Costly Mistakes: How Russian Businesses Risk Millions in Fines for Personal Data Violations
A year after new fines for personal data protection violations came into force in Russia, many entrepreneurs still risk multimillion-ruble penalties from Roskomnadzor. The most frequent breaches involve improper collection, storage, and processing of personal data of Russian citizens.
Violation 1: Using Google Forms
Despite repeated warnings at conferences and webinars, businesses continue to use Google Forms. All personal data must be recorded, systematized, accumulated, stored, and processed using databases located on Russian territory under Part 5 of Article 18 of the Law on Personal Data. Google’s servers are located outside Russia, violating localization requirements. Recommended fix: replace with domestic alternatives such as Yandex Forms. Fines range from 30,000–50,000 rubles for citizens and 1–6 million rubles for individual entrepreneurs and legal entities under Part 8 of Article 13.11 of the Code of Administrative Offenses.
Violation 2: Missing Cookie Banner
If a website uses cookies without displaying a proper banner, it violates the law because cookies qualify as personal data. The recommended banner text informs users about cookie usage for analytics and links to the privacy policy. Fines start at 10,000–15,000 rubles for citizens and reach 150,000–300,000 rubles for legal entities.
Violation 3: No Consent Under Data Collection Forms
Many sites lack valid consent for processing personal data or link only to a privacy policy instead. Consent must meet requirements of Article 9, including specific purpose, list of data, and validity period, plus a checkbox with linked consent text. Fines are identical to those for missing cookie banners.
Violation 4: Publishing Reviews Without Distribution Consent
Publishing reviews containing personal data without separate consent for dissemination violates Article 10.1. Consent must follow the form approved by Order No. 18, and the privacy policy must disclose processing conditions and any prohibitions set by the data subject.
Violation 5: Missing or Non-Compliant Privacy Policy
Every operator must publish a privacy policy in the site footer and under every data collection form, detailing categories of data, purposes, retention periods, destruction procedures, and third-party recipients per Part 2 of Article 18.1. Fines range from 1,500–3,000 rubles for citizens to 30,000–60,000 rubles for legal entities.
Violation 6: No Notification or Outdated Notification to Roskomnadzor
Operators must notify Roskomnadzor before processing personal data and keep the notification current using the form from Order No. 180 of 28 October 2022. Fines reach 100,000–300,000 rubles for legal entities.
Violation 7: Transferring Employee Data Without Separate Written Consent
Employers may not disclose employee personal data to third parties without written consent for each specific purpose, as required by Article 88 of the Labor Code and Part 4 of Article 9. Fines range from 100,000–300,000 rubles for individual entrepreneurs and 300,000–700,000 rubles for legal entities.
Violation 8: No Data Processing Agreement with Third Parties
When personal data are entrusted to third parties (mailing services, etc.), a separate agreement must list the data, operations, purposes, and confidentiality obligations per Part 3 of Article 6. Fines are the same as for missing cookie banners.
Violation 9: No Document on Paper Data Storage Locations
Operators must maintain a document specifying storage locations of paper-based personal data carriers and the list of persons with access, according to Government Resolution No. 687 of 15 September 2008. Fines range from 1,500–4,000 rubles for citizens to 50,000–100,000 rubles for legal entities.
Violation 10: Failure to Respond to Data Subject or Roskomnadzor Requests
Operators must respond within statutory deadlines under Article 21. Appointing a responsible person and maintaining clear internal instructions helps ensure timely replies. Fines range from 2,000–4,000 rubles for citizens to 50,000–90,000 rubles for legal entities.
A comprehensive audit followed by development and implementation of all required documents remains the most reliable way to eliminate these risks and protect profits in 2026.
Related articles
Protecting Data Centers from Kinetic and Cyber Attacks: What Regulators Worldwide Are Proposing
InfoWatch experts have updated their April report on data center resilience, highlighting how physical and cyber threats now directly threaten business continuity and national security. Regulators in the United States, European Union, and Russia are treating data centers as strategic infrastructure requiring layered defenses that combine physical hardening, geographic distribution, and strict cybersecurity controls. The United States has launched the Cyberstrategy for America 2026 emphasizing offensive operations, Zero Trust modernization, and supply-chain restrictions. The European Union is implementing ProtectEU and the Cyber Solidarity Act with real-time threat sharing and mandatory resilience standards under DORA. Russia is advancing technological sovereignty targets, new siting rules for data centers, and Presidential Decree No. 604 that enables temporary state management of inadequately protected critical facilities. The report also notes growing recognition that attacks on data centers can constitute acts of aggression under the Tallinn Manual.
US Department of Homeland Security Orders Federal Agencies to Remove DeepSeek Products
The US Department of Homeland Security issued an order on October 19 requiring federal civilian agencies to cease purchasing products from DeepSeek and to remove related technology from government systems. The directive, published the following day, targets Hangzhou DeepSeek Artificial Intelligence, its affiliates, and any third-party products or services built on DeepSeek implementations. The measure stems from the Federal Acquisition Supply Chain Security Act of 2018 and follows a recommendation by the Federal Acquisition Security Council, though no specific incidents or evidence were detailed in the notice. The restriction applies only to federal environments and does not prohibit private sector or individual use outside government systems. No removal deadline was set, and the document does not name the signing authority. The order is filed under docket DHS-2026-0628 with the CISA implementation team listed as the contact point.
AKIT Requests Temporary Permission for Russian Companies to Transfer Personal Data Abroad After Data Center Incidents
The Association of Internet Trade Companies (AKIT) has sent a formal letter to Russian Prime Minister Mikhail Mishustin proposing a temporary exemption from strict data localization rules. The measure would allow affected companies to move critical systems and Russian citizens' personal data to data centers in friendly countries when domestic infrastructure is unavailable due to accidents or damage. Members including Ozon, Wildberries, Cooper, and Yandex Market argue that services must continue operating even if Russian facilities are compromised. The proposed special regime would apply only after an officially confirmed incident, require compliance with information security standards, and end no later than March 1, 2028. After recovery, companies would be required to return to normal data processing within Russia. Expert Alexey Muntyan noted that the mechanism activates only after incidents occur and questioned whether countries should be selected based on data protection levels rather than political alignment.
Anthropic Model Reconstructs NSA Seeds for NIST Elliptic Curves in Under 30 Minutes
An internal Anthropic research model traced the origins of the five seeds used by the NSA to generate the NIST elliptic curves P-192, P-224, P-256, P-384, and P-521. The discovery resolves a 25-year-old question that arose when the curves were standardized in FIPS 186-2 for ECDSA in 2000. Researchers combined analysis of 1990s random number generators, 34 generator-output combinations, and lattice reduction techniques to identify lrand48 initialized with Unix timestamps from May 1997 to April 1998. The P-256 seed corresponds to the 1842nd candidate from a run started on 16 August 1997, and example seeds from ANSI X9.62 follow the same pattern. The work does not demonstrate any cryptographic break or backdoor in the curves and does not recommend changes to production systems. Several questions remain open, including the seed for curve B-163 and the reason certain candidate values were discarded.