Costly Mistakes: How Russian Businesses Risk Millions in Fines for Personal Data Violations
A year after new fines for personal data protection violations came into force in Russia, many entrepreneurs still risk multimillion-ruble penalties from Roskomnadzor. The most frequent breaches involve improper collection, storage, and processing of personal data of Russian citizens.
Violation 1: Using Google Forms
Despite repeated warnings at conferences and webinars, businesses continue to use Google Forms. All personal data must be recorded, systematized, accumulated, stored, and processed using databases located on Russian territory under Part 5 of Article 18 of the Law on Personal Data. Google’s servers are located outside Russia, violating localization requirements. Recommended fix: replace with domestic alternatives such as Yandex Forms. Fines range from 30,000–50,000 rubles for citizens and 1–6 million rubles for individual entrepreneurs and legal entities under Part 8 of Article 13.11 of the Code of Administrative Offenses.
Violation 2: Missing Cookie Banner
If a website uses cookies without displaying a proper banner, it violates the law because cookies qualify as personal data. The recommended banner text informs users about cookie usage for analytics and links to the privacy policy. Fines start at 10,000–15,000 rubles for citizens and reach 150,000–300,000 rubles for legal entities.
Violation 3: No Consent Under Data Collection Forms
Many sites lack valid consent for processing personal data or link only to a privacy policy instead. Consent must meet requirements of Article 9, including specific purpose, list of data, and validity period, plus a checkbox with linked consent text. Fines are identical to those for missing cookie banners.
Violation 4: Publishing Reviews Without Distribution Consent
Publishing reviews containing personal data without separate consent for dissemination violates Article 10.1. Consent must follow the form approved by Order No. 18, and the privacy policy must disclose processing conditions and any prohibitions set by the data subject.
Violation 5: Missing or Non-Compliant Privacy Policy
Every operator must publish a privacy policy in the site footer and under every data collection form, detailing categories of data, purposes, retention periods, destruction procedures, and third-party recipients per Part 2 of Article 18.1. Fines range from 1,500–3,000 rubles for citizens to 30,000–60,000 rubles for legal entities.
Violation 6: No Notification or Outdated Notification to Roskomnadzor
Operators must notify Roskomnadzor before processing personal data and keep the notification current using the form from Order No. 180 of 28 October 2022. Fines reach 100,000–300,000 rubles for legal entities.
Violation 7: Transferring Employee Data Without Separate Written Consent
Employers may not disclose employee personal data to third parties without written consent for each specific purpose, as required by Article 88 of the Labor Code and Part 4 of Article 9. Fines range from 100,000–300,000 rubles for individual entrepreneurs and 300,000–700,000 rubles for legal entities.
Violation 8: No Data Processing Agreement with Third Parties
When personal data are entrusted to third parties (mailing services, etc.), a separate agreement must list the data, operations, purposes, and confidentiality obligations per Part 3 of Article 6. Fines are the same as for missing cookie banners.
Violation 9: No Document on Paper Data Storage Locations
Operators must maintain a document specifying storage locations of paper-based personal data carriers and the list of persons with access, according to Government Resolution No. 687 of 15 September 2008. Fines range from 1,500–4,000 rubles for citizens to 50,000–100,000 rubles for legal entities.
Violation 10: Failure to Respond to Data Subject or Roskomnadzor Requests
Operators must respond within statutory deadlines under Article 21. Appointing a responsible person and maintaining clear internal instructions helps ensure timely replies. Fines range from 2,000–4,000 rubles for citizens to 50,000–90,000 rubles for legal entities.
A comprehensive audit followed by development and implementation of all required documents remains the most reliable way to eliminate these risks and protect profits in 2026.
Related articles
Russia Ready to Disclose Source Code of Social Networks, Messengers and AI Models, Minister Shadaev Says
Russian Minister of Digital Development Maksut Shadaev announced that Russia is prepared to open the source code of its domestic social networks, messengers and video services to foreign partners. The offer includes showing the internal structure of the platforms and jointly modifying their algorithms. Shadaev compared reliance on Western IT products to digital colonialism, citing years of disagreements over compliance with Russian legislation. A similar proposal was made for Russian AI foundation models, which could be adapted to meet other countries' laws, cultural requirements and security standards. The statement was delivered at the Platform of Sovereign Development exhibition, yet no specific products, repositories, timelines or licensing terms were provided.
Russia Mulls Mandatory Two-Week IMEI Registration for Foreign Smartphones via Gosuslugi
Russian authorities are discussing a new rule requiring owners of smartphones imported without customs clearance or purchased abroad to register the devices through the Gosuslugi portal within two weeks. Failure to register would result in the device being blocked from Russian mobile networks. The Ministry of Digital Development is preparing the requirements, which remain under discussion with possible changes to timelines and details. Devices already operating in Russia before April 2027 would be exempt and continue working without restrictions. Officially imported equipment would be added to the registry automatically. The measure is expected to significantly impact gray-market sellers, potentially forcing up to 70 percent of them out of the market and driving price increases of up to 40 percent for some models.
Google Opens Registration for Registered App Stores Program to Simplify Third-Party App Installs on Android
Google has opened registration for its new Registered App Stores program, enabling approved third-party app stores to install applications with a single tap and perform background updates on Android devices. The program introduces stricter compliance requirements, including an annual $10,000 registration fee paid before review, mandatory submission of all APK files and updates for malware scanning, and organizational verification. These features will become available starting December 1, 2026, on devices running Android 17 QPR2 and newer versions, with Russia listed among supported countries. Stores that remain outside the program can continue using the existing multi-step installation process. Google will impose additional fees if more than 1% of installation attempts or 2% of catalog applications are flagged as potentially malicious within any 30-day period. The initiative aims to balance user convenience with enhanced security controls while remaining entirely voluntary for alternative app distributors.
Mobile Internet Slowdowns Reported in Central Moscow as Content Filtering Systems Activate for Summits
Residents in central Moscow reported noticeable degradation in mobile internet performance starting October 27, coinciding with the first day of possible restrictions announced by the Ministry of Digital Development. The measures involve content filtering systems deployed to comply with Russian legislation and ensure security during the Gas Exporting Countries Forum and Russia-Africa summits. Two Speedtest measurements shared via the Ostorožno, Moskva channel showed speeds dropping from 225.47 Mbit/s to 12.13 Mbit/s, though exact locations, operators, and test conditions remain unspecified. The ministry indicated that restrictions inside the Third Transport Ring could occur daily from 11:30 Moscow time on October 27-28 and from 9:30 on October 29. Access to resources in the approved whitelist is expected to remain available, while voice calls, fixed broadband, and Wi-Fi should continue without interruption. The practical recommendation for visitors is to download necessary maps, tickets, and documents in advance before traveling to the affected area.