Legal bases for processing

• Law and public bases
• the triggering fact is set by a provision, independent of the subject's will (Art. 6(1)(2)-(4), (11))

• Contract with the subject
• fact occurred, scope set by contract subject, relationship initiated by the subject (item 5)

• Legitimate interest
• the operator builds the context link by the purpose, necessity and balancing test (item 7)

• Consent
• the fact is created on purpose, and withdrawal at any time cancels the basis (item 1)

reliable

Law, contract, disclosure, court

the subject cannot switch them off, so critical and continuing processes are built on them

borderline

Legitimate interest

lawful but evaluative, so a written assessment and a fallback scenario are needed

unreliable

Consent

can be withdrawn at any time; kept for purposes with no other basis

Methodology: the law does not rank bases, but Roskomnadzor sees consent only outside the cases in Art. 6(1)(2)-(11). The sign of substitution is simple: if withdrawing consent changes nothing in processing, it rests on another basis

• Item 1
• consent
• Item 2
• law
• item 4
• gov service
• Item 5
• contract
• Item 6
• vital interests
• item 7
• legitimate interest

• Item 2
• a provision obliges or empowers the operator
• 1
• a provision merely presupposes processing
• item 7

Distinguishing items 2 and 7: Roskomnadzor, 27.07.2023. Example: school olympiad under a departmental act, item 2 (07.12.2023)

• Item 2
• duty and power
• 2
• a subjective right with an applicability assessment
• item 7

Example: a shareholder's right to company documents

• Item 5
• needed for the contract's subject
• 3
• whatever the contract does not need requires its own basis: interest does not top up a contract
• other

Example: mailing, profiling, scoring from third-party sources

• item 4
• the service starts with a citizen's request
• 4
• the function is request-independent
• Item 2

Example: epidemic control under item 2, the authority has no legitimate interest

• Item 6
• only if consent is objectively impossible
• 5
• protection of third parties and society
• item 7

Example: video of a conflict for the police

• Item 1
• only if none of items 2-11 fits
• 6
• consent is not needed and is not collected as a reserve (Roskomnadzor letter of 03.10.2025)
• items 2-11

Example: school register under items 2, 4 after parent withdraws consent (Moscow City Ct, 2026)

Rule: as many bases as purposes: delivery by contract, records by law, defence in court by legitimate interest, mailing by consent. Roskomnadzor orally allows competing bases (14.08.2026), but a reserve basis for the same purpose betrays an unworked-out purpose

1

Purpose, operation

a multi-purpose process is split

2

Data category

Arts. 10, 11 and 10.1 have own lists

3

Without consent

law, court, public service, contract, disclosure

4

Legitimate interest

three criteria, no bypassing bans

5

Consent

if no alternative exists or the law requires it

6

Recording

policy, record, assessment, logs

Log of bases

Logging the bases

the operator proves the basis (Art. 9(3)), so evidence is collected when the process starts

date of consent or of the fact that triggered the basis

the subject, and a representative's authority if any

Art. 6(1) item or Art. 10, 11 provision, and purpose

term, status and date of withdrawal or lapse

Basis for data, not for purpose

one basis for the whole client base hides mailing, profiling and transfers

Chosen once and for all

contracts end, consents are withdrawn, but the register entry stays the same

Processing on a lapsed basis

data kept after the contract or withdrawal, recipients not notified

Basis after withdrawal

a construct that first appears in correspondence on withdrawal looks like abuse

Art. 9(1), from 01.09.2025

Two features of separation

visually and semantically separate from contracts, regulations, forms and other data

a separate act of will, not merged with signing a contract or accepting an agreement

the requirement covers any form, including oral and implied

the court noted: requirements for proper advertising consent took shape in practice long before 01.09.2025 (discount card form, Moscow Commercial Court 20.04.2026, A40-311022/2025)

• Disputed area
• 2026 guideline

• consent tick in a standard form under item 7(b) of Res. 687
• allowed as a declaration without signature, per Roskomnadzor's letter of 03.10.2025

• consent on the back of a form or contract
• allowed if signed as a standalone document by a separate act

• standard employment contract of a micro-enterprise (Res. 858)
• clash with Labour Code Art. 309.2 open; safer to prioritise Art. 9(1)

• modular consent, annex to a contract or regulations
• the regulator neither confirmed nor ruled it out; a separate signature per block is needed

• one text covering consent to advertising, image, secrecy
• disputed, separate declarations are safer

• a set of documents under one e-signature
• disputed, a separate act for consent is safer

Practice: one signature under a policy and application does not make both a contract and consent: the order to the insurer held in three instances, the Supreme Court refused referral (A44-745/2017, 31.07.2018)

recipients

Recipients by name

name the processor with name and address, categories are not enough (A65-35933/2017)

term

Definite term

by purpose or contract term; 10 years after the contract held excessive (A40-12838/2022)

purposes

Purposes by form

written form needs one purpose per consent, simple form lists each purpose

operator

One addressee

Roskomnadzor orally does not allow one declaration to several equal operators

2%

Insurer survey, 2026

read the consent carefully

48% are sure the service cannot be used without consent

Informedness

information comes before the declaration, not after sending the form

explain terms in the text, citing the law is not enough (A44-9647/2015)

a signature and a withdrawal clause do not cure a content defect (A65-35933/2017, A65-33540/2017)

vs

Consent withdrawal

Art. 9(2), 21(5)

tied to the consent and acts only for the future

stop processing and destroy data in 30 days, unless needed for the purposes or the contract says otherwise

full or partial: by purpose, channel, operator, recipient

if another basis existed independently, processing continues and a reasoned reply is given

a written consent must state the withdrawal method (Art. 9(4)(8))

Demand to stop processing

Art. 21(5.1)

made regardless of consent

comply in 10 business days, extendable by 5 with a reasoned notice

does not cover processing under Art. 6(1)(2)-(11), 10(2) and 11(2)

classified by the wording of the request, clarified if unclear

confusion causes delay or a withdrawal without data destruction

• Special procedure
• marketing under Art. 15: immediately
• dissemination, Art. 10.1: from the demand

• biometrics in the UBS: to the system operator via Gosuslugi
• patient: care does not stop

Errors: withdrawal is hedged with formalities heavier than giving consent, or the whole data set is destroyed without checking bases, and a basis invented at the moment of withdrawal looks like abuse of right

• Subject
• Who consents
• Basis and caveats

• under 14
• legal representative, one parent's signature is enough
• RKN letters of 29.12.2021 and 30.03.2023

• 14 to 18
• alone within capacity (Art. 26 Civil Code), beyond it RKN orally (14.08.2026) accepts one representative's consent
• disputed

• patient from 15
• alone, for data tied to medical intervention
• Art. 54 of Law 323-FZ, some categories have own thresholds

• emancipated or married
• alone, no age limits
• Arts. 21, 27 Civil Code, proved by a decision or certificate

• incapacitated
• guardian, who also withdraws consent
• Art. 9(6) of Law 152-FZ, appointment document

• deceased
• heirs, if no consent was given in life (bill No. 1219127-8 changes the rule)
• Art. 9(7) of Law 152-FZ, lifetime consent stays valid

• any capable person
• agent under power of attorney, no notary needed
• except consent to dissemination (RKN letter of 02.12.2021)

Can and cannot: an owners' meeting gives no consent for participants, its decision is void (cassation 88-5455/2024, retrial). For a teenager, consent signed by both the teen and a representative is safer

• Who is in the contract
• Item 5

• contract party, incl. public and adhesion contracts
• covered

• beneficiary or surety, incl. an insured under group insurance
• covered

• prospective party on own initiative: request, order, registration
• covered

• insured person without beneficiary status
• no

• representative, counterparty employee, client's relative
• no

• employee: RKN treats HR processing under item 2
• no

• unilateral deed outside contract: power of attorney, set-off
• no

Necessity test per flow

• 1
• Obligations

list main terms, set aside incidental ones

• 2
• Purpose

per obligation, never the formula "to perform the contract"

• 3
• Link

purpose is met by exactly this processing and data set

• 4
• Alternative

no less intrusive way

• 5
• Remainder

the rest moves to its own basis, promotion only to consent

Test question: would the operator stop performing the obligation if it skipped the operation. Delivery and online payment fall within the subject matter, ad profiling and a credit report request (218-FZ) do not

• pre-contract
• performance
• after termination

Subject's request (item 5)

Performance (item 5)

Refunds, settlements, penalty (item 5)

Accounting, tax, 115-FZ (item 2)

Archive terms, 125-FZ (item 2)

Evidence for a dispute (item 7)

Initiative

data comes in reply to subject's action, not from own database

Party identification

another's contract is no basis, even through an agent

SMS code

proves no intent: Supreme Court requires checking the person

Contract lapses

record the moment and reason

move mandatory periods to item 2

destroy the rest within 30 days

separate archive from active

Art. 6(1)(2) of Law 152-FZ

Two independent branches

aims of a Russian international treaty or law

functions, powers and duties under Russian law, incl. Government resolutions, departmental and municipal acts

a "consent not required" clause is not a condition

Prescription markers in the norm

• "operator is obliged"
• "shall be stored"
• "shall be submitted"

• "are posted"
• sanction for non-compliance

What forms no basis

operator's internal act and foreign law

norm granting a right: route to item 7 with assessment

general reference to Law 152-FZ or to legislation, no article

advertising and procurement rules: marketing needs item 1 and Art. 15

Record: each purpose gets its own article of the sectoral act. The layer is built on the Labour Code, Tax Code, Law 402-FZ, social insurance and corporate law, and minimisation limits performance: counter-terrorism security does not justify copying a visitor's passport

• Basis
• What it covers
• Limit

• item 3, legal proceedings
• other party's data in the claim and procedural papers, transfer to own representative
• only within the case: Supreme Court requires checking that data served the defence (25-AD25-1-K4, remitted for retrial); collection bypassing the court is not covered

• item 4, public services
• processing to deliver a service at the applicant's request
• extra consent is no filing condition (Supreme Court, 5-KA19-56)

• item 11, mandatory disclosure
• further processing of disclosed data: bankruptcy, procurement, teachers
• dissemination consent not taken (A40-139096/2022, Supreme Court refused to refer)

• Art. 15 of the FSB law, from 01.04.2026
• transfer of a database copy on order, classed under item 2
• check form, signature and secrecy regime, destroy copies once purposes are met

• Art. 27(4)-(6), Law 161-FZ, antifraud
• sharing of transfer data without client consent
• item 2 basis, so consent withdrawal does not stop the exchange

Contractor: a third party changes nothing if the law does not require personal performance, data volume is minimal and the instruction meets Art. 6(3) and Art. 88 of the Labour Code. Presnensky District Court held payroll outsourcing lawful (2-907/2024)

Prohibited contract terms

Limiting rights and freedoms

terms restricting data subject rights and freedoms

Minors' PD

provisions setting the cases of their processing, unless otherwise provided by law

Inaction as a condition

silence and an unticked refusal are not acceptance, the ban came with unambiguous consent

How item 5 changed

Law 363-FZ of 21.12.2013 added processing on assignment from 01.07.2014, assignment was dropped from the item on 01.01.2017, and Law 266-FZ added from 01.09.2022 a second sentence with three bans

RKN, 03.07.2026

No contract terms contrary to Law 152-FZ

contract formed under Ch. 28 of the Civil Code, processing follows Art. 5 of Law 152-FZ

a transfer clause names recipients and purposes

name third parties or link to an operator resource listing them

Review: offers and adhesion contracts are checked against the three bans and retention periods, an impermissible term found is removed, not softened in wording. Typical defects of consumer contracts are analysed in Section 12

1

Interest and purpose

a current interest from the operator's real activity, formalised through a specific purpose

2

Necessity

purpose unachievable without this data and scope, no less intrusive alternative

3

Balance

no violation of subject's rights: expectations, notice, vulnerability, lawful source

or

Category 1

Right granted by a norm

shareholder and participant information rights (Arts. 65.2, 67 Civil Code), checking a counterparty representative's authority. Justify briefly: the norm, and the right cannot be exercised without processing

Category 2

Activity not prohibited

antifraud, system security, business model follow from dispositive law and legal capacity. No norm exists, so proof rests on describing the activity, purpose and necessity

Important: criteria do not offset one another, failing any means Art. 13.11(1) of the CAO. A public authority has no interest of its own, and the Constitutional Court declined complaints on item 7 (2173-O of 18.07.2019, 2029-O of 30.06.2026), but the operator must prove the criteria for each process

Method: three filters

• 1
• Basis filter

whether a more suitable or mandatory basis exists

• 2
• Norm filter

a norm on a right or significant purpose, item 7 strictly read with "and"

• 3
• Processing filter

whether special regimes risking rights violations apply

Filter result

• passed
• !
• with remarks

• failed
• -
• inapplicable

Selection does not replace the assessment, it cuts false expectations before it

Calculator example: four processes

• Filter criterion
• Access
• Hiring
• Audit
• Incident

• 1.1
• Consent mandatory by law

• 1.2
• Cases directly from law or contract
• !
• !
• !
• !

• 2.1
• No rights of operator or third parties

• 2.2
• No norms on public interest
• !
• -
• -
• -

• 3.1
• Public sources, Art. 8

• 3.2
• Incapacitated, children, Art. 9
• !
• !
• !
• !

• 3.3
• Special categories, Art. 10
• !
• !
• !

• 3.4
• Allowed for dissemination, Art. 10.1

• 3.5
• Biometrics for identification, Art. 11

• 3.6
• CBT, Art. 12

• 3.7
• Marketing and campaigning by telecom, Art. 15

• 3.8
• Automated decisions, Art. 16

• 3.9
• Workers outside employment, Labour Code
• -
• !
• !

• 3.10
• Image and private life, Civil Code

• 3.11
• Protected secret, Art. 9 of 149-FZ

Potential applicability of item 7

Processes: access control, hiring with relatives' data, audits, incident investigations. Remarks are cleared by minimisation and safeguards: contract with a sole proprietor or individual (1.2), children and special categories (3.2, 3.3), IS auditors and consultants (3.9)

vs

Passes assessment

access control and site security with minimum identifying data

preparing a claim and passing data to court if it cannot be obtained in the case

employee conflict-of-interest check in open registers (Art. 13.3, Law 273-FZ)

shareholder and participant rights to company documents

keeping evidence of lawfulness within the limitation period

Does not work

direct marketing, special categories and convictions, biometrics, dissemination, automated decisions

employee PD transfer to third parties, incl. within a group (Art. 88 Labour Code)

bank secrecy, a citizen's image and private life

failures: client base sale, training models on the full base, illicit lookups

demanding others' data: interest does not oblige anyone to hand it over

2026 shift: utility suppliers sought registration records from authorities citing legitimate interest, but on 28.05.2026 the Supreme Court corrected this line and dismissed the claim (A72-10657/2024)

• 1
• Screening

inapplicability zones and special bases before the test

• 2
• Interest and purpose

right citing a norm, or a significant purpose

• 3
• Necessity

minimum data, no less intrusive alternative

• 4
• Balance and measures

expectations, notice, sources, safeguards

• 5
• Recording and review

protocol, record, policy, reassessment on purpose change

Protocol per process

Eight fields in four blocks

process: subjects, data, operations, terms

date, owner, participants

admissibility, interest with norm, balance

decision, measures, outcome: applicable, with measures, or not

Assessment regulations

roles, procedure and terms, criteria and risk signs, protocol template, typical cases

High risk: minors, CBT, dissemination and over 100,000 subjects do not stop the assessment but require measures in the decision. Use one methodology and do not mix steps from different ones

Key points

Basis attaches to a purpose-operation pair

Consent is checked last

first law, contract and legitimate interest, consent remains for purposes with no other basis (RKN letter of 03.10.2025)

Consent stands apart since 01.09.2025

a separate document and action, and neither a signature nor a withdrawal clause cures content defects

Contract covers only what is necessary

for the party, beneficiary and surety, only while the contract lasts, then storage rests on law and interest

Legitimate interest is recorded in minutes

all three criteria together, calculator screening of exclusion zones, written assessment per process