Order No. 180

Costly Mistakes: How Russian Businesses Risk Millions in Fines for Personal Data Violations

A year after stricter Russian personal data protection fines took effect, many entrepreneurs continue to commit violations that could trigger multimillion-ruble penalties from Roskomnadzor. The article details ten common breaches, including the prohibited use of Google Forms for data collection, missing cookie banners, absent or invalid consent forms under forms, and failure to obtain separate consents for publishing reviews. Additional violations cover missing privacy policies, outdated notifications to Roskomnadzor, improper transfer of employee data to third parties without written consent, lack of data processing agreements, and absence of records for paper-based data storage locations. Each violation is explained with direct references to the Law on Personal Data, the Code of Administrative Offenses, and specific government orders, along with exact fine ranges for citizens, individual entrepreneurs, and legal entities. Practical remediation steps are provided, such as replacing foreign services with Yandex Forms, drafting compliant consent texts per Article 9, and submitting updated notifications under Order No. 180. The guidance emphasizes conducting a full site audit and implementing all required documents to avoid penalties throughout 2026.