Website checklist for Federal Law No. 152-FZ: what to check before launch
Federal Law No. 152-FZ is not just a policy in the footer. We’ll break down point by point where personal data appears on your website, what questions to ask yourself before launch, and what signs indicate a requirement hasn’t been fulfilled.
How to use a checklist
Below are questions you should go through for your website before launch or after a major overhaul. Each item is phrased so that you can answer "yes" or "no" and provide supporting evidence: a line from a processing register, a link to a document, or a screenshot of a setting.
This is a guide for internal self-assessment, not legal advice. Controversial cases—cross-border data transfers, biometrics, special categories of data, and processing on behalf of a controller—are reviewed with a lawyer tailored to the specific company: the cost of an error here exceeds the cost of consultation.
1. Inventory: where on the website do the data appear at all
The first step is not documents, but a list. Until it's clear what data is being collected, any policy will be written "in general terms."
- Are all lead capture points collected into a single list: feedback forms, requests, subscriptions, chat, callback requests, personal account, job application responses, comments?
- Is it specified for each point which fields are being collected and exactly why they are needed—or are some fields included 'just in case'?
- Are non-obvious channels taken into account: email and phone number listed on the website, file and resume uploads, call recordings, and inquiries via messengers?
- Is there any data collected automatically: IP address, device and session identifiers in logs, analytics tags?
2. Basis for processing: why you are entitled to do this
Each processing purpose requires a conscious legal basis. Consent is not the only—and often not the best—option: where data is needed for contract performance, consent only muddies the waters.
- Is the legal basis defined for each purpose: data subject's consent, performance of a contract, legal obligation, or another basis provided by Article 6 of Federal Law No. 152-FZ?
- If consent is chosen as the legal basis, it is specific, informed, and explicit: a separate checkbox without being pre-ticked, clear wording, and the ability to refuse while still being able to use the website where processing isn’t mandatory?
- Is consent for processing separated from consent for marketing communications—do they have different purposes and legal bases?
- Is there separate consent for the dissemination of personal data if you publish reviews, photos, or names of clients or employees?
- Is the fact of obtaining consent recorded in a way that allows it to be verified during an audit: date, scope, version of the text?
- Is consent withdrawal implemented—and what happens to the data after withdrawal?
3. Documents and Transparency
- Is the personal data processing policy published in free access, without registration, and is it accessible from every page where data collection occurs?
- Does the policy text reflect reality: do the stated purposes, data categories, retention periods, and recipients match what actually occurs?
- Is the procedure for a data subject described: how to request information about processing, clarify, block or delete data, within what timeframe you respond, and to which address correspondence should be sent?
- Is it specified who the operator is: the name, address, and contact details of the person responsible for organizing the processing?
- Are the third parties to whom data is transferred disclosed — CRM, mailing services, analytics, hosting, call tracking, support contractors?
4. Notification to Roskomnadzor and registration
- Has it been verified whether you are required to submit a notification regarding the processing of personal data, and has it actually been submitted?
- Do the details in the submitted notification match current practice: purposes, categories of data subjects and data, list of actions, timeframes?
- Is there a procedure for updating the notification when a new form, new service, or new processing purpose is added?
- Has a person responsible for organizing the processing of personal data been appointed, and is he aware of it?
- Is there an internal register maintained listing which information systems process personal data, who has access to them, and what security measures have been implemented?
5. Localization and cross-border transfer
Two questions due to which a website most often ends up in a risk zone without even realizing it: they are created not by lawyers, but by connected services.
- Is the requirement for recording, systematizing, accumulating, storing, clarifying, and retrieving personal data of Russian citizens using databases located within the territory of Russia being fulfilled?
- Is it known where the servers of the services used are physically located: hosting, CRM, email marketing service, website chat, forms, analytics, cloud file storage?
- If data is transferred abroad, has the specific destination been identified, and have the requirements for cross-border transfers been met, including notifying the regulator where required?
- Have foreign scripts on pages been checked: maps, fonts, video players, social media widgets, external chats — can they also transmit user identifiers?
6. Cookies, analytics, and trackers
- Is there a list of all cookies and similar technologies with their purpose and lifespan?
- Are technically necessary cookies separated from analytical and advertising ones—and is consent requested where required?
- Does opt-out actually work: after opting out, are analytics and pixel scripts not loaded?
- Is the user informed about which third-party services receive data about their visit?
7. Storage, Access, and Protection
- Are retention periods defined for each data category, and is there a real procedure in place for deletion upon expiration—including backups and email exports?
- Is employee access to requests and inquiries restricted based on the principle of necessity, and is an access log maintained?
- Is the transmission channel protected: HTTPS on all pages with forms, and no data sent to third-party domains without justification?
- Are contracts or processing agreements concluded with contractors who process data on your behalf, specifying data protection requirements?
- Is the incident response procedure defined: who identifies, who notifies the regulator and data subjects, and within what timeframes?
8. AI scenarios on the website
A point not yet included in standard checklists, yet already a problem: assistants and model-based request handling create a new data pathway.
- Do personal data end up in model requests—from a form, chat, uploaded file, or call transcription?
- Is it known where the model is executed: within your perimeter or on an external service, and what does this service do with the contents of the requests?
- Has AI processing been accounted for in the policy and list of purposes, or did the assistant appear on the website after the documents were published?
- Is masking or exclusion of sensitive fields configured before sending to the model?
- Are chats and transcripts stored, who has access to them, and how long are they retained?
How this website works
The RESTART website is built without advertising or analytics trackers and without a cookie banner: there's nothing to collect consent for. However, this doesn't mean there are no personal data at all—email addresses and phone numbers used to contact us also lead to the processing of personal data, which is described in processing policyWe deliberately avoid placing forms with unnecessary fields on the website: the less data collected, the less there is to protect and explain.
Let's discuss your environment
Describe the task, current systems, constraints, and expected results. We will offer a practical first step: diagnostics, pilot, audit, roadmap or project team.
