Alongside your DPO
Partial outsourcing
We back your in-house specialist with privacy expertise across the full range of data processing and protection matters.
Data Privacy & Data Security
Personal data compliance built on rigorous analysis and risk management
- 20+
- experts in personal data processing and protection
- 18 years
- of Data Privacy experience for the practice founder
- 10 years
- average Data Privacy experience of our lead experts
Trusted by
Services
From a one-off consultation to running your privacy function
Flexibility, a tailored approach and expertise across industries let us address client needs comprehensively rather than create a mere appearance of compliance.
Data Privacy
Comprehensive audit
Audit of personal data processing, gap analysis and documentation
We examine how personal data is processed, perform a gap analysis, identify legal risks and develop recommendations for treating them. Where needed, we prepare a full set of internal personal data documentation.
Optional, depending on client needs
- Staff training
- Audit of archiving processes
- Trade secret regime audit
- Threat model
- Specification and technical design of the data protection system
Data Privacy
Support
Partial and full outsourcing of the Data Protection Officer (DPO) function
Instead of an in-house DPO
Full outsourcing
We perform all duties of the person responsible for personal data processing ourselves.
Data Privacy
Advisory
Personal data compliance advisory and support in dealings with regulators and in court
Expertise
- Questions on any aspect of personal data processing
- Independent opinions and recommendations
- Professional training
Regulators and data subjects
- Support during regulatory inspections and representation in court
- Advice on liability matters and on personal data incidents
- Responses to regulator inquiries and data subject requests
Data Security
Security
Design of data protection, cybersecurity management and IT service management systems
We analyse current information security threats and design personal data protection systems in line with FSTEC and FSB methodology. We build information security and IT service management systems and prepare them for certification.
- ISO/IEC 27001/27701
- GOST R ISO/IEC 27001
- ISO/IEC 20000-1
- GOST R ISO/IEC 20000-1
- 1Analysis of current management processes
- 2Development of documentation
- 3Implementation of new processes
- 4Certification readiness
We will tailor the scope of services to your needs
Request a proposalApproach
Our approach is our advantage
Five principles for handling privacy risks
01
Risk-based approach
We treat privacy risks with the risk appetite of all stakeholders in mind
02
Do no harm
We never reduce privacy risks at the cost of increasing other risks
03
Active engagement
We discuss risk treatment proposals with stakeholders
04
Habit is second nature
We respect the way our clients are used to doing business
05
Practical results
We tailor deliverables for use in day-to-day operations
Team
More than 20 experts in personal data processing and protection
Most of our team members hold a law degree and certificates of continuing education in personal data protection. Our leaders speak at conferences, teach professional development courses and give lectures and master classes at leading Russian universities.
Our advantage
Many of us have in-house experience, and some still serve as DPOs in companies. That is why we balance legal requirements with business needs and protect the processes that already work.
Partners
Alexey Muntyan
Founder and Managing Partner
18 years in Data Privacy- Member of the Roskomnadzor Competence Center and of the Scientific and Technical Council of the Main Radio Frequency Center
- Co-founder of RPPA.pro, the community of privacy professionals
- Member of the State Examination Board of the Higher School of Law, Plekhanov Russian University of Economics
- Co-chair of the Privacy & Legal Innovation cluster at RAEC
- Former DPO at Johnson&Johnson, DHL Express, the Alfa Group consortium, Sberbank CIB and the Office of the UN High Commissioner for Human Rights
Alexander Partin
Partner, attorney, head of special projects
11 years in Data Privacy- Attorney at law, member of the Moscow Bar Chamber and the Bastion Bar Association
- Former Legal Director at Kimberly-Clark (Central & Eastern Europe, Turkey) and Chief Privacy Counsel at the MidHub blockchain project
- Partner and instructor at RPPA, including AI Governance courses
- IAPP member, CIPP/E and CIPM certified
Industry practices
Healthcare and pharmaceuticals
Nikolay Aleksandrov
Practice lead, 6 years in Data Privacy
10 years in the pharmaceutical industry (Eli Lilly & Co.), hands-on experience in clinical healthcare
Ekaterina Ashcheulova
Practice lead, 5 years in Data Privacy
14 years at an international pharmaceutical company (Eli Lilly & Co.) in legal and compliance roles
Transport, logistics and technology
Ruslan Chepurin
Practice lead, 10 years in Data Privacy
Former Chief Legal Counsel at Beeline, practical experience in criminal law. PPCP certified
Finance
Oksana Zmeu
Practice lead, 5 years in Data Privacy
15 years as an in-house lawyer at financial institutions
Almanac
Our methodology and useful resources
Open catalogues, tools and analysis by Privacy Advocates, now in English. Start with our two key tools.
Tool
Personal data processing and protection checklist
Personal data compliance controls in 10 sections, with liability measures and risk factors
132controls with legal provisions, references, sanctions and risk factors
Sanctions
- 01Governance and records of processing
- 02Purpose limitation and proportionality
- 03Legal grounds for processing
- 04Collection, use, storage and destruction
- 05Transfers and third-party agreements
- 06Interaction with data subjects
- 07Interaction with authorities
- 08Staff awareness and training
- 09Security of processing
- 10Deviation control and incident response
- Annex 1 liability measures
- Annex 2 inspection risk factors
Quick check
Check yourself in a minute
Eight practical questions on Russian personal data law, based on the checklist sections. Your answers stay in your browser; we do not receive or store them.
- 01Every personal data collection form on your website links to your current personal data processing policyChecklist section 01
- 02The consent checkbox on personal data collection forms is not pre-ticked, and consent is kept separate from the offer or terms of useChecklist section 03
- 03Your entry in the Roskomnadzor register of operators matches reality: purposes, data categories, categories of data subjects and cross-border transfersChecklist section 07
- 04Website forms and CRM store data on servers in Russia, without Google Forms or foreign cloudsChecklist section 04
- 05There are no cross-border data transfers (email, cloud, counterparty), or Roskomnadzor has been notified of themChecklist section 05
- 06With every contractor receiving personal data (outsourced accounting/HR, mailings, call center, hosting), the contract sets out data processing and protection termsChecklist section 05
- 07Only those who need access to personal data for their work have it; departing employees lose it on their last day, and contractors when their contract endsChecklist section 09
- 08Data past its retention period (candidate CVs, former clients) is actually deleted, with destruction records to prove itChecklist section 04
The quick check is for information only and does not replace an audit.
Digest 2026
NewDigest of key personal data developments and initiatives
A regularly updated overview of Russian laws, drafts, case law and the policy agenda
Open the digest- Laws and draftsFederal laws, presidential and government acts, agency regulations and drafts, with effective dates
- Case lawEnforcement practice of courts, Roskomnadzor, the antimonopoly service and prosecutors, with references and key points
- AgendaInitiatives, events and analysis from regulators, lawmakers, the expert community and the market
- FreshnessLast-updated date and New labels for the latest additions