Mandatory Notification of Personal Data Processing: What Is Needed to Do Before May 30, 2025

New rules will come into force on May 30, 2025, obliging all persons working with personal data of individuals to notify the regulatory authority, Roskomnadzor.

Failure to comply with this requirement can result in significant fines ranging from 100,000 rubles to 300,000 rubles for legal entities.

1. Who Is Required to Submit the Notification?

Any individual or entity handling personal data must file a notification, including:

• Individuals engaged in business activities
• Self-employed entrepreneurs (sole proprietors)
• Legal entities (companies, NGOs, etc.)
• Government agencies

If personal information of individuals is collected, stored or used by a person (for example, through forms on the website, e-mail, questionnaires), then such person automatically becomes the operator of personal data and is obliged to comply with the requirements established by law.

• What Counts as Personal Data?

Personal data includes any information that can identify an individual, such as:

• Full name, date and place of birth
• Contact details (phone, email, address)
• Passport details, tax ID (INN), pension insurance number (SNILS)
• Employment, education, and financial status
• Bank card and account details
• Website cookies tracking user activity

Even storing just email addresses for newsletters qualifies as personal data processing.

• When Should the Notification Be Submitted?

The ideal approach is to notify before starting data processing. However, if you already handle such data, you have until May 30, 2025, to comply. After this date, failure to submit or delays in filing will result in fines.

• How to Submit?

Notifications must be sent to Roskomnadzor (Russia’s Federal Service for Supervision of Communications, IT, and Mass Media). There are three submission methods:

1. Paper submission – in person or by mail to a local Roskomnadzor office.
2. Electronic submission with a digital signature – using a qualified electronic signature (QES).
3. Via the Unified Identification and Authentication System (ESIA) – through the government services portal.

No state fee applies, but legal assistance for proper drafting may incur costs.

5. What Happens After Submission?

Roskomnadzor reviews notifications within 30 days. If approved, you will be added to the register of personal data operators.

However, filing the notification is just the first step—you must also comply with all legal requirements, including data protection measures and obtaining proper user consent.

6. What Are the Penalties for Non-Compliance?

Starting May 30, 2025, fines for missing or late notifications will be:

• Individuals: 5 000–10 000 rubles
• Company officials: 30 000–50 000 rubles
• Legal entities: 100 000–300 000 rubles

7. Who Is Exempt from Filing?

The law provides exceptions. No notification is required if:

1. Data is processed within state security systems.
2. Processing is done without automation (e.g., only paper records).
3. Activities relate to transportation security.

By May 30, 2025, all personal data handlers must submit a notification to Roskomnadzor. This is not just a formality—it’s a legal obligation, and violations carry heavy fines. If unsure about compliance, consulting a lawyer can help avoid mistakes and potential audits.