Ensuring website compliance with 152-FZ requirements
Federal Law "On Personal Data" No. 152-FZ obligates personal data operators to perform a set of organizational and technical measures. For most commercial websites collecting user names, emails, and phone numbers, specific technical requirements arise.
What is personal data under 152-FZ
Personal data is any information directly or indirectly identifying a natural person. In practice: full name, phone, email, address, IP address (debatable, but case law tends toward yes), cookies with identifier.
Technical requirements for basic level (УЗ-4)
Data localization (Art. 18.1): Personal data of Russian citizens must be collected and stored on servers in RF. Replication abroad is permitted, but primary storage must be in RF.
Encryption in transit:
- HTTPS mandatory on all pages where personal data is collected
- TLS 1.2 minimum, TLS 1.3 recommended
Access control: Access to personal data only for employees who need it for job duties.
class PersonalDataPolicy
{
public function view(User $authUser, User $targetUser): bool
{
return $authUser->hasPermissionTo('view-personal-data')
&& $authUser->department === 'support';
}
}
Mandatory website elements
Privacy Policy: Must contain: processing purposes, legal basis, data list, retention period, third-party transfer info, data subject rights.
Consent to processing: Explicit, informed, specific. Checkbox "I agree with policy" without unchecking option doesn't meet requirements.
Breach notification: Upon data breach discovery — notify Roskomnadzor within 24 hours, data subjects within 72 hours.
class DataBreachNotificationService
{
public function notifyRkn(DataBreach $breach): void
{
// Submit to RKN via pd.rkn.gov.ru (API or email)
// Deadline: 24 hours from discovery
}
public function notifyAffectedUsers(DataBreach $breach): void
{
$affectedUsers = $this->getAffectedUsers($breach);
// Mass mailing with breach description
// Deadline: 72 hours
}
}
Personal Data Processing Registry
Operators processing personal data must maintain internal registry:
class ProcessingActivityRegistry
{
private array $activities = [
[
'name' => 'User registration',
'purpose' => 'Service access provision',
'legal_basis' => 'Consent (Art. 6.1 152-FZ)',
'data_types' => ['Full name', 'email', 'phone'],
'storage_period'=> '5 years after account deletion',
'third_parties' => ['Sendgrid (email, DPA signed)'],
'server_location'=> 'RF (Selectel, Moscow)',
],
];
}
Roskomnadzor notification
Before personal data processing begins, operator must notify RKN. Submit via pd.rkn.gov.ru.
Exceptions (no notification required): employee data, one-time contract data, publicly disclosed data.
Technical measures by FStek Order No. 21
For УЗ-4 (most commercial websites):
- User identification and authentication
- Access management (role-based model)
- Security event logging
- Antivirus protection
- Intrusion detection (IDS/WAF)
- Software updates
DPA agreements with contractors
When transferring personal data to third parties (cloud services, email providers, analytics), DPA (Data Processing Agreement) must be signed.
Implementation Timeline
- Audit of current state + gap analysis: 2–3 days
- Privacy Policy + consents: 3–5 days
- Technical measures (encryption, logging, access): 5–10 days
- RKN notification + registry: 1–2 days