Working with subscribers' personal data: legal risks for the brand
Where problems usually begin
A classic scenario: a marketer launches a contest on Instagram or VKontakte, asking subscribers to write their name, phone number, and city in the comments for a prize draw. A month later, the data leaks from a spreadsheet that was kept in shared access, or it is accidentally published in an open chat. The brand has formally already violated the law — not because the data was stolen, but because it was collected without proper consent and without understanding where and how it will be stored.
A similar story involves chat bots and feedback forms. The bot collects a phone number to send a promo code, the data flies into CRM, then into a mailing service. Consent must be obtained at each stage of transfer, but in practice, it is often simply missing.
What the law considers personal data
Personal data is any information that allows a specific individual to be determined directly or indirectly: full name, phone number, email, geolocation, IP address, and sometimes even a nickname in a social network, if it is easy to establish identity from it. Processing is considered almost any action with this data: collection, storage, transfer, deletion, use in mailing.
The key myth is that because the data is "public" (the person wrote it in a comment), anything can be done with it. This is not true: the public nature of the data does not cancel the operator's obligation to obtain consent for its further processing, if the brand intends to use it beyond the scope of the conversation itself.
What actions require consent, and which ones do not
- Collecting contacts for a contest draw — requires separate consent with indication of the purpose and storage period
- Email newsletters and promotions — require consent, the withdrawal of which should be as simple as the subscription
- Data transfer to a third-party service (CRM, email platform, bot) — requires separate consent for sharing with third parties
- Answering a question in comments or direct messages within the same conversation — does not require separate consent, as it is part of regular communication
- Retention of data beyond the stated period — is a separate violation, even if consent was obtained correctly
How to properly arrange data handling
- Define the purpose of data collection in advance — for a specific campaign, not "for the future"
- Draft the consent text: what data is collected, for what purpose, to whom it is transferred, and for how long it is stored
- Place consent where the subscriber will actually see it before data is sent — not in the site footer, but next to the form
- Submit notification to Roskomnadzor about the start of personal data processing, if the brand was not previously registered in the operators' registry
- Limit access to collected data within the team — do not store winners' phone numbers in a shared Google document with "link access"
- Delete data after the stated period or upon the first request by the subscriber to withdraw consent
Common mistakes and their consequences
Most brands violate the law not out of malice, but out of haste: a contest needs to be launched "tomorrow," while legal review of forms is a slow process. As a result, typical situations arise that Roskomnadzor and courts regularly fine.
| Violation | Consequence |
|---|---|
| Data collection without formal consent | Fine under Article 13.11 of the RF Code of Administrative Offenses for legal entities |
| Lack of notification to Roskomnadzor regarding data processing | Fine, directive to eliminate the violation |
| Data transfer to a subcontractor without separate consent | Liability of both the operator and the subcontractor |
| Data storage for longer than the stated period | Separate fine even with consent |
| Data leak due to careless storage | Fine, reputational damage, lawsuits from subscribers |
What to do if data has already been collected with violations
If a brand discovers that it has been maintaining a subscriber database for several years without proper consent — there is no need to panic, but ignoring the issue is definitely not an option. A reasonable course of action: conduct an audit of all data collection points (forms, bots, contests, CRM), document the purposes of data processing, formalize missing consents post facto where possible, and delete data that cannot be legalized. At the same time, it is advisable to review contracts with all contractors who have access to the database — from email services to agencies that manage newsletters. It is precisely at the intersection of 'the brand handed over data, but the contractor did not protect it' that data leaks most often occur, for which the brand owner is ultimately responsible, not the contractor.
Where problems usually begin
A classic scenario: a marketer launches a contest on Instagram or VKontakte, asking subscribers to write their name, phone number, and city in the comments for a prize draw. A month later, the data leaks from a spreadsheet that was kept in shared access, or it is accidentally published in an open chat. The brand has formally already violated the law — not because the data was stolen, but because it was collected without proper consent and without understanding where and how it will be stored.
A similar story involves chat bots and feedback forms. The bot collects a phone number to send a promo code, the data flies into CRM, then into a mailing service. Consent must be obtained at each stage of transfer, but in practice, it is often simply missing.
What the law considers personal data
Personal data is any information that allows a specific individual to be determined directly or indirectly: full name, phone number, email, geolocation, IP address, and sometimes even a nickname in a social network, if it is easy to establish identity from it. Processing is considered almost any action with this data: collection, storage, transfer, deletion, use in mailing.
The key myth is that because the data is "public" (the person wrote it in a comment), anything can be done with it. This is not true: the public nature of the data does not cancel the operator's obligation to obtain consent for its further processing, if the brand intends to use it beyond the scope of the conversation itself.
What actions require consent, and which ones do not
- Collecting contacts for a contest draw — requires separate consent with indication of the purpose and storage period
- Email newsletters and promotions — require consent, the withdrawal of which should be as simple as the subscription
- Data transfer to a third-party service (CRM, email platform, bot) — requires separate consent for sharing with third parties
- Answering a question in comments or direct messages within the same conversation — does not require separate consent, as it is part of regular communication
- Retention of data beyond the stated period — is a separate violation, even if consent was obtained correctly
How to properly arrange data handling
- Define the purpose of data collection in advance — for a specific campaign, not "for the future"
- Draft the consent text: what data is collected, for what purpose, to whom it is transferred, and for how long it is stored
- Place consent where the subscriber will actually see it before data is sent — not in the site footer, but next to the form
- Submit notification to Roskomnadzor about the start of personal data processing, if the brand was not previously registered in the operators' registry
- Limit access to collected data within the team — do not store winners' phone numbers in a shared Google document with "link access"
- Delete data after the stated period or upon the first request by the subscriber to withdraw consent
Common mistakes and their consequences
Most brands violate the law not out of malice, but out of haste: a contest needs to be launched "tomorrow," while legal review of forms is a slow process. As a result, typical situations arise that Roskomnadzor and courts regularly fine.
| Violation | Consequence |
|---|---|
| Data collection without formal consent | Fine under Article 13.11 of the RF Code of Administrative Offenses for legal entities |
| Lack of notification to Roskomnadzor regarding data processing | Fine, directive to eliminate the violation |
| Data transfer to a subcontractor without separate consent | Liability of both the operator and the subcontractor |
| Data storage for longer than the stated period | Separate fine even with consent |
| Data leak due to careless storage | Fine, reputational damage, lawsuits from subscribers |
What to do if data has already been collected with violations
If a brand discovers that it has been maintaining a subscriber database for several years without proper consent — there is no need to panic, but ignoring the issue is definitely not an option. A reasonable course of action: conduct an audit of all data collection points (forms, bots, contests, CRM), document the purposes of data processing, formalize missing consents post facto where possible, and delete data that cannot be legalized. At the same time, it is advisable to review contracts with all contractors who have access to the database — from email services to agencies that manage newsletters. It is precisely at the intersection of 'the brand handed over data, but the contractor did not protect it' that data leaks most often occur, for which the brand owner is ultimately responsible, not the contractor.
Recent articles
MegaFon, BMW, VTB and more 240+ companies. See how it looks in the showcase reel:
Our branding agency is approached to order:
Branding agency services
