Russia's Pre-Processing Notification: Exceptions You Can't Afford to Ignore

What Is the Pre-Processing Notification Under 152-FZ?

Under Article 22 of Russia's Federal Law No. 152-FZ on Personal Data, operators must notify Roskomnadzor before processing personal data. Think of it as telling the data protection authority what you're about to do—like informing your neighbor before throwing a party. But there are exceptions that can save you from this bureaucratic step.

Featured Snippet: When Is Notification Not Required?

Notification is not required if the data is processed solely for labor relations, statistical purposes, or by religious/public organizations, among other exceptions. Check the full list in Article 22(2) of 152-FZ.

Key Exceptions to the Notification Requirement

Article 22(2) lists several scenarios where you can skip the notification. For example, if you process data only for employment contracts, you're exempt. Also exempt: processing by religious organizations, public associations, or for scientific/statistical purposes. Another big one: if the data is processed without using automation tools (i.e., manual filing).

But don't get too comfortable. Even if you're exempt, you still must comply with other 152-FZ obligations, like obtaining consent and ensuring data security. It's like getting a free pass on the entrance fee but still having to follow the park rules.

How to Notify Roskomnadzor Correctly

If you're not exempt, you must submit a notification via the Roskomnadzor portal or by mail. The notification must include: your company details, purpose of processing, categories of data subjects, legal basis, and measures to protect data. Missing any field can lead to rejection or fines.

Pro tip: Keep a copy of the notification with the Roskomnadzor acknowledgment. You'll need it to prove compliance during inspections.

Penalties for Non-Compliance

Failing to notify can result in fines up to 75,000 RUB for companies (Article 13.11 of the Russian Code of Administrative Offenses). Repeat violations can lead to higher fines or even suspension of activities. Not fun.

So, treat the notification like a vaccine—better to get it done than risk the consequences.

Practical Steps for Compliance

• Review your data processing activities to see if any exception applies.
• If not exempt, prepare and submit the notification before starting processing.
• Update the notification if your processing purposes change.
• Keep records of all notifications and acknowledgments.

For more details, check the official text of 152-FZ on Consultant.ru.

FAQ