Submission of a notification to Roskomnadzor about the collection of personal data
Dear clients! We remind you of the necessity to submit a notification about the collection of personal data to Roskomnadzor.
❗️From May 30 — a fine of up to 300,000 ₽ or website blocking for violating the personal data law.
All online businesses (legal entities, individual entrepreneurs, self-employed) that collect or process personal data in Russia are required to submit a notification to Roskomnadzor. Even if you:
• hire employees and maintain personnel records;
• enter into contracts with individuals;
• collect applications through websites, forms, social networks;
• conduct email or SMS mailings;
• use CRM, chatbots, or other online services;
• maintain a client database;
• use video surveillance with recognition;
• transfer data to contractors or the cloud;
• process data manually — on paper.
⛔️ Consequences of non-compliance:
• a fine of up to 300,000 ₽;
• website blocking — without warning.
✖️Notification is not required if:
• you process data only for access to the territory;
• there is no automation, third-party transfer is excluded, rights are not violated;
• you work only with employment contracts and do not transfer data.
If you have already submitted a notification before — no need to do it again. Check yourself by TIN in the Roskomnadzor registry.
Instructions for submitting a notification about the collection of personal data to Roskomnadzor
Who is required to submit a notification?
Legal entities, individual entrepreneurs, and self-employed processing personal data in Russia.
📌 Required information:
• Full and short name of the organization
• OGRN, TIN
• Legal and actual address
• Contact details (phone, email, website)
• Purposes of personal data processing
• Categories of personal data subjects (employees, clients, etc.)
• List of processed personal data
• Legal basis for processing
• Security measures
• Information on cross-border transfer (if any)
• Automated processing (if any)
📨 Methods of submitting a notification:
1. On paper
Fill out the form on the RKN website, print it, and send it to the territorial body by mail.
2. Electronically with EDS
Fill out and sign the form with an enhanced qualified electronic signature. You will need the CryptoPro plugin.
3. Through the State Services portal (ESIA)
Submit the form through your personal account on the State Services portal (a confirmed account is required).
Procedure for submitting a notification
1. Choose the method of submitting the notification on the RKN website
2. Fill out the form
Section 1. Information about the operator
• Full and short name of the legal entity
• Full name of the head
• OGRN, TIN
• Location address
• Postal address (may coincide)
• Phone, email, website (if any)
Section 2. Information about the person responsible for organizing personal data processing
• Full name, position
• Phone, email
Section 3. Purposes of personal data processing — select all applicable options, for example:
• Personnel record keeping
• Conclusion and execution of contracts
• Accounting
• Processing website user data
• Sending notifications/advertisements (with consent)
Section 4. Categories of personal data subjects
• Employees, former employees
• Contractors, their representatives
• Website visitors
• Application users
Section 5. Categories of user personal data:
• Full name, gender, date of birth
• Phone, email
• Delivery address or service location
• Place of residence
• Geolocation
• Purchase history
• Passport data
• Employment information
• Uploaded photos, texts, and other files
• IP address, cookies (for websites/applications)
• If processing special categories (e.g., health) — specify with justification.
Section 6. Legal basis for processing — specify:
• Art. 6 and 9 of Federal Law-152
• Consent of the personal data subject
• Labor Code
• Civil Code
• Law on Accounting, etc.
Section 7. Personal data processing
• Automated / Non-automated / Mixed
• Names of information systems used (e.g., 1C, CRM)
Section 8. Ensuring personal data security — briefly indicate the measures applied:
• Antivirus, firewall, access rights differentiation
• Local acts (personal data processing policy)
• Employee training
• Appointed person responsible for personal data
Section 9. Cross-border personal data transfer
• No — "not carried out"
• Yes — specify countries and basis (e.g., contract, consent)
Section 10. Personal data processing terms — specify specific storage terms or: "during the term of the contract and 5 years after" (for accounting documents).
3. Prepare the notification for submission
Check the data → send the notification in electronic or paper form (depending on the chosen submission method)
4. Await confirmation
Within 30 days, Roskomnadzor will include you in the personal data operators registry. You can check by TIN on the RKN website.
If you have any questions, contact your manager or technical support service.
Sincerely, the FoodSoul team