Audit and Upgrade of Mobile App for 152-FZ (Personal Data) Compliance
Your app's servers are in Europe, but your users are in Russia? Roskomnadzor is actively fining for violations of 152-FZ — amounts reach millions of rubles. We are a team with 5+ years of experience in mobile app security and 30+ completed compliance projects. We help bring your app into compliance within 3–5 weeks, with a guarantee of passing inspection.
One of our clients — a fintech startup — received a Roskomnadzor order after a user complaint. We conducted a gap analysis, migrated data to Yandex Cloud in two weeks, implemented consent and subject rights screens. A fine was avoided.
What technical requirements does 152-FZ have for mobile apps?
The law requires that the primary processing of personal data of Russian citizens take place on servers physically located in Russia. This includes recording, storage, systematization, accumulation, clarification, extraction. Cross-border transfer after primary processing is allowed only to countries with an adequate level of protection or under special grounds (Article 12 of 152-FZ).
How to ensure data localization in Russia?
The most reliable way is to place servers in a Russian data center. Use Yandex Cloud, VK Cloud, or Sber Cloud — they are certified for 152-FZ. An alternative is data routing: during registration, check phone_number (7xx) or geolocation and route the request to the Russian instance. Important: data should not temporarily reside on foreign servers even during routing.
| Approach | Compliance with 152-FZ | Complexity | Risks |
|---|---|---|---|
| Firebase (europe-west) | No | Low | Fine during inspection |
| AWS (eu-central-1) | No | Medium | Requires justification |
| Yandex Cloud (ru-central) | Yes | Medium | None |
| Own data center (Tier III+) | Yes | High | High cost |
Subject consent and special categories
152-FZ requires explicit written consent for processing personal data. In a mobile app, the "written form" is electronic consent with the ability to revoke. Technical requirements:
- Specific list of processed personal data (not "and other data")
- Purpose of processing for each category
- Retention period
- List of third parties to whom data is transferred
- Method to revoke consent
Common mistake: one large blanket consent. Roskomnadzor considers that consent must be specific. For advanced analytics and advertising — separate consent, separate button.
data class ConsentItem( val purposeCode: String, // "analytics", "marketing", "profiling" val purposeDescription: String, val dataCategories: List<String>, val retentionDays: Int, val thirdParties: List<String> ) Consent is stored with a timestamp and document version. When conditions change — re-request consent.
Special categories of personal data (medical, biometrics, religion, etc.) require separate explicit consent. For biometrics (Face ID, fingerprints) it is important: data is processed locally via LAContext.evaluatePolicy() (iOS) or BiometricManager (Android) — templates are stored in Secure Enclave/StrongBox and never leave the device. This must be stated in the Privacy Policy.
Third-party SDKs and data transfer
Each analytics or advertising SDK is a third party — "person processing personal data on behalf of the operator" (Article 6, paragraph 3). A processing agreement is required with each such partner, containing:
- Purposes of processing
- Obligation to store personal data in Russia (if the SDK transfers data abroad — separate basis)
- Obligation to maintain confidentiality
AppMetrica from Yandex stores data in Russia — suitable. Amplitude, Mixpanel — data in the US, requires either separate consent for cross-border transfer or an EU instance with additional justification.
Subject rights and technical protection measures
The subject has the right to:
- Receive information about processed data — "My Data" screen with response within 30 days
- Correct or delete data — request form + SLA 7 business days for response
- Revoke consent — immediately, without explanation
In the app: a "Personal Data" section in profile settings with buttons "Request Data", "Correct Data", "Delete Account".
Technical measures (according to FSTEC Order No. 21): encryption at rest (AES-256) and in transit (TLS 1.2+), access control (RBAC at the API level), access logging, regular backups with restoration testing, incident response procedure (leak → notify Roskomnadzor within 24 hours). In the mobile app, use EncryptedSharedPreferences (Android) and kSecAttrAccessibleWhenUnlockedThisDeviceOnly in Keychain (iOS).
What is included in the work
- Audit of current architecture and gap analysis (2–3 days)
- Design of data routing and migration to Russian data center (3–7 days)
- Implementation of consent UI and consent management (3–4 days)
- Subject rights screens + backend workflow (3–5 days)
- Encryption and logging setup (2–3 days)
- Document preparation: processing policy, Roskomnadzor notification, SDK agreements (2–3 days)
- Testing and handover to client (1 day)
Timeline: from 2 days for an audit to 5 weeks for full compliance. Cost is calculated individually after analysis of the current architecture. Contact us for a preliminary assessment — it will take no more than an hour.