Provider Rights and Core Obligations
A qualified trusted-services provider is entitled to provide one or more qualified or other trusted services defined by the law and to set the corresponding fee. At the same time the law imposes on it a strict block of obligations: it must draw up internal statutes and ensure their public availability for every service it provides.
The internal statutes must reflect: a description of the secure systems, means and procedures used; the grounds and scope of liability insurance, including compensation for damage caused by cessation of activity; the period and procedure for storing all necessary information; the procedure for cessation of activity and its transfer to another person; the amount of the fee, the payment procedure and the procedure for possible changes; and any other conditions established by the technical regulation. The provider notifies the supervisory organ and its consumers of any change in the statutes at least 14 calendar days in advance, and of an intended cessation of service at least 30 calendar days in advance — otherwise it is obliged to compensate the damage caused by non-notification.
The operational requirements are equally exact: the use of only secure systems, means and procedures ensuring reliability, data integrity, verification of authenticity and protection from forgery and unauthorised use; sufficient financial and technical resources and qualified personnel in accordance with the technical regulation; personal-data protection and information-security incident management; civil liability insurance (for an administrative organ — sufficient financial resources and guarantees); a service-continuity plan submitted to the organ; and notification of the organ of any breach of system security or data integrity within no more than 24 hours. Compensation of damage caused by non-observance of the requirements is obligatory, save for force-majeure circumstances.