Dealing with RKN and authorities

• Authority
• Scope
• Tools
• Basis

• Roskomnadzor
• subject rights, operators register, Law 152-FZ rules
• inspections, visits, monitoring, demands, orders, offence reports
• Arts. 23, 23.1 Law 152-FZ, Res. 1046

• FSTEC of Russia
• technical information protection
• set of measures, certification, licensing, attestation, control of measures in state PDIS
• Art. 19(4), (8) of Law 152-FZ, Orders No. 21, 117

• FSB of Russia
• cryptography, GosSOPKA, Art. 13.12(1), (2), (6) CAO cases
• crypto tool requirements, licensing, orders on access and database copy
• Orders No. 378, 77, 297, 547, 321; Art. 23.46 of the CAO

• Prosecutor's office
• enforcing laws generally
• requests, inspections outside Law 248-FZ, submissions, demands for RKN inspection, suits
• Arts. 6, 21, 22 of Law 2202-1

• Security agencies
• systems with data on protected persons
• access on an order in the prescribed form
• Art. 6(1.1), (1.2) of Law 152-FZ

• Digital Ministry, Rostrud
• risk indicators; employee PD, Labour Code Ch. 14
• Ministry Order No. 1187; labour checks, Art. 5.27 of the CAO
• Art. 23 248-FZ; Arts. 86-90 Lab. Code

Boundary: RKN refers control of Art. 19 measures to the FSB and FSTEC (letter of 12.09.2024 No. 08-377683), but a paper trail of security measures is still needed

• 1
• Control activity under Law 248-FZ

inspection, inspection visit, raid check: a request is backed by Art. 19.7 of the CAO, obstruction by Art. 19.4.1(1)

• 2
• Activity without interaction

website monitoring and analysis of operator data without notice; outcome is a demand or caution

• 3
• Preventive visit

a mandatory visit cannot be declined, documents are requested; at the operator's request no orders (Art. 52.2(9))

• 4
• Complaint or information request

Art. 20(4) of Law 152-FZ: 10 working days plus up to 5 on reasoned notice; silence: Art. 19.7 CAO

• 5
• Prosecutor's request

Law 2202-1: ignoring a prosecutor's demand, Art. 17.7 of the CAO

Classifying the incoming item

Four steps before replying

• 1
• authority: sets the subject of questions and extent of disclosure

• 2
• form: decision and unified register number - an activity; citizen reference - complaint review

• 3
• regime and deadline: runs from receipt

• 4
• a proxy and single contact point, ideally the person responsible for organising processing

Rule: a reasoned refusal beats silence: silence is itself an offence, a refusal records your position before a case starts

24 hours

appoint a responsible person

and notify the agency from receipt of the order

3 hours

for immediate access

for state secrets, the person needs clearance

24 hours

report any disclosure

of the order and of officials' data, even if unintentional

Art. 19.5.3

CAO

higher sanction for failing to comply with such an order

Technical reasons are no excuse

processing speed, maintenance windows and off-hours do not delay access

No traces of earlier entries

officials enter data and logs must not reveal the original content

Closed route

not via the general registry, tickets or work chats: only the responsible person and head are told

FSB from 01.04.2026

Two forms of orders

on access to systems with protected persons (Art. 17 of the FSB Law, Art. 19.5.3 of the CAO) and on a database copy (Art. 15, signed by the FSB head, a deputy or a regional office head, no special sanction)

Law 2202-1

Supervision without register or moratorium

the prosecutor requests documents on the inspection subject (Art. 6), processes PD under Art. 4(2.1) and may demand an unscheduled RKN inspection (Art. 57(1)(4) of Law 248-FZ)

Own website monitoring

Kolomna, 20.05.2026: Yandex Metrica without consent - Art. 13.11(1); policy omits it - Art. 13.11(3); fine ₽30k. Art. 13.11(1): warning after annulment on 31.08.2026

System detail

requests ask for server names, DBMS, IP addresses and data flow diagrams, and in 2026 threat models and FSTEC Order No. 21 measures

Submission

consider at once, reply within a month (Art. 24): a reply, not agreement; non-compliance - Art. 17.7 of the CAO

Lawsuit in the public sector

court ordered a municipality to prepare documents under Art. 18.1 and Res. 211 (case No. 2-43/2021)

Note: a prosecutor's inspection episodes are not merged into one penalty (Art. 4.4(5) of the CAO). The Constitutional Court allowed paying half the fine (39-P of 18.07.2024), but since 30.05.2025 this does not apply to Art. 13.11 of the CAO

vs

To file

Notification needed

any automation, even PCs, 1C, a website or counters, voids the paper exemption

the exemption must cover all activity, otherwise it is also reported

each group entity files its own (Roskomnadzor letter of 14.08.2026 No. 109631-10/77)

a processor is, per Roskomnadzor, also an operator for notification, though disputed

small staff and one-off processes are no ground for not filing

No filing needed

Exemption or other construct

Art. 22(2)(7): GIS for state security and public order

(8): non-automated processing only

(9): cases under transport security legislation

a citizen convening an owners' meeting exercises their own right

a foreign person not registered in Russia files, per an RKN office position (03.12.2025), after opening a representative office

SFC case: for a special financial company with no bodies or staff, Privacy Advocates deems filing unnecessary: the management company runs the processing. Record the ground in writing and keep a draft notification ready

• Field
• How to fill
• Typical error

• Purposes
• by substance: employment duties as one purpose, health insurance separate; "other" box worded as in the policy
• one "statutory activity" purpose for all processes

• PD categories
• the data items as a full list
• passport and diploma instead of items, "and others"

• Legal basis
• sector acts with details, own internal regulations
• a single reference to Law 152-FZ

• Actions
• only those actually done
• the full list, incl. dissemination and depersonalisation

• Website
• site visitors, cookies, metrics, by collection purpose
• site missing from the notification

• Databases and CBT
• country and address of own facilities; CBT: fact only, details in Art. 12 notice
• clouds disputed: RKN orally on 14.08.2026 limits field to the operator's facilities

• Measures, crypto, date
• measures actually taken, supplemented later; crypto tools with documentation; actual start date
• waiting for all measures and not filing

Trap: a field in a change notification replaces the record's previous content entirely: entering only the added item erases the rest

3+

Risk indicator, Ministry Order No. 1187

Three mismatch facts

mismatches between notified processing and CBT data and the website policy justify an unscheduled activity; no calendar-year limit on this indicator

How to keep the set in sync

Single source

edits flow from the record to notification, policy and website at once

Update procedure

changes by the 15th of the next month, end of processing notified within 10 working days; triggers: a new service, change of responsible person, database move

Old entries

RKN suggests updating notifications from before 01.09.2022 on the Order No. 180 form; no hard deadline

External cross-check

in 2026 a prosecutor noted site visitors and cookies missing in the register

Note: failure to file is no ground for inspection by itself but surfaces at any contact: a complaint, request or prosecutor's inspection. Most often it starts with an information request, answered within 10 working days

728

preventive visits

in H1 2026

1

unscheduled inspection

same period; no scheduled ones in 2024

89

orders

issued after visits

504

violations

found, 490 under Art. 13.11 of the CAO

Mandatory

Authority's initiative

24 hours' notice, no refusal

up to 10 working days (Res. 1286)

documents are requested, inspection may be remote

unfixed by the end of the visit: order

On request

Operator's initiative

small business, socially oriented NPOs and institutions

explanations are advisory

no orders issued (Art. 52.2(9))

Visit report

Three outcomes

• 1
• no violations

• 2
• remedied by the end of the visit

• 3
• not remedied - order

Risk category where groups intersect

probability group: sanctions history

• severity
• 1
• 2
• 3
• 4

• A
• high
• significant
• significant
• medium

• B
• high
• significant
• medium
• moderate

• C
• significant
• significant
• medium
• moderate

• D
• medium
• medium
• moderate
• low

Severity group criteria

A: special categories, biometrics, 100k+ subjects, redundant consent, foreign collection services, depersonalised data transfer

B: children, 10k+ subjects, foreign databases, depersonalisation, no transfer

C: relatives, 1-10k subjects, CBT to adequate countries

D: under 1k subjects, public sources

Probability is sanctions history

groups 1-3 by response acts over 2 years and rulings over 3 years, group 4 - none

Scheduled workload

high risk: inspection every 2 years or a visit yearly; significant, medium, moderate: visit at most every 3, 5, 6 years (Res. 1511)

Compliance does not lower category

a flawless operator is always in group 4, and redundant consent or depersonalised transfer lifts severity to A

Indicators outside the category

four thresholds of Ministry Order No. 1187 trigger an unscheduled activity in any category

1

Complaint to regulator

a subject complains about an operator

2

Request

10 working days, at most 5 more

3

Demand

comply or explain within 10 working days

4

Case

on a citizen's application

5

Appeal

subject can be the victim

6

Lawsuit

compensation and an injunction

honest reply

Incomplete letter to applicant attached

it proves the Art. 13.11(4) CAO offence itself (case No. 05-1546/419/2024, warning issued)

evasive reply

Version differs from the citizen's

ten discrepancies a year trigger a risk indicator and an unscheduled activity

silence

Request ignored

a separate offence, Art. 19.7 of the CAO, and no chance to explain before a case

One way out: answer the applicant fully the first time; before replying to the regulator check your letter and send a supplement if it was incomplete

• Report
• Force
• Response time
• For non-compliance

• Caution
• creates no obligation
• objection in 10 working days (cl. 20, Res. 1046)
• no offence

• Demand to clarify or destroy
• binding
• comply or explain within 10 working days
• Art. 13.11(5), (5.1)

• Demand to stop processing
• binding
• the demand itself sets the deadline
• no own paragraph; Art. 19.5 disputed

• Order
• binding
• comply on time, appeal within 10 working days
• Art. 19.5(1) CAO

• Prosecutor's submission
• a reply, not agreement
• one month (Art. 24 of Law 2202-1)
• Art. 17.7 of the CAO

• Check before the activity starts
• ground from closed list in Art. 57(1) of Law 248-FZ
• agreement with the prosecutor's office

• number in the unified register
• 24 hours' notice
• ID cards and QR code
• defects under Art. 91 - results annulled

Different regime: leak investigations run under the CAO with no moratorium or prosecutor approval; information is due in 3 days (Arts. 26.10, 28.7 CAO)

01

Classify first

who contacted you and how: this sets the deadline, duty to reply and cost of silence

02

Notification mirrors the register

almost all must notify; notification, policy, site are cross-checked externally, no inspection

03

Visit instead of inspection

the mandatory preventive visit is now the main supervision channel; prepare for it as for an inspection

04

Category is not a shield

the model reflects processing features and sanctions history; indicators and complaints work outside it

05

A reply is evidence

a letter with annexes can itself make the offence: check it before sending, contest an order within 10 days