Question 1

How much does a 152-FZ personal data audit cost?

Accepted Answer

The express site audit is a fixed price and takes three business days. A full company audit depends on the number of systems, processes and legal entities. We quote within one day after the call, no hourly billing.

Question 2

Do we have to notify Roskomnadzor, and who does?

Accepted Answer

Almost everyone. Since September 2022 any personal data operator files a notification: a company, a sole proprietor, even a self-employed person with a website form, a CRM or a customer base. Exceptions are narrow. The audit checks whether you are in the registry and prepares the notification or the amendments.

Question 3

What are the fines under 152-FZ in 2026?

Accepted Answer

Failing to notify Roskomnadzor costs a company up to 300 thousand rubles. A first data leak is fined 3 to 15 million rubles depending on how many people are affected. A repeated leak, since 30 May 2025, triggers turnover fines of 1 to 3% of revenue with a 20 million minimum. Separate fines apply to processing without consent, cookies and trackers without notice, and cross-border transfers without a legal basis.

Question 4

How does a Roskomnadzor inspection work and what is checked?

Accepted Answer

Most inspections are remote: the regulator reviews the website without a visit. They check the privacy policy, consents in forms, the cookie banner, trackers, cross-border transfers and the registry entry. On-site inspections add documents, orders, logs, processor agreements and technical measures under FSTEC order 21. We prepare you against the same checklist the regulator uses.

Question 5

What does the Roskomnadzor bot find on a website?

Accepted Answer

The automated check looks for forms collecting a name, phone or email without a consent checkbox, a missing privacy policy, cookies and analytics without notice, data sent to foreign services, and mismatches between the site and the operator registry. All of this is covered by the three-day express audit.

Question 6

Can we keep Yandex Metrica and Google Analytics?

Accepted Answer

Yandex Metrica is fine with a cookie notice and a policy that states the purposes. Google Analytics sends data abroad, which needs a separate legal basis and a cross-border transfer notification; in practice it is easier to drop it. The audit reviews every tracker and external script.

Question 7

Do you need a FSTEC licence for the audit?

Accepted Answer

Not for 152-FZ audits and security assessments in the private sector. A licence is required for formal certification of personal data systems, and for that we bring in a licensed partner.

Question 8

Do you fix what you find?

Accepted Answer

Yes. After the audit we quote, and the same team closes the gaps at a fixed price: documents, site forms, cookie banner, regulator notification, system and access settings.

Question 9

How much of our time does it take?

Accepted Answer

One 30-minute call, access to the site and systems, two or three short interviews with owners. We do the rest.

Personal data audit under 152-FZ

Who needs it

E-commerce and online services

Healthcare, education, HR

B2B and SaaS

Companies facing an inspection

More than documents

Documents and consents

Contracts

Site and apps

Systems and access

What you get

How the audit works

Call

Data collection

Audit

Plan and estimate

Formats and pricing

Express

Company

Group

FAQ

Let's talk