.
2. The list of data with grounds.
3. The act of destruction.

Four Employer Mistakes When Consent Is Withdrawn

1. Destroying everything. You would breach the duty to keep personnel and tax records.
2. Leaving the letter unanswered. The period runs from receipt, and a written reply stating the grounds becomes your evidence.
3. Replying with a template. A reference to the law without a list of data and grounds proves nothing to the employee or to the inspector.
4. Forgetting copies and processors. The data remains in accounting software, in messengers, and with contractors, although part 5, Art. 21 requires processing to stop with them too.

How a Lawyer Helps an Employer When Consent Is Withdrawn

When a withdrawal arrives, there is usually no time for a long review. I take on:

1. A list of the employee’s data with the ground for each category.
2. The decision on what to keep, what to stop processing, and what to destroy.
3. A written reply to the employee and a reply to a Roskomnadzor request.
4. The act of destruction and the content of the event-log export under Order No. 179.
5. A policy, internal documents, consent forms, and an internal withdrawal procedure, so the next letter does not become a fire drill.

Contact me right away if at least one of these applies:

1. The reply deadline is already running, and the data has not been sorted.
2. The employee threatens a complaint to Roskomnadzor or a lawsuit.
3. A Roskomnadzor request has arrived.
4. The company has no PD processing policy and no data matrix.

I work with employers on labor disputes and through a subscription legal service: the procedure and templates are set up once, and every later withdrawal is handled by a ready scheme.

Frequently Asked Questions

How soon must an employer destroy data after consent is withdrawn?

No later than 30 days from receipt of the withdrawal, if keeping the data is no longer necessary (part 5, Art. 21 of Federal Law No. 152-FZ).

Other deadlines:

1. If destruction within that period is impossible, the data is blocked and destroyed within no more than six months (part 6, Art. 21).
2. If the employee demands that processing stop, the deadline is 10 business days (part 5.1, Art. 21).

What fine does an employer face for ignoring a withdrawal of consent?

It depends on the part of Art. 13.11 CAO:

1. For failing to meet the deadline on a demand to destroy unnecessary data (part 5): ₽8,000–20,000 for officials and ₽50,000–90,000 for organizations.
2. For processing without a lawful ground (part 1): ₽150,000–300,000 for organizations.

A repeat violation is punished more heavily.

Can an employer refuse to delete a personal file?

Yes, if it is part of personnel records.

Their retention period is set by Art. 22.1 of Federal Law No. 125-FZ, and the employee’s consent is not needed for this (part 2, Art. 9 and para. 2, part 1, Art. 6 of Federal Law No. 152-FZ). Name this ground in the reply to the employee.

Must a former employee’s photo be removed from the website?

As a rule, yes.

The photo was usually posted with the employee’s consent, and after withdrawal processing stops (part 5, Art. 21 of Federal Law No. 152-FZ). If there was no consent, under para. 3, Art. 152.1 of the Civil Code of the Russian Federation, a person may demand removal of an image distributed online.

How do we confirm that data was destroyed?

With an act of destruction. For data in information systems, an export from the event log is added to it (Roskomnadzor Order No. 179).

The act and the export are kept for three years from destruction (para. 8 of the Requirements approved by the Order).

What should we do if the employee complains to Roskomnadzor?

Reply to the request within 10 business days (part 4, Art. 20 of Federal Law No. 152-FZ). Attach to the reply:

1. The letter to the employee.
2. The list of data with grounds.
3. The act of destruction.

If you need more time, send a reasoned notice of extension before the period ends.

Can we keep a dismissed employee’s data in case of a future dispute?

The main documents (orders, the employment contract, the personal file, tax data) are kept by law, and withdrawal of consent does not apply to them.

For non-archival correspondence and work files, for the period while a claim is still possible, the employer relies on a legitimate interest (para. 7, part 1, Art. 6) and the deadlines of Art. 392 LC RF: one month for dismissal disputes, three months for other disputes, one year for pay disputes.

This is the employer’s position: it needs a written balance-of-interests assessment, restricted access, and a destruction date. If a dispute has already begun, the ground is para. 3, part 1, Art. 6, and a court may restore a missed deadline.

Read Also

• Data Leak: ₽400K Instead of ₽10M — what a personal data leak can cost
• Dismissal for Forwarding Files: Three Employer Safeguards — where the line falls between an employer’s rights and data protection
• Trade Secrets: Protecting Your Client Database — what to do with data when an employee leaves for a competitor
• How to Withdraw Consent to Personal Data Processing After Dismissal — what an employee’s letter looks like: sample and next steps

Received a withdrawal of consent, or want to set up the procedure in advance? Write to me: I will review what employee data you process and on what grounds, and prepare the reply to the employee and the act of destruction. Details on the subscription legal service page.