Website checklist: documents to protect your business from fines under Federal Law 152-FZ
Building a website, setting up analytics, and launching your project is just the beginning; there is also a legal side to consider. Regulatory bodies are increasingly auditing online platforms, with fines for non-compliance reaching hundreds of thousands of rubles. Data protection laws require businesses not only to collect physical consent forms for processing personal data but also to adhere to specific rules for websites that process visitor information.
Processing the personal data of website visitors automatically makes you, the site owner, a personal data operator.
Below, we outline the documents you must post on your website to avoid potential liability.
Required website documents
Privacy Policy regarding the processing of personal data.
This is a mandatory document that must be easily accessible to every visitor to your website (Clause 2, Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006, hereinafter "Federal Law No. 152").
This document allows data subjects to review how their personal data is processed, the security measures taken by the operator, and the specific types of data being collected.
For businesses, this document serves as proof that all necessary organizational measures are being taken to protect personal data.
Consent to the processing of personal data.
Next to every data collection form, the user must perform a conscious and unambiguous action by checking a box.
IMPORTANT! Passivity does not equal consent: a pre-checked box does not meet the requirement for a conscious and unambiguous expression of will by the data subject.
IMPORTANT! The checkbox must include a link or hyperlink to the full text of the consent form for the processing of personal data.
Cookie collection notice.
Cookies are data files saved on a user's computer after visiting a website (e.g., IP address, information about site activity).
Cookies are considered personal data if they allow for the identification of a specific individual. Technical cookies (those necessary for the website to function) do not require consent.
IMPORTANT! Passivity does not equal consent: consent for cookie processing must not have a pre-checked box.
IMPORTANT! The checkbox must include a link or hyperlink to the full text of the cookie policy.
Consent to receive promotional communications (if applicable).
Consent to receive promotional communications allows you to send information about new events, discounts, and special offers to the recipient (the data subject).
IMPORTANT! Consent to the processing of personal data and consent to receive promotional communications are two separate consents; therefore, you must provide separate checkboxes for each.
IMPORTANT! The checkbox must include a link/hyperlink to the full text of the consent to receive promotional communications.
Public offer (mandatory if your goods and/or services are sold remotely via the Internet) (Clause 17 of Decree of the Government of the Russian Federation No. 2463 dated December 31, 2020).
Liability for missing specific documentation
Personal Data Processing Policy — administrative fine in the amount of:
- for individuals: 1,500 to 3,000 RUB;
- for officials: 6,000 to 12,000 RUB;
- for sole proprietors: 10,000 to 20,000 RUB;
- for legal entities: 30,000 to 60,000 RUB.
(Part 3, Article 13.11 of the Code of Administrative Offenses of the Russian Federation).
Consent to the processing of personal data — for processing without the subject's proper consent (or with consent lacking mandatory details): for individuals: 10,000 to 15,000 RUB; for officials and sole proprietors: 50,000 to 100,000 RUB; for legal entities: 150,000 to 300,000 RUB (Part 1, Article 13.11 of the Code of Administrative Offenses of the Russian Federation). For processing without the subject's proper mandatory written consent (or without mandatory details): for individuals: 10,000 to 15,000 RUB; for officials and sole proprietors: 100,000 to 300,000 RUB; for legal entities: 300,000 to 700,000 RUB (Part 2, Article 13.11 of the Code of Administrative Offenses of the Russian Federation).
Consent to the processing of personal data — for processing without the subject's proper consent (or with consent lacking mandatory details):
- for individuals: 10,000 to 15,000 RUB;
- for officials and sole proprietors: 50,000 to 100,000 RUB;
- for legal entities: 150,000 to 300,000 RUB.
(Part 1, Article 13.11 of the Code of Administrative Offenses of the Russian Federation).
For processing without the required written consent of the data subject (or without the mandatory details):
- for individuals: 10,000 to 15,000 RUB;
- for officials and sole proprietors: 100,000 to 300,000 RUB;
- for legal entities: 300,000 to 700,000 RUB.
(Part 2, Article 13.11 of the Code of Administrative Offenses of the Russian Federation).
Cookie processing — administrative fine in the amount of:
- for individuals: 10,000 to 15,000 RUB;
- for officials and sole proprietors: 50,000 to 100,000 RUB;
- for legal entities: 150,000 to 300,000 RUB.
(Part 1, Article 13.11 of the Code of Administrative Offenses of the Russian Federation).
Public offer — warning or fine:
- for officials and sole proprietors: 500 to 1,000 RUB;
- for legal entities: 5,000 to 10,000 RUB.
(depriving a consumer of the right to information, Part 1, Article 14.8 of the Code of Administrative Offenses of the Russian Federation).
Also a warning or fine:
- for individuals: 300 to 1,500 RUB;
- for officials and sole proprietors: 1,000 to 3,000 RUB;
- for legal entities: 10,000 to 30,000 RUB.
(violation of distance selling regulations, Art. 14.15 of the Code of Administrative Offenses of the Russian Federation).
Recommendations from the C Cases team
1. Check the website for a privacy policy regarding the processing of personal data, including whether essential terms are covered (e.g., principles, purposes and scope of data processing, methods of processing, and conditions for terminating data processing);
2. Check the website for a personal data processing consent form, including whether essential terms are covered (e.g., purposes of data processing and the list of personal data for which consent is being given).
You can find more detailed information in the article "Consent to Personal Data Processing: How to Draft a Document to Avoid Fines?".
3. Check the website for a cookie notice;
4. Check the website for consent to receive promotional communications, including whether essential terms are covered (e.g., the communication channels that will be used for promotional mailings and what information will be collected for these purposes).
You can find more detailed information in the article: "How to Avoid Being Marked as Spam: Rules for Legal SMS and Email Marketing".
5. Check the website for a public offer agreement (if applicable), including whether essential terms are covered (e.g., information about the seller; the procedure for concluding the contract and placing an order; and the procedure for determining the order cost and payment).
Conclusion
Compliance with personal data legislation is not just a formality; it is essential protection for your business against financial and reputational losses. The absence of even one of these documents can lead to fines, while missing several can result in liability for multiple administrative offenses.
Inspections by Roskomnadzor and Rospotrebnadzor are becoming increasingly frequent, and a complaint from any website visitor can trigger one.
A legal website audit and regular document updates are the most effective ways to avoid claims from regulatory authorities and users.
If you need to check your website for compliance with personal data laws, draft the necessary documents, or resolve existing violations, the C Cases team is ready to provide a full range of legal support: from a website audit to the preparation of all required documentation on a turnkey basis.
Sources
- Code of the Russian Federation on Administrative Offenses No. 195-FZ dated December 30, 2001;
- Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data";
- Decree of the Government of the Russian Federation No. 2463 dated December 31, 2020.