A contact form with an “Email” field makes you an operator of personal data. Not figuratively—in the sense of 152-FZ (Russia’s personal-data law). Below is the checklist we work through on every project that has forms. This is not legal advice: for the wording of the documents go to a lawyer, this is about what has to be done on the website side.
Documents and consents
1. The personal data processing policy is published. A separate page reachable from any page of the site, usually from the footer. The requirement is direct: the document must be freely available.
2. Consent is separate from the policy. These are two different documents and two different actions. Reading the policy is not consent to processing.
3. Checkboxes are not ticked in advance. Consent is an active act by the user. A pre-ticked box does not count as consent. Technically it is one line of code that is very easy to leave in.
4. There are at least two checkboxes. Consent to processing and consent to marketing are different purposes. A single “I agree to everything” box mixes purposes, which the law does not like.
5. The consent text names the purposes. “I consent to the processing of personal data” with no statement of what for is incomplete consent. Processing in order to answer an enquiry and processing for marketing are different purposes.
6. There is a way to withdraw consent. An address to write to, given in the policy. An unsubscribe link in every marketing email.
Technical
7. HTTPS with no exceptions. Transmitting personal data over an open channel fails the requirement on protective measures. There is no taste involved.
8. The data is stored in a database on Russian territory. Initial collection and storage of Russian citizens’ data belongs on servers in Russia. This is one of the most common breaches: the form pipes data straight into a foreign email service, bypassing your own database. That is not allowed. First your database in Russia, then—where there are grounds for it—anything else.
9. Analytics and trackers do not load before consent. Counters set identifiers. Until consent is given the scripts must not load at all. There is no “loaded but staying quiet” mode in the law.
10. Forms are protected against automated submissions. A honeypot, a minimum time to fill the form in, rate limiting. This is not directly about the law, but other people’s personal data poured into your database by a bot is your problem.
11. Access to the data is restricted and logged. Which employees see the enquiries, through which interface, and whether a trace is left. For a small company this looks like “an admin panel with roles and an audit log”. No separate system needs deploying.
12. Retention periods are defined and deletion is set up. Data is kept no longer than the purpose requires. Enquiries that are three years old have stopped being an archive and become a risk. Automatic deletion or anonymisation on a schedule.
Organisational
13. The notification to Roskomnadzor has been filed. It is filed before processing begins. The form is on the regulator’s website and review takes up to 30 days. The exemptions from the duty to notify have narrowed, and most sites with forms no longer fall under them.
14. A person responsible for processing has been appointed. An order, and a document setting out their duties. For a sole trader or a small company this is a one-page formality, but the absence of that page is a standard finding during an inspection.
What is not on the list and why
There is no full set of internal documents here: statements of policy, threat models, procedures, records. They are needed, but they are the work of a lawyer and an information security specialist, not of the website.
The fourteen points above close what is visible from the outside—which is where any inspection and any complaint starts. They can be checked in an hour and closed in a day or two, which is not comparable to a discussion about fines.
How to check in fifteen minutes
Open the site in a private window. Look at the Network tab in the developer tools before you click anything in the cookie banner. If the counters have already loaded, point 9 is not met. Submit a form and see where the request went. If it went to a third-party service’s domain, deal with point 8. Find the policy and the consent in the footer. If it is a single link, point 2 is not met.