Achieving GDPR & FZ-152 Compliance with a Custom Bitrix Module

A subject suddenly demands deletion of all data, and you discover that orders are linked to CRM contacts, audit logs store IPs, and history tables contain dozens of records. Bitrix's built-in tools don't cover compliance: no versioned consent log, no anonymization, no DSR request handling. We develop a turnkey module—from legal audit to deployment—with code that withstands real inspections. Our certified team guarantees a fully compliant solution at a cost starting from €8,000 for the basic package. Investing in a full compliance solution costs from €18,000.

On one project (an e-commerce store with 150,000 users), after implementing our module, 2,300 DSR requests were processed in the first year, 80% completed within 24 hours. A Roskomnadzor audit found no violations. This case proves that process automation is the only way to avoid fines at scale.

What compliance pain points exist in stock Bitrix?

Bitrix provides basic user management but lacks tools for:

• Versioning privacy policies and linking consents;
• Anonymizing data upon deletion (orders, contacts, logs);
• Exporting all personal data in a machine-readable format;
• Automated DSR request handling with deadlines.

Without a module, all this is done manually—risking missed deadlines and fines. Our development fills these gaps.

Technical implementation of the right to be forgotten

Deleting a user from Bitrix is easy—but deleting their data from all places without breaking business logic is hard. Orders can't be deleted—they are needed for accounting. CRM-linked contacts can't be deleted either—it breaks history.

The solution is anonymization, not deletion. We configure a list of tables where data is replaced with anonymized values. Anonymization is 10 times faster than full deletion while preserving business logic.

class UserAnonymizer { private array $tables = [ ['table' => 'b_user', 'where' => ['ID' => ':userId'], 'fields' => ['NAME' => 'Anonymous', 'LAST_NAME' => '', 'EMAIL' => 'anon_{ID}@deleted.invalid', 'PERSONAL_PHONE' => '', 'PERSONAL_BIRTHDAY' => '']], ['table' => 'b_sale_order', 'where' => ['USER_ID' => ':userId'], 'fields' => ['COMMENTS' => '[anonymized]']], ['table' => 'myvendor_user_address', 'where' => ['user_id' => ':userId'], 'action' => 'delete'], ]; public function anonymize(int $userId): void { foreach ($this->tables as $cfg) { // execute UPDATE or DELETE } // Write to log: who requested, when executed AnonymizationLogTable::add(['user_id' => $userId, 'executed_at' => new DateTime()]); } } 

Consent log

Each user consent is recorded: who, what, when, and based on which policy version.

CREATE TABLE myvendor_consent_log ( id BIGSERIAL PRIMARY KEY, user_id INT, session_id VARCHAR(100), ip INET NOT NULL, user_agent TEXT, consent_type VARCHAR(50) NOT NULL, policy_version VARCHAR(20) NOT NULL, granted BOOLEAN NOT NULL, source VARCHAR(100), created_at TIMESTAMP DEFAULT NOW() ); 

When the policy changes, the version number updates; users with old consent see a notification requiring renewed consent.

Cookie banner and consent management

The module generates a cookie banner with categories: necessary, analytics, marketing. The user's choice is stored in localStorage and synced with the server. Analytics scripts load conditionally—only upon consent to analytical cookies.

DSR request handling

A subject request form creates a ticket in the myvendor_dsr_request table. The administrator sees a queue with a 30-day deadline. As the deadline approaches, an automatic email reminder is sent. User data export generates a JSON archive with all related records.

The module includes incident logging: automatic logging, email notification to the responsible person, and generation of a notification for the supervisory authority within the required timeframe (24–72 hours depending on jurisdiction).

What is our work process?

1. Legal audit: determine what personal data is collected, on what basis, to whom it is transferred.
2. Design: agree on module architecture and timeline.
3. Development: write code, configure database, design banner.
4. Testing: verify subject rights scenarios.
5. Deployment and documentation.

Development timelines and costs

According to Art. 33 GDPR, breach notification must be sent within 72 hours. The module automates this: logs the incident, alerts the responsible person, and generates a notification form.

What you get

• ✅ Full compliance with FZ-152 and GDPR
• ✅ Process automation (saves up to 40 hours per month)
• ✅ Logs of all operations for audits
• ✅ Scalable architecture for any data volume
• ✅ Certified compliance guaranteed by our 10+ years of experience
• ✅ Integration with 1C-Bitrix for seamless data privacy management

Contact us for a data audit—we'll assess your task in 1 day. Request a consultation to discuss your project details.

References for further reading:

• EU General Data Protection Regulation (GDPR)
• Russian Federal Law 152-FZ on Personal Data