Doing business today is inseparable from processing customers' personal data: from collecting contact details and concluding contracts to placing online orders across a wide range of industries.

Personal data leaks have become more frequent recently, and Roskomnadzor has stepped up its oversight of businesses' compliance with personal data protection law.

According to media reports, Roskomnadzor recorded 136 database leaks in 2024 containing more than 710 million records about Russians. Personal data leaks were also recorded in 2025. One of the most high-profile was the leak of personal data of AlfaStrakhovanie-Zhizn customers after cybercriminals penetrated the company's information infrastructure.

Because the rules on personal data processing needed tightening, Federal Law No. 420-FZ of 30.11.2024 increased fines for non-compliance with personal data protection law, introduced specific offences (for example, failure to notify Roskomnadzor of the intention to process personal data) and introduced fines for leaks of special categories of personal data and biometric data.

Processing of personal data: general information

Under Article 3 of Federal Law No. 152-FZ of 27.07.2006 ("Law No. 152-FZ"), processing of personal data means any action performed with personal data (for example, collection, recording, clarification or storage).

There are always two mandatory participants in personal data processing relationships:

The operator — the person who organises and/or carries out the processing of personal data;
The data subject — the individual who provides their personal data to the operator for processing.

Processing of personal data is lawful when:

Such a right or obligation is provided for by Russian law, in which case the subject's consent is not required (Article 6(1)(2)–(11) of Law No. 152-FZ);
The data subject has given the relevant written consent (Article 6(1)(1) of Law No. 152-FZ).

The subject's consent is thus the legal basis for processing personal data where such processing is not expressly required by law.

Consent to the processing of personal data: types and recommendations from the C Cases team

As a general rule, consent to the processing of personal data may be given in any form that allows the operator to prove that consent was obtained. In practice, operators obtain such consent in written or electronic form (for example, by ticking a box on a website).

There are, however, cases where consent must be in writing (for example, when processing special categories of personal data or biometric data, or for cross-border transfers of personal data).

Important! Consent to the processing of personal data must be separate from other documents; including consent in a contract is not considered proper consent (Article 9(1) of Law No. 152-FZ). This position is confirmed by Roskomnadzor's guidance.

Important! If, as a personal data operator, you plan to disseminate personal data (i.e. disclose it to an indefinite range of persons), you need to obtain additional consent specifically for this action (Article 10.1(1) of Law No. 152-FZ), which must be separate from other consents.

The requirements for the content of consent to the processing of personal data are set out in Article 9 of Law No. 152-FZ.

Typical mistakes for which Roskomnadzor imposes liability are:

vague purposes ("for any lawful purposes");
a broad list of personal data that does not correspond to the purposes of processing;
no term and no procedure for withdrawing consent.

The C Cases team recommends that operators include the following sections in their consents:

Information about the data subject (full name, date and place of birth, Russian passport details);
Information about the personal data operator (for example, for a legal entity — OGRN, INN, and details of the person entitled to act on behalf of the legal entity without a power of attorney);
The purposes of processing personal data (for example, conducting marketing research or advertising mailings);
The list of personal data to whose processing consent is given (for example, full name, place of birth, email address);
The actions the operator may perform with the personal data (for example, collection, recording, storage, clarification);
The period for which the consent is given.

Liability for processing personal data without the subject's consent

Processing personal data without the subject's proper consent (or with consent lacking mandatory details) entails liability under Article 13.11(1) of the Code of Administrative Offences:

For individuals: an administrative fine of RUB 10,000 to RUB 15,000;
For officials and sole proprietors: an administrative fine of RUB 50,000 to RUB 100,000;
For legal entities: an administrative fine of RUB 150,000 to RUB 300,000.

Processing personal data without the subject's proper mandatory written consent (or without mandatory details) entails liability under Article 13.11(2) of the Code of Administrative Offences:

For individuals: an administrative fine of RUB 10,000 to RUB 15,000;
For officials and sole proprietors: an administrative fine of RUB 100,000 to RUB 300,000;
For legal entities: an administrative fine of RUB 300,000 to RUB 700,000.

Conclusion

Consent to the processing of personal data is an independent legal basis for processing personal data where such processing is not expressly provided for by law. It is properly documented consent that allows the operator to confirm the lawfulness of its actions with personal data and significantly reduce the risk of administrative liability.

Given Roskomnadzor's increasing oversight and the growing number of personal data leaks, preparing a correct consent has moved from the category of a formal recommendation to that of a necessary condition for a business's legal safety.

If, as a personal data operator, you need to determine whether consent is required in a specific situation, prepare the correct text of a consent, take into account the requirements for processing special categories of personal data, or check your existing documents for legal risks, the C Cases team will help you prepare a "working" set of documents and protect your interests in dealings with data subjects and supervisory authorities.

Sources

Federal Law No. 152-FZ of 27.07.2006;
Code of Administrative Offences of the Russian Federation No. 195-FZ of 30.12.2001.