Legal Documentation for Websites: Privacy Policy & Consent

Short answer: what legal documents does a site need under Russian law?

Any site that collects personal data from users is required to have a privacy policy and a mechanism for obtaining consent to data processing. This is a requirement of Federal Law No. 152-FZ “On Personal Data”. Lack of documentation entails fines of up to several million rubles, and, taking into account the 2024–2025 amendments, increased liability for repeated violations and data leaks.

Mandatory documents under 152-FZ: minimum requirements

Every website owner who collects at least a name and email address through a feedback form is a personal data operator. The minimum set of documents includes:

• policy regarding the processing of personal data (must be published on the website);
• consent form for the processing of personal data;
• notification of Roskomnadzor of the intention to process personal data (except for cases of withdrawal);
• internal local acts defining the procedure for processing and protecting data.

Key facts: deadlines, fines and regulatory authority

• The supervisory authority is Roskomnadzor.
• Fines for legal entities - from 60,000 to 6,000,000 rubles (taking into account the 2024 amendments for data leaks - up to 15,000,000 rubles and turnover fines).
• The privacy policy must be available to an unlimited number of persons before the start of data collection.
• A notification from Roskomnadzor is submitted before the start of data processing.

Who is the data controller and why is it important for your website?

An operator is any person - legal or natural - who independently organizes the processing of personal data. If the site contains an order form, subscription, feedback, personal account or analytics system with user identification, the site owner acts as the operator and bears the full scope of responsibilities under 152-FZ.

Privacy policy as an object of intellectual property: authorship, protection and risks of copying

Is the privacy policy protected by copyright under Russian law?

A privacy policy developed individually for a specific business is a literary work in the sense of Part IV of the Civil Code of the Russian Federation. If a document contains an original structure, author's wording and was created by the creative work of a lawyer, it is protected by copyright. Typical template texts without signs of originality are deprived of such protection.

Risks of using boilerplate privacy policies: legal and intellectual property

Copying someone else's privacy policy creates a double risk:

• violation of the exclusive copyright of the copyright holder of the original text (Article 1301 of the Civil Code of the Russian Federation - compensation from 10,000 to 5,000,000 rubles);
• discrepancy between the content of the copied document and the actual data processing processes on your website, which entails administrative liability under 152-FZ.

How to protect your custom privacy policy from unauthorized copying

For protection it is recommended:

• record the date of creation of the document (deposition, notarization);
• post attribution and prohibition of reproduction;
• if copying is detected, send a claim to the infringer and, if necessary, go to court with a claim for protection of the exclusive right.

User database as an object of intellectual property

A database generated through the website (a set of personal data of users) can be protected as an object of related rights (the right of the database manufacturer under Articles 1333–1336 of the Civil Code of the Russian Federation). Unauthorized extraction and reuse of a significant part of the database content is a violation of the exclusive right of its manufacturer.

Mandatory content of the privacy policy according to 152-FZ and Roskomnadzor requirements

List of categories of personal data collected on the site

The policy should clearly indicate what data is collected: last name, first name, middle name, email address, phone number, location data, cookies, device information and other data.

Purposes, legal grounds and methods of processing personal data

For each data category you must indicate:

• specific purpose of processing (execution of a contract, marketing mailings, analytics);
• legal basis (consent, execution of contract, legitimate interest, legal requirement);
• processing method (automated, manual, mixed).

Storage periods and data deletion procedures

The policy must contain information about the retention period for each category of data and the procedure for its destruction upon achievement of the purpose of processing or at the request of the data subject.

Transfer of data to third parties and cross-border transfer

When transferring data to counterparties, hosting providers or abroad, it is necessary to disclose the list of recipients, the reasons for the transfer and measures to protect data during cross-border transfer.

Changes 2025–2026: new legal requirements

Since 2025, the requirements for detailing policies have been tightened: it is mandatory to indicate specific data processing systems, describe technical and organizational protection measures, as well as the procedure for notifying Roskomnadzor of incidents (leaks) within 24 hours.

Consent to the processing of personal data on the site: forms, content and electronic design

Error 500 (Server Error)!!1500.That’s an error.There was an error. Please try again later.That’s all we know.

Consent must be:

• voluntary (without coercion or conditions for the provision of services);
• specific (indication of goals, list of data, actions with them);
• informed (the subject must understand what he is agreeing to);
• conscious and unambiguous.

Electronic consent forms: checkboxes, click-through, and preset checkboxes

Acceptable forms of electronic consent:

Separate consent for special categories of data and advertising mailings

The processing of biometric data, information about health, and political beliefs requires separate, specially executed written consent. For advertising mailings, separate consent is also required - it cannot be combined with consent to data processing for the purpose of fulfilling a contract.

Withdrawal of consent: technical and legal implementation

The site is obliged to provide the subject with a simple and accessible mechanism for revoking consent. After receiving the response, the operator is obliged to stop processing and destroy the data within no more than 30 days (unless otherwise provided by law).

2025-2026 Updates: Increased language and logging requirements

The new rules require that evidence of each consent (logs, server logs, screenshots of forms) be kept for at least three years. The consent form must contain an exhaustive list of third parties who are recipients of the data.

Notification of Roskomnadzor and registration as a personal data operator

When notification is required and when exceptions apply

Notification is mandatory for all operators, except in cases where data is processed solely within the framework of an employment relationship or without the use of automation tools. The collection of data through the site is automated processing and therefore notification is required.

Procedure for submitting notification

The notification is submitted through the Roskomnadzor portal in electronic form. It contains information about the operator, purposes of processing, categories of data and subjects, and protection measures. The review period is 30 days.

Data localization requirement

When collected, personal data of Russian citizens must be recorded, systematized, accumulated and stored on servers located on the territory of the Russian Federation (Part 5 of Article 18 of Federal Law No. 152).

Liability and penalties for non-compliance

Administrative penalties according to the Code of Administrative Offenses of the Russian Federation (current scale):

• non-publication of the privacy policy - up to 60,000 rubles;
• failure to provide information to the data subject - up to 80,000 rubles;
• processing without a legal basis - up to 150,000 rubles for legal entities;
• data leakage (according to new standards) - up to 15,000,000 rubles or a turnover fine of up to 3% of annual revenue.

For repeated violations, fines are doubled. Roskomnadzor has the right to conduct scheduled and unscheduled inspections, including based on citizen complaints.

Additional requirements for cookies and tracking technologies

Cookies and Tracking Technologies Policy

Taking into account the requirements of 152-FZ, cookies can be recognized as personal data. It is necessary to inform the user and obtain consent for the use of analytical and advertising cookies.

Custom development or template: why personal documentation is important

Legal risks of copying templates

A template privacy policy does not take into account the specifics of business processes, the specific purposes of processing, the composition of contractors and the list of data processing systems. When inspected by Roskomnadzor, inconsistency between the policy and actual activities is classified as a violation.

What an individual policy should reflect

• real data processing processes on your website;
• list of analytics and advertising services used;
• specific counterparties - recipients of data;
• the current legal basis for each processing purpose.

How lawyer Erich Rath's team develops legal documentation for websites

We — RECHTSANWALT ERICH RATH — provide a full range of services for the preparation of legal documentation for sites:

1. Audit of the website and business processes: identifying all points of personal data collection.
2. Development of a privacy policy taking into account the specifics of the activity.
3. Preparation of consent forms for each processing purpose.
4. Set up legally correct consent forms and cookie notifications.
5. Preparation and submission of notification to Roskomnadzor.
6. Legal support during inspections.

Our expertise covers not only Russian, but also European data protection legislation - this is especially in demand by companies with an international structure.

FAQ: privacy policy, consent to data processing and legal compliance of the site

Is every website required to have a privacy policy?

Yes, if the site collects any personal data (including cookies that allow user identification), publication of the policy is required by virtue of Article 18.1 of Federal Law-152.

Can I use a free privacy policy template?

Formally, it is possible, but the template does not reflect the specifics of your business, which creates the risk of a fine during verification and may violate the copyright of the developer of the original text.

What is the penalty for not having a privacy policy?

For legal entities - from 30,000 to 60,000 rubles for the first violation. For leakage of personal data - up to 15,000,000 rubles according to the standards of 2024–2025.

Do I need to obtain separate consent for advertising mailings?

Yes, consent to marketing communications must be separate from consent to data processing for other purposes. Combining these consents into one checkbox is a violation.

How to prove the fact of obtaining electronic consent?

It is necessary to keep a journal (log) recording the date, time, IP address, version of the consent form and user actions. The storage period for logs is at least three years.

Does copyright apply to the texts of legal documents on a website?

Individually developed legal texts with signs of originality are protected by copyright. Unauthorized copying may result in legal action for compensation.

Do you need to develop legal documentation for your website or want to bring existing documents into compliance with the requirements of 152-FZ? Contact us for advice.

Phone: +7 (495) 970-74-16

Email: info@ratanwalt.com

Address: Moscow, Rozhdestvenka St., 5/7 p. 1

Website: https://www.ratanwalt.com/

RECHTSANWALT ERICH RATH - legal documentation for websites, protection of intellectual property, compliance with laws on personal data.