Our site collects customer data: where do we start with the 152-ФЗ personal data law?

The technical detail people overlook most is the physical location of the database. If you use WordPress or a custom build, even if the hosting server itself is in Russia, sometimes a form plugin will back up data to a third-party cloud service abroad. You haven't truly resolved the issue with consent forms until you verify that the primary storage disk is located within Russia.

edit: I wrote something wrong above, sorry about that.

There are four things you need to audit on your site immediately: 1) The checkbox on the form must never be checked by default. 2) The privacy policy text cannot be generic; it must include your company's full legal name and tax ID. 3) A cookie consent banner must be implemented. 4) The specific purpose of processing user data and the retention period must be explicitly stated.

We got a similar audit warning last year. We paid a local specialist 45.000 RUB to draw up internal policies and sort out our Roskomnadzor registration properly. Once the required paperwork was in order, the notification approval took about two weeks. No need to splurge on overpriced agency packages, but filling out the document templates correctly is an absolute must.

make sure the checkbox on your form is unchecked by default so users have to tick it themselves. people used to pre-check it back in the day, but now inspectors crawl forms with bots specifically checking if it's pre-ticked or not.

Edit: asked below, I wrote the answer in the second message.

Are the forms on the site hooked up to a CRM, or do submissions just land in a corporate email inbox? Is your mail server hosted with a Russian provider, or are you using a global service? That distinction is critical for the technical localization requirement.

The "we only do B2B, we collect company data not personal data" defense doesn't hold up. If your form asks for a first name, last name, and personal phone number, that record counts as personal data, period. Most audits are triggered by competitor reports or automated site scrapers, so get your legal texts sorted on the site without delay.

Adding a checkbox below the form and linking it to your customized privacy policy will take you two hours at most—do that first.

I went through the same thing two years ago. Payment information changes are never verified through the channel they came from.

Any unwritten clause becomes a point of disagreement later, as both sides remember it differently. Of course, it varies if your situation is different.

Exactly like that. honestly security isn't absolute; it's about making attacks not worth the effort.

If you get three different answers on a topic, the question was asked wrong. I mean if I were you, I'd go this route.

I went through the same thing. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

The biggest time-waster for us was not knowing who had the final say. If you have questions, write them; I'll answer as best I can.

Noted, thanks.

Let me share my experience. Having backups accessible on the same network and with the same identity makes them part of the target.

If you have questions, write them; I'll answer as best I can.

Here's how it went for us. Processes without records never improve, because you don't know what to fix.

Correct me if I'm wrong.

I was thinking the same thing. An automated scan report is not the same as a penetration test.

Thanks, this was very helpful. The harder it is to reverse a decision, the slower you should make it.

i'm currious too.

Three different views emerged, they all complement each other. Trying to do this alone is the most expensive way.

Let me summarize what's been said so far. The harder it is to reverse a decision, the slower you should make it.