In 2025, given the new requirements of the law and regulators such as Roskomnadzor, a privacy policy on a website is an essential part of complying with security rules and protecting user data. In this article we look at who needs a privacy policy, what fines are imposed for not having one, how to write such a document properly and what to consider when building a website.
Why do you need a privacy policy?
A privacy policy is a legal document that tells users how their personal data is collected, processed and stored on a website. It protects both the interests of users and the website owners themselves from possible legal consequences. A privacy policy is mandatory for websites that process users’ personal data. In 2025 it is important to take into account the new legal requirements aimed at better data protection and transparency in how information is processed.
The main purpose of a privacy policy is to comply with Federal Law No. 152-FZ “On Personal Data” and to increase users’ trust in your website. It is also needed to protect against possible sanctions and fines that may be imposed on a website without such a document.
Who must have a privacy policy?
A privacy policy must be published on a website if it collects, processes or stores users’ personal data. This applies to:
- Online stores: If your website collects customer data (for example, first name, surname, delivery address, email), a privacy policy is mandatory.
- Landing pages: Pages that offer a product or service and collect information through sign-up or subscription forms must also have a privacy policy.
- Corporate websites: Even though such websites may not be aimed at selling goods and services directly, they also often collect personal data of employees, counterparties and clients.
- Websites that use cookies and trackers: If a website uses cookies or collects data on user actions (for example, through analytics or advertising technologies), publishing a privacy policy is mandatory.
Where should the privacy policy be placed?
The privacy policy must be available to the user at any time. It is usually placed at the bottom of every page of the website, where there are links to the main documents such as “Terms of use” or “Contacts”. It can also be included in an “About the company” or “Privacy policy” section highlighted in the main menu.
It is important that the privacy policy is visible and accessible. Users should not have to search for it for a long time. Good practice is to link to the privacy policy from every page of the website.
Fines for not having a privacy policy
Under Federal Law No. 152-FZ “On Personal Data”, organisations that do not comply with the requirements for processing personal data face fines. The main points:
- Fines for organisations: If a company has no privacy policy or violates its provisions, the fine may be from 30,000 to 100,000 roubles.
- Fines for officials: Fines for individuals responsible for processing personal data can reach 10,000 roubles.
- Fines for individual entrepreneurs: Fines can be up to 30,000 roubles for violating the rules of personal data processing.
In addition, Roskomnadzor may block a website for failing to meet the requirements of personal data legislation. So the importance of complying with these rules can hardly be overstated.
What should a privacy policy include for online stores, landing pages and corporate websites?
Every website should adapt its privacy policy to its specifics. Here are the main points the document should cover:
- Types of data collected: State what data is collected on the website (for example, first name, surname, email address, IP address, purchase data, etc.).
- Purposes of data processing: Explain why this data is collected. For example, to process orders, deliver goods, send newsletters, etc.
- Users’ rights: It is important to state users’ rights regarding their data, including the right to access, correct and delete information.
- Data retention periods: State how long the information will be stored. For online stores this may depend on the type of transaction and the law.
- Transfer of data to third parties: Explain when data may be passed to third parties, for example, courier services or payment systems.
- Data security: State what security measures are taken to protect data from leaks and unauthorised access.
- Contact details: Provide contact details for questions about personal data processing.
How to write a privacy policy properly?
Creating a privacy policy requires a careful approach and compliance with the law. Here is an approximate outline of the document:
- Introduction — A description of the company and its activities.
- Data collection — A list of the types of data collected on the website.
- Purposes of data processing — What the collected data is used for.
- Users’ rights — What users can do with their data.
- Transfer of data to third parties — Conditions and reasons for transfer.
- Data protection — Measures to protect personal data.
- Data retention periods — How long the data will be stored.
- Contacts — How to contact the website administration about privacy questions.
Which websites can do without a privacy policy?
Some websites can do without a privacy policy if they do not collect users’ personal data. For example:
- Websites with informational content that require no registration or data collection (for example, news websites).
- Landing pages without data collection, if they have no forms for entering personal information.
- Blogs or business card websites that collect no information about visitors.
However, it is important to remember that if a website uses cookies, advertising services or analytics (for example, Google Analytics), a privacy policy is still required.
Can the requirements be avoided?
Some website owners may try to get around the requirements, but this is fraught with legal consequences. For example, not collecting any data or not using cookies may remove the need to publish a privacy policy. However, such methods are not recommended, as they violate the law and can lead to fines.
Conclusion
A website privacy policy in 2025 is not just a formality, but a necessity aimed at protecting user data and complying with the law. It helps you earn customers’ trust, avoid fines and protect your business. It is important to keep the information in the policy up to date and update it regularly in line with new requirements.
If you are not sure whether your website meets the requirements of personal data legislation, I can help. I will audit the website for compliance with the current Roskomnadzor requirements and identify shortcomings and risks. I will also write a correct and legally sound privacy policy and set up data collection forms with all the mandatory points.
Contact me on Telegram — let’s discuss the details and find the best solution for your website — Message me on Telegram
