Personal Data Law Compliance Check

Personal Data Law Compliance Check - findings with the legal norm, evidence and fine range

The add-on checks a store from the inside against Russian personal data law 152-FZ and related laws: theme and add-on code, the database and settings, storefront pages and what actually fires in the browser. Every finding names the legal norm, the object, the evidence it can be verified by, and the offence under the Code of Administrative Offences with its fine range. The add-on only reads: it does not change store settings, templates or content.

The problem

Since 1 July 2025 Russian law prohibits collecting personal data straight into a foreign system, and Roskomnadzor, the Russian data protection regulator, checks websites automatically: it parses HTML and scripts, external connections and forms, and finds out where the hosting is. Cross-border transfer is not only Google Analytics: fonts, captcha, maps and video, foreign CDNs, chats and forms, and domain mail hosted abroad count too. Since 1 March 2026 state language law 168-FZ adds Latin text and borrowed words on buttons and in category and product names.

A CS-Cart store collects such connections over the years - through add-ons, HTML blocks, template edits and a tag manager that loads counters on the fly. The add-on gathers them into one report and shows where each of them lives.

Scan inventory: everything the store loads from outside - kind, data processor, country of processing, purpose and the number of places it is seen.

What you get after installing

• •  The Website - Compliance audit section. "Run scan" starts a full scan, "Quick scan (no storefront walk)" checks only the code and the database. A scan runs in portions with a progress bar, so no cron job is needed for it.
• •  The scan report: a summary - critical, major, minor, new and gone since the previous scan - and a table of findings with the rule, the legal norm, the offence, the object and the state.
• •  The Administrative risk block with a fine range by offences and caveats.
• •  The finding card: what is wrong, what it carries, the object, the evidence, what to do, and "Accept the risk" with a reason.
• •  The inventory of external connections with country and purpose of processing, and the processing register - a draft for the policy and the notice to Roskomnadzor.
• •  Exports: the report as one file (HTML), findings as a table (CSV), the processing register (CSV).
• •  The storefront probe, allowed words for the language section, accepted risks and a watchdog that emails about new findings.

The list of scans: "Run scan" and a quick scan without a storefront walk; every run shows its mode, status and the number of critical, major and minor findings, new and gone.

The scan report: a summary by severity, new and gone findings, and a table - rule number with the section letter, legal norm, offence, object marked "Observed on the storefront" or "In code only", and state.

Nine sections of the check

• •  A. Cross-border transfer and third-party services (152-FZ, art. 12 and 18): Google Tag Manager and Google Analytics, Google Ads, Meta Pixel, foreign advertising pixels, session recording, fonts, maps, captcha and video, foreign CDNs, forms, chats, CRM and mailing services, payment gateways, a storefront behind a foreign node, services in email templates, domain mail, and the site, database or outgoing mail server outside Russia.
• •  B. Consents and forms (152-FZ, art. 9; advertising law 38-FZ, art. 18): a form without a consent checkbox, a checkbox ticked in advance, one checkbox for both data and advertising, no link to the policy, a subscription not confirmed by email, switches of the built-in consent add-on turned off, an empty agreement log, no way to withdraw consent or delete the account, a form that sends data to an external domain.
• •  C. Cookies and browser storage: a counter fired before consent, no consent window or one that only informs, long-lived cookies, identifiers in browser storage, browser fingerprinting, loaded services not named in the policy.
• •  D. Documents and disclosure: no policy or nothing links to it, template placeholders, an empty consent text, the operator not named, a tax number in the policy that differs from the settings, nothing about cookies, demo store requisites, "by using the site you agree".
• •  E. Protection measures (152-FZ, art. 19): a secure connection that is not enforced, no HSTS and missing flags on the session cookie, files left open to the public, unsupported PHP and CS-Cart versions, the admin panel at its default address, login logging turned off.
• •  F. Retention periods and amount: data older than the declared period, orders of deleted profiles, excessive required fields, card numbers in order comments, old exports on disk.
• •  G. Transfer to third parties: active add-ons that send data out, and exports available without authorisation.
• •  H. Advertising: external banners without the erid marking identifier and links to banned platforms.
• •  I. State language (168-FZ): untranslated interface strings on the storefront, names of categories, pages, shipping and payment methods, statuses and blocks, products without a single Russian word, foreign text in blocks, foreign words written in Cyrillic letters.

Administrative risk: a range by offences

48 of the 59 rules name an offence under the Code of Administrative Offences - the article and the part. The report reduces findings to distinct offences and shows a fine range from the lower to the upper limit: one offence brings one penalty, however many lines of the report point at it.

• •  Amounts from the text of the Code as in force since 30 May 2025. For a legal entity, for example: art. 13.11 part 1 - RUB 150,000-300,000, art. 13.11 part 3 - RUB 30,000-60,000, art. 14.3 part 16 - RUB 200,000-500,000, art. 14.8 part 1 - RUB 5,000-10,000.
• •  Legal entity or sole trader. The "Operator is" setting changes the ranges. As a rule a sole trader answers as an official - RUB 50,000-100,000 under art. 13.11 part 1 - and under parts 1.1 and 8-18 of art. 13.11 as a legal entity.
• •  Arguable classification is marked with the words "classification is arguable". For cross-border transfer, for example, there is no settled practice.
• •  Caveats in the block itself: the range is built by offences, not by adding up; under art. 4.1.1 a fine for a first offence found during state control is replaced with a warning where the circumstances of art. 3.4 part 2 are present; findings of the Protection measures section are left out of the estimate.
• •  Accepted risks are left out of the estimate: the decision is deliberate and recorded.

The Administrative risk block: the fine range, offences with the number of findings and the "classification is arguable" mark, caveats and the list of what the check does not measure.

The finding card and accepted risks

• •  What is wrong and what to do - a text of its own for each of the 59 rules.
• •  Evidence: a page address, a file path, a database record or a code fragment. Personal data in evidence is masked: emails, phones, card numbers, keys and tokens.
• •  Data processor, country and purpose for a detected service, and the store add-on that installs it, with a link to its settings.
• •  "Observed on the storefront" or "In code only": a mention in code and a call from the browser are different things, and the report tells them apart.
• •  "Accept the risk" with a reason. The decision is stored by the finding fingerprint and survives every later scan; the finding stays in the report marked "Risk accepted". A risk cannot be accepted without a reason.
• •  Comparison with the previous scan: the "New" or "Was before" state and the number of gone findings.

The finding card: the legal norm, "What it carries" under the Code of Administrative Offences, the object, the evidence, "What to do" and the "Accept the risk" form with a reason.

Service inventory and processing register

The inventory gathers everything the store loads from outside - violation or not - with the vendor, country and purpose of processing. The signature base of the add-on knows 57 services, Russian ones included: those are not reported as cross-border transfer.

• •  The processing register: the operator, tax number, address and phone, then the data recipients - kind, object, data processor, country, purpose and where seen. Countries other than RU are highlighted.
• •  Register export to CSV that opens in Excel.
• •  Hosting country of the site, the database, the outgoing mail server and domain mail. When the provider cannot be recognised, the report says so instead of passing a guess off as a fact.
• •  Tax number check: the number from the add-on settings is compared with the one in the policy.

The processing register: operator details and data recipients - vendor, country, purpose and where seen; countries other than RU are highlighted.

The storefront probe

A tag manager loads counters on the fly, so neither the code nor the returned page shows what actually ran. The probe answers that from a real browser.

The storefront probe: the private window hint, the probe session state and the last session - pages walked, observations and how many fired before consent.

State language and allowed words

Section I checks what the buyer sees: interface strings are searched for in the page the storefront returned, and administrative strings are left out.

• •  Latin text in interface strings, names of categories, pages, shipping and payment methods, order statuses, block titles and content, and product names without a single Russian word. A product name that pairs a brand with a Russian word is not a finding.
• •  Foreign words written in Cyrillic letters: a dictionary of 91 words with replacements. The finding is one per store: words, replacements, how many times and where they occur.
• •  Allowed words: a shipped list of brands, payment marks, units and technical designations, plus your own list for the storefront - in Latin or Cyrillic letters, with a reason.

Allowed words: your words with a reason and a date, the add form and the shipped list that comes with the add-on.

Watchdog and scheduled scans

• •  An address for the scheduler with a schedule key: a full scan once a day. Treat the key as a password; "Issue a new schedule key" makes the old address stop working.
• •  Email only about something new: findings that appeared since the previous scan, starting from the chosen severity. Nothing new - no email.
• •  What was changed in the store: add-on status, storefront block, setting - with the administrator name and date. The list is shown on the scans screen and comes in the email.
• •  Scans by storefront: runs, probe sessions and allowed words are kept for the selected storefront.

What the add-on does not do

• •  It does not give a legal opinion. The add-on shows technical facts and compares them with the wording of the law; whether a finding is a violation in your circumstances is for a lawyer to decide. The exported report carries the same caveat.
• •  It fixes nothing itself: it does not change settings, templates, blocks or content and does not disable add-ons. Every finding says what to do. A consent window and counters held back until the visitor chooses are set up with the built-in CS-Cart notice or the Cart-Power Cookie Consent add-on - the two add-ons are sold as a pair.
• •  It does not detect leaks: the offences of art. 13.11 parts 12-15 cannot be seen from the website and are not part of the estimate.
• •  It does not decide where the law requires written consent and does not query the Roskomnadzor register of operators: the tax number from the settings is compared with the policy, and a person checks the register by that number.
• •  It does not file notices with Roskomnadzor and does not write the policy: the processing register is a draft for a lawyer.
• •  It does not see forms loaded by a request into a popup window - the walk parses the pages the storefront returns.

Running costs

A full scan walks your own storefront and creates load like an ordinary visitor. The walk plan is fixed: home page, catalog, cart, login, registration, password recovery, search, one category, one product and up to 60 content pages - in the main language by default. The limit is 150 pages per scan, the pause between requests 200 ms and the timeout 15 seconds; all of them are set in the settings. A zero pause gives the fastest and heaviest scan. A quick scan does not walk the storefront at all.

Scan data lives in the add-on's own tables: raw facts for the last three scans, evidence for 90 days, probe observations for 14 days; the periods are set in the settings. On a CS-Cart Multi-Vendor 4.20.1 test stand a full scan took less than a minute. The watchdog needs a scheduler that opens the schedule address once a day.

A license costs 99 USD for one store. The add-on requires the "Cart-Power: Add-ons Manager" add-on.

Frequently asked questions