Data: fines.

What has changed in money terms

Since 30 May 2025 the fines under Federal Law No. 420-FZ have been in force, and they are no longer “a warning and ten thousand”. Failed to notify Roskomnadzor that you process personal data - ₽100,000 to ₽300,000 for a company. Failed to report a leak - ₽1 to ₽3 million. The leak itself is assessed by scale: from ₽3-5 million for the data of a thousand people to ₽10-15 million for a hundred thousand. For a repeat leak - a turnover-based fine of 1 to 3% of annual revenue, a minimum of ₽20-25 million, a ceiling of ₽500 million.

An important detail: the 50% discount for prompt payment does not apply to any of the offences under Article 13.11 of the Code of Administrative Offences. In other words, the amount in the ruling is the amount payable.

The second change is not in the law but in practice. Since September 2025 Roskomnadzor has restructured its oversight: instead of scheduled inspections - work on complaints. Any site visitor who dislikes a pre-ticked checkbox can complain. Small and medium-sized businesses are the first in the firing line: template websites with forms from ten years ago.

What counts as a violation on a website

The regulator proceeds from the principle that consent must be specific, informed and conscious. In the language of front-end code this means four things.

A pre-ticked checkbox. A “I consent to processing” checkbox ticked by default is a violation in itself, regardless of whether a leak has occurred or not.

Consent merged with submission. The wording “by clicking the button, you agree” without a separate action by the user is considered legally weak. A separate checkbox is needed, and the form must not submit without it.

A policy in the footer in small print. The link to the data processing policy must be visible in the form itself at the moment the data is collected and must open before submission, not be hunted for in the footer.

Analytics before consent. Counters, ad-system pixels and cookies must not load until the visitor has given consent. A “we use cookies” banner with a single “ok” button that blocks nothing formally solves nothing.

Separately - different consents for different purposes. Registration, mailing and analytics are three different types of processing, and one blanket consent “to everything” does not cover them.

What to check in a single evening

• Notification to Roskomnadzor. Check whether the company is in the register of operators and whether the declared purposes match what the site actually collects. If not - submit a notification: this is the cheapest item on the list and the most frequent fine.
• Every form on the site. Enquiry, callback, subscription, calculator, chat. In each - a separate unticked checkbox, a link to the policy inside the form, submission blocked without consent.
• The processing policy. A current version, a date, purposes, retention periods, a list of third parties (CRM, mailing, call tracking). A copied template with another company’s name in it is a typical finding during an inspection.
• The cookie banner. “Accept” and “decline” buttons, not a single “ok”; counters start after consent; the choice is remembered.
• A consent log. Technical recording: date and time, form version, policy version, where the consent came from. During an inspection this is what they request, not the text of the document.
• Transfer abroad. Widgets and services that send data to foreign servers (forms, chats, analytics) require a separate legal basis. It is easier to replace them than to formalise it.

Where this overlaps with advertising

Since July 2026 Yandex Direct moderation itself sends commercial sites without a privacy policy and company details for manual review - in detail in our breakdown of the Yandex Direct changes. In other words, one and the same shortcoming now costs both a fine and paused advertising. By putting your forms in order for Roskomnadzor, you simultaneously remove the barrier to launching campaigns.

What not to do

Do not “hide” forms: removing the checkbox altogether so as not to hurt conversion. A form without consent is data collection without a legal basis, and that costs more than losing a few per cent of enquiries. Do not put up a single cookie banner “for show” without blocking the counters: inspectors look at network requests, not at whether a banner exists. And do not put off the register notification until the first inspection - it is the only item that cannot be fixed retroactively.

We wrote about how work with client data is built more broadly - storage, access, CRM - in our piece on protecting client data; this text is about the website as a point of collection.

In brief

• Fines since 30 May 2025: notification ₽100,000-300,000, a leak from ₽3 million, a repeat one - up to 3% of revenue.
• Since September 2025 Roskomnadzor works on complaints; template websites are in the risk zone.
• Violations: a checkbox ticked by default, consent without a separate action, a policy only in the footer, counters before consent.
• Checklist: the register of operators, every form, a current policy, a cookie banner with a decline option, a consent log.
• Since July, Yandex Direct moderation applies the same requirements to a website.

Frequently asked questions

Do you need to notify Roskomnadzor if the site only has a callback form?

Yes. A name and a phone number are personal data, and collecting them requires a processing notification.

Is the text “by clicking the button, you agree” enough?

No. A separate unticked checkbox is needed, with submission blocked without it.

Is a cookie banner mandatory?

Consent is needed before counters and pixels start. A banner is a way to obtain it, but only if it really blocks loading until a choice is made.

What is requested during an inspection?

Not only the policy but also proof of consent: the date, the method of obtaining it, the form and policy versions. Without a log there is nothing to prove consent with.