Preparation sheet for an initial notification to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Роскомнадзор) under Article 22 of Federal Law No. 152-FZ (ФЗ). The information must be transferred to the prescribed form; this sheet does not confirm filing.
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
Required fields not filled: 22. The PDF will have blank lines in their place to fill in by hand.
Click a field label in the text and type, or use the form. Empty fields become blank lines in the PDF.
Preparation date: . This is a working sheet for an initial notification, not an official form or confirmation of entry in the register. Controller: ; short name: . Taxpayer identification number (ИНН): . Primary state registration number for a legal entity / individual entrepreneur (ОГРН / ОГРНИП): . Address: . The notification shall be filed before processing begins, except for the exemptions in part 2 of Article 22 of Federal Law No. 152-FZ (ФЗ). The actual processing start date must not be replaced with a future date to conceal late filing.
Purpose: . Data categories: . Data subject categories: . Legal grounds: . List of actions: . The method for the first purpose is mixed processing (automated and non-automated). Processing specifics, network use and transmission through communication channels: .
Description of measures actually implemented: .
| Review area | Measure actually implemented / document | Responsible person | Evidence / comment |
| ____ | ____ | ____ | ____ |
| ____ | ____ | ____ | ____ |
| ____ | ____ | ____ | ____ |
Check appointment of a responsible person (for a legal entity), policy and internal documents, access restrictions, employee training, internal control, harm assessment, technical protection, activity logging, backups and incident response. Include only measures actually implemented, taking the processing method into account. A general statement that “all measures have been taken” does not replace a description. No cryptographic tools are used. This information must be checked against the actual infrastructure. Person responsible for organizing processing: . Responsible person’s contact details: . Processing start date: . Period or termination condition: . Locations of databases containing Russian citizens’ personal data: .
| System / database | Country | Hosting address | Owner / processor | Supporting document |
| ____ | ____ | ____ | ____ | ____ |
| ____ | ____ | ____ | ____ | ____ |
| ____ | ____ | ____ | ____ | ____ |
Include the information systems used, external storage and backup databases to the applicable extent. Do not substitute an office address for a server location without checking. Localization and cross-border transfer shall be assessed separately; having a database in Russia does not in itself establish that no data are transferred abroad. No cross-border transfers are made. The processes described do not involve access to or contracted processing of data in state and municipal information systems.
Assign to check the information by and transfer it to the form in Appendix No. 1 to Roskomnadzor Order No. 180 dated 28.10.2022. Prepare and sign the electronic notification through Roskomnadzor’s official service using its prescribed method; retain confirmation of dispatch/receipt. Notify changes to information no later than the 15th day of the month following the month of the changes; notify termination of processing within ten working days of termination (part 7 of Article 22 of Federal Law No. 152-FZ).
The preparer shall reconcile the sheet with the actual processing register, processor agreements, system settings and internal documents. For each purpose, check that the basis, data items, data subject categories, operations and methods are specific, and exclude information unrelated to the controller’s activities. Check the current name and address, registration details, the responsible person’s full name or entity name and all necessary contact details — telephone number, postal address and email. The signatory shall substantiate authority; cryptographic tool information shall be confirmed with the technical person responsible, rather than inferred solely from the existence of a website. Notification does not replace a lawful processing basis, consent, localization or protection measures. The separate cross-border transfer notification shall be checked independently; filing the initial notification does not replace that procedure.
| Action | Date / deadline | Responsible person | Number / confirmation | Comments |
| ____ | ____ | ____ | ____ | ____ |
| ____ | ____ | ____ | ____ | ____ |
| ____ | ____ | ____ | ____ | ____ |
Retain the signed version and submission confirmation, then check the register information and any requests for clarification. Submission shall not be described as completed registration until this has been verified. Changes to previously filed information and termination of processing shall use the corresponding forms, rather than a repeat initial notification. Preparatory information checked by: ______________ / /. Basis of authority: .
This is a draft template. Before use, have a lawyer review the text and adapt it to your specific circumstances. This document is not legal advice.
Documents that are usually drawn up in the same process.
The controller's public policy covering purposes, legal grounds, data categories, retention periods and data subjects' rights. Website use, analytics, processors and cross-border transfers are includ…
Appoints the person responsible for organizing personal data processing by a legal entity; provides for voluntary allocation of functions for an individual entrepreneur.
Internal procedures for collecting, using, transferring, retaining and destroying data concerning customers and counterparties’ representatives. Defines employee actions and request handling.
Internal organizational document of the controller governing access, media, technical protection and incident response. Supplements the public policy and processing regulation.
8 of 30 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.