Now personal data processing consent must be obtained separately

On 24 June 2025 the President of the Russian Federation signed a new federal law on the creation of a multi-purpose data exchange service and on amendments to certain legislative acts of the Russian Federation. Amid the lively debate surrounding the new opportunities that this service offers citizens, it is important to note the amendments introduced by the federal law to article 9, part 1 of Federal Law No. 152-FZ of 27 July 2006 On Personal Data (“Personal Data Law”).

The Personal Data Law now expressly states that consent to the processing of personal data (“consent”) must be executed separately from any other information and/or documents that the individual (the data subject) agrees to and/or signs.

Obtaining separate consent was even previously regarded as “best practice” in the field of privacy as such consent could be considered fully informed, deliberate and express, which is in line with the fundamental principles enshrined in article 9, part 1 of the Personal Data Law.

However, the absence of an express legal requirement allowed companies to make business decisions in a “grey area,” for example, by combining personal data processing consent with the acceptance of the terms and conditions of the service or by incorporating consent into the terms of a contract.

As Roskomnadzor classifies cookies as the personal data of website users, the new requirement now obliges website owners to display a cookie banner on their sites in order to obtain users’ separate explicit consent to the collection of cookies for gathering website metrics and analytics.

In general, the new legislative provisions are in line with the emerging trend among companies to shift their focus from obtaining consent across the board to other legal grounds for personal data processing (such as processing data under a contract or by virtue of the controller’s legitimate interests). Therefore, amendments to article 9 of the Personal Data Law should not significantly complicate business processes as the processing of personal data often takes place on the basis of a contract concluded with the data subject and does not require consent.

In the case of a breach of the requirement to obtain consent separately, companies may be subject to administrative liability under article 13.11, part 1 of the Administrative Offences Code of the Russian Federation, which provides for fines ranging from RUB50,000 to RUB100,000 for officials and from RUB150,000 to RUB300,000 for legal entities.

The amendments will take effect on 1 September 2025.