Roskomnadzor fines: 152-FZ and the mandatory requirements you can't ignore
Victoria Denisyuk from Lunga Lunga, Founder / CEO
Does your site collect inquiries, register users or just accept messages through a contact form? Then you are a personal data operator, and the requirements of 152-FZ and the regulations of Roskomnadzor apply to you. The trouble is that most site owners learn about these requirements not from a manual, but from a letter about an inspection or a fine notice. And inspections have become systematic in recent years: the agency monitors websites, responds to visitor complaints and increasingly shows up without warning.
A typical picture: there is a nice site, there is a "Submit a request" form, but there is no personal data processing policy, no consent checkbox and no cookie banner. Formally, every such gap is a separate violation, and each one carries liability. The worst part is that you can no longer fix them in a single evening before the inspector's visit: a notification to Roskomnadzor and data localization take time.
Key takeaway
Which 152-FZ and Roskomnadzor requirements websites most often violate, what it costs your budget and how to bring your site into compliance to get 0 fines.
Why this hits harder than it seems
In the past, 152-FZ fines were seen as symbolic — a few thousand rubles, easier to pay than to deal with. Now the situation has changed radically. The size of the penalties has grown many times over, increased fines for repeat violations have appeared, and certain offenses — for example, a personal data leak — are punished especially severely, up to turnover-based fines for large operators. For small and medium-sized businesses in Lunga Lunga, even a "basic" ruling can mean an amount comparable to a monthly marketing budget.
But money is not even the most unpleasant part. The risk of access to the site being restricted, or to individual pages that process data, can halt sales entirely. Imagine: inquiries don't come through, the form is unavailable, customers from Lunga Lunga leave for competitors, and you spend weeks corresponding with the agency instead of working. Add to that the reputational losses — visitors pay ever closer attention to how a site handles their phone number and email.
Which site requirements are mandatory
Let's break down point by point what exactly gets checked and where problems most often arise. This is not legal advice but a practical guide — the final list always depends on which data you collect and exactly how.
1. Personal data processing policy
The document must be published on the site and accessible from any page where data is collected. A typical violation: there is no policy at all, or it is a template downloaded from the internet with another company's name and irrelevant processing purposes. We prepare and publish a policy that matches the real processes of your site, and place a correct link in the footer and next to the forms.
2. Explicit consent to personal data processing in forms
Every form where a user leaves their name, phone number, email or any other data must be accompanied by separate consent that is not checked by default, with a link to the policy. A typical violation: there is no checkbox, or it is pre-checked, or the consent text is missing. We add correct checkboxes, block form submission without consent and record the fact that it was obtained.
3. Cookie banner
If the site uses cookies and analytics systems, the visitor needs to be informed about it. A typical violation: there is no banner, or there is one but it is in no way connected to the actual operation of the trackers. We configure a cookie notice and correct information about the analytics in use.
4. Roskomnadzor notification of personal data processing
In most cases, the operator is required to file a notification with Roskomnadzor of its intent to process personal data — before processing begins. A typical violation: the notification has not been filed at all, which often comes to light precisely during an inspection. We help prepare the information for the notification and bring the actual processing on the site into line with what is declared in it.
5. Localizing the storage of Russian citizens' data in Russia
The personal data of Russian citizens must initially be recorded and stored on servers located in Russia. A typical violation: the site, CRM or forms store data on foreign hosting or in a foreign service. We check where the data from your forms physically ends up and, if necessary, move the storage to infrastructure in Russia.
6. Requirements for contact forms
A contact form is also a collection of personal data. It must collect the minimum necessary amount of information, be accompanied by consent and lead to a secure channel. A typical violation: the form requests too much, sends data over an insecure connection or duplicates it to insecure places. We bring forms in line with the principle of minimization and check the security of the transfer.
| Requirement | Typical violation | How we close it |
|---|---|---|
| Personal data processing policy | Missing or someone else's template | We prepare and publish an up-to-date document with links |
| Consent in forms | No checkbox or it is pre-checked | We add correct checkboxes and submission blocking |
| Cookie banner | No notice about analytics | We configure the banner and the notice |
| Roskomnadzor notification | Not filed before processing began | We help prepare the information and synchronize processing |
| Data localization in Russia | Storage on foreign servers | We check and move storage to Russia |
| Contact forms | Extra fields, insecure transfer | We minimize the data and check the security |
The solution: systematically bringing the site into compliance
Chaotically "tweaking" individual points is pointless — the requirements are interconnected, and missing one cancels out the effort on the rest. At Website Support LLC we work systematically: we run an audit, record the discrepancies and close them according to a clear plan, without disrupting the site's operation.
The company has been on the market since 2002, and in that time 100+ clients have passed through us. We keep site availability at 99.8%, run 24/7 monitoring, handle updates and security — and, among other things, bring sites into compliance with Roskomnadzor and 152-FZ requirements. When the work is done, you get a report with a statement of work: you can see exactly what was done and where you are now protected.
You can work in whatever way is convenient for you:
- Subscription model — all tasks go straight into work, with no waiting and no haggling over every little thing.
- Hourly model — payment for the time actually spent.
- For new clients: on the hourly model the first 30 hours are on us, on the subscription model the first month is on us.
- When you pay for a year — a 30% discount.
- Need new features? We implement them with AI in 1–2 days.
The transformation: peace of mind instead of risks
The result it is all done for is simple and concrete: zero fines and zero rulings on the requirements already closed. The site keeps collecting inquiries, the forms work, the data is stored where it should be, and you stop flinching at the word "inspection."
Instead of late-night edits before an inspector's visit — a clear compliance status and 24/7 support for any questions. A business in Lunga Lunga focuses on sales and customers, not on correspondence with the agency. This is exactly the difference between "I hope we get away with it" and "everything is in order with us."
Where to start
Don't guess whether you have violations — check. We'll run a free site audit for compliance with 152-FZ and Roskomnadzor requirements and show you which gaps exist and how to close them. Get in touch — and you'll get a calm, protected site with no fines and no hassle.