Information Security & Data Privacy

Yandex has a designated Information Security Department that implements security standards, monitors vulnerabilities, and investigates incidents to protect our infrastructure and services. This work is governed by Yandex’s Information Security Policy, Incident Management Policy, and other internal guidelines. The results are assessed by the Yandex executive management team.

At Yandex, every employee is responsible for safeguarding user data, and improper handling of personal or confidential information is a violation of the Yandex Group Code of Business Ethics and Conduct. At the executive level, data privacy is overseen by the Chief Privacy Officer (CPO), who coordinates between the Information Security Department and trained specialists within each business unit responsible for managing user data. To ensure proper employee conduct, we provide training on data protection, confidential information handling, and anti-phishing skills.

Cybersecurity risk monitoring is a continuous process that is accompanied by proactive measures to detect vulnerabilities, such as sensitivity testing, as well as clear protocols on how to act in case an incident has occurred. While we have been working hard over years to build secure, reliable systems that make such incidents highly unlikely, there is always a negligible chance we want to be vigilant about. We believe honest communication is the key to minimizing damage and are therefore committed to informing our users immediately if their data has been compromised.