Who this applies to
Practically any site with a contact form, an enquiry, a sign-up or a subscription. A name plus a phone number or email is already personal data, and you are its operator.
“We're a small site” doesn't exempt anyone: the law isn't about the size of the business, it's about the fact that data is being processed.
What a breach costs
Fines for personal-data violations have grown in recent years and now land as a real cost to a business rather than a symbolic one. On top of that come reputational risk and, in some cases, restricted access to the resource.
Covering the basic requirements in advance is cheaper than dealing with it after an inspection or a complaint.
Five steps to baseline compliance
- 1. A privacy policy — published and reachable from every page that carries a form.
- 2. Consent to processing — an explicit checkbox at the form (not pre-ticked), linking to the policy.
- 3. Data stored in Russia — the database and the enquiries on servers under Russian jurisdiction.
- 4. Notifying the regulator — the operator files a notification of personal-data processing.
- 5. Cookies and analytics — a cookie notice and analytics configured correctly.
What you can do yourselves, and what needs a lawyer
The technical part — consent at the forms, storage inside Russia, correctly configured analytics — is the developer's job. We provide the checklist and document templates and configure the site to meet the requirements.
Formal certification and filing the paperwork are handled by licensed auditors and lawyers; there we bring in a vetted partner rather than imitating expertise we don't have.
A common myth
“We added an 'I agree' checkbox, so we're compliant.” The checkbox is one element of several. Without the policy, storage inside Russia and the notification to the regulator, formal compliance doesn't add up.
The good news: for a typical site this is a manageable amount of work — and much better done before an inspection than after one.