Website collects customer data: what does 152-FZ require and where do we start?

The server location is your most urgent issue. As long as the database stays in Germany, you're directly violating data localization rules, even if you draft all the other documents. Prioritize moving the database and website to a cloud provider inside Russia.

The three most common mistakes small websites make: 1) Leaving form checkboxes pre-checked, 2) Copy-pasting a privacy policy from another site without updating the tax ID and company name, 3) Collecting unnecessary data on order forms, like birthdates or national IDs.

We went through a similar process for our own e-commerce site last fall. Switching to a local Russian cloud server cost us 3,500 rubles a month. We paid 25,000 rubles to a local law firm to draft the contracts and policy texts, and the entire compliance process was wrapped up in two weeks.

Simplify your forms right away. If all you need for cake delivery is the recipient's name, phone number, and address, remove the rest. The law also restricts collecting unnecessary data. The less data you keep, the lower your risk during a potential audit.

move that server out of germany asap and once roskomnadzor sends a warning letter dealing with legal defense gets way more expensive also dont forget the links under your forms.

Consultants usually try to panic small shop owners into buying pricey advisory packages. For a bakery with 3,000 customers, grabbing official templates and localizing your forms is plenty; no need to spend hundreds of thousands of rubles on compliance projects.

Legally speaking, having documents on your website alone is not enough; your business must also keep stamped internal records appointing a data protection officer and detailing data processing guidelines. Auditors will request physical copies of these during an inspection.

Thanks for posting.

Do you think this works at any scale? People defend habits, not processes. Resistance comes from there.

Quick summary for newcomers: Everything goes well for the first three months; problems arise in the fourth.

That's all, sorry if I went on too long.

i feel the same way. if it's your first time start small; scalig comes later.

if I were you, I'd go this route.

There's a trap here, let me mention it. Most time waste accumulates in tasks waiting for approval.

If you post the result here, it will help others too.

The opposite happened to me, that's why I'm writing. Taking notes for two weeks yields better results than a six-month estimate.

If you have questions, write them; I'll answer as best I can.

You're right.

I was thinking the same thing. When you try to change everything at once, nothing settles.

The real issue isn't the number, but what it's based on. Hope this helps.

I'm writing this so you don't make the same mistake. Don't hesitate to ask; those who don't ask always pay more.

Let me summarize the topic, since several different answers were given. Forgotten test environments are more often the entry point than live systems.

An untested backup is not a backup. I'm also curious if anyone does it differently.

I've been dealing with this for a long time. If 2FA is on, a stolen password alone is useless.