Registering a website with Roskomnadzor: Why is it necessary and is it possible to avoid it?

If you’re launching a website in the Russian market, then this article is for you. Beyond hosting, domains, and other confusing terms, there’s a simple and familiar legal aspect to the matter. Let’s break it down.

There’s a Roskomnadzor registry, and in some cases, your resource must be listed. We’ll explore why this is necessary, how to register, and whether it’s possible to operate “the old-fashioned way”—without it.

What is this registry and why is it needed?

The Roskomnadzor registry is a state database that records resources and organizations that: process the personal data of Russian citizens, provide communications or hosting services, and own information systems. The registry’s main purpose is to ensure transparency. The state wants to understand who collects what data, where it’s stored, and whether legal requirements are being met.

This is part of the overall “digital sovereignty” program—to ensure that Russian websites and services operate independently of external risks and infrastructure.

When is registration mandatory?

Registration with Roskomnadzor is mandatory if at least one of the following conditions is met:

1. You process the personal data of Russian citizens (full names, phone numbers, email addresses, orders, personal accounts).
2. You are a hosting provider or server owner, providing platforms to third parties.
3. You are the owner of an information resource that mass-disseminates user data (e.g., an online platform, news portal, or marketplace).

If a website represents a company with feedback, registration, or online shopping forms, this is already processing personal data. Therefore, in accordance with Federal Law No. 152 and Government Resolution No. 687, you must notify Roskomnadzor and be included in the relevant register of operators.

What does registration provide?

Registration does not impose strict restrictions; on the contrary, it confirms that you operate within the legal framework.
After being included in the register:

• You officially become a personal data operator;
• You face fewer questions during inspections or when connecting payment systems;
• Your website is easier to protect from blocking and complaints because you have legal status and documents;
• You can legally work with Russian users, CRM systems, and government agencies.

How to submit a notification to Roskomnadzor – step-by-step instructions

The procedure is simple; here are the basic instructions:

1. Fill out a notification to begin processing personal data. This can be done online on the Roskomnadzor website.
2. The form specifies:
   – legal entity,
   – purposes of data processing,
   – user categories,
   – list of processed data (full name, email address, etc.),
   – database storage location (data center, city, country).
3. Submit the notification through your personal account or by mail.
4. Roskomnadzor will review your application within 30 days and add you to the register of personal data operators.
5. After this, you can post an updated privacy policy with your registration number on your website.

What if you don’t register your website?

Many people still think, “Why bother? We have a small website, just a feedback form.” But in practice, this is also processing personal data.

What happens if you don’t submit a notification:

• Roskomnadzor may conduct an inspection based on a complaint or as part of monitoring 🙁
• If a violation is detected, a fine will be imposed: from 30,000 to 150,000 rubles for legal entities (under Article 13.11 of the Code of Administrative Offenses of the Russian Federation).
• Repeated violations or refusal to comply with the regulator’s requirements may result in

resource blocking.

Essentially, registration is a formality that costs a little time once, but eliminates many risks.

Is it possible to operate without a registry?

Technically, yes, the site will work without it.
But legally, no, if you interact with the personal data of Russian citizens in any way.

Without registration, you remain in a “gray zone”: the site is functional, but upon the first inspection, it becomes a vulnerability.
If your resource doesn’t collect any data (for example, just a static landing page without forms or analytics), there is indeed no need to notify Roskomnadzor.

You have already added your site in the Roskomnadzor register?