The paper studies the problems of correctly choosing certificated data protection facilities for information, not comprising state secret, processed in the information systems of personally identifiable information, according to the requirements of current regulatory and procedural documents of FSTEC of Russia.