The personal-data operator registry
The operator registry is Roskomnadzor's public database: everyone who files a processing notification gets an entry with a registration number. Search is open — by tax ID (ИНН) or name. Absence from the registry while running a live site with forms means the notification was never filed — and anyone can see it: a customer, a competitor, an inspector. Check not only yourself but also the vendors you entrust customer data to.
Free online tool — compliance checker: instant results, no signup.
A one-minute check
- Open Roskomnadzor's personal-data portal (the operator registry section)
- Search by tax ID — the reliable key; names produce duplicates and typos
- Review the entry: name, declared purposes, registration date
The entry shows declared purposes — worth reconciling with what the site actually does: mailings under a declared purpose of "responding to requests" is a discrepancy that surfaces in an inspection.
Not in the registry — what it means
Either the notification was never filed, or it is recent and still in review. The first case is direct risk: failure to file is punishable by itself and invites questions about everything else — the policy, consents, localisation. Filing is free and takes an evening — see the notification guide.
Check your vendors
Your CRM, call centre, delivery service and mailing agency process your customers' data on your instruction. A vendor with no registry entry and no processing contract is your risk zone: the operator — you — answers to the subject. Quick hygiene: vendor listed in the registry + a data-processing clause in the contract + a mention in your policy. The site's technical layer — forms, documents, where data flows — is checked by the compliance scanner.
Related
Why teams trust us
How it works
Enter your site URL
The scanner opens pages in a browser
Get a grade and a fix list
Why check your site for privacy compliance?
Regulators fine sites for processing personal data without consent — and a site starts processing earlier than it seems: analytics, pixels and widgets write cookies the moment the page loads. The scanner shows the auditor's view: what leaves for third parties before consent, whether the banner works, and whether forms collect data correctly.
Real Browser
Three sessions per page: no action, banner accepted, banner rejected.
Trackers and Jurisdiction
Service catalogue: who receives visitor data and in which country.
Policy at Collection Point
The policy link and consent element are checked next to the form, not in the footer.
Signed PDF
Report with an HMAC integrity stamp — hand it to your lawyer or contractor.
Who uses this
Business
preparing for an audit
Lawyers
technical facts for an opinion
Web Studios
client site handover
DevOps
consent regression monitoring
Common Mistakes
Best Practices
Monitor compliance automatically
Scheduled re-checks with an alert when pre-consent trackers appear on your site.
Sign up freeLearn more
Frequently Asked Questions
Is a registry entry Roskomnadzor's "approval"?
No, the registry is notification-based: the entry confirms a filing, not that the processing complies with the law.
The entry is outdated — is that a violation?
Details must be kept current: changes are reported with a follow-up notification. A mismatch between the entry and reality is a finding in an inspection.
Can we be removed from the registry?
Yes, by filing a processing-termination notification. While you actually process data you cannot delist — the entry must reflect reality.
Try the live tool that powered this guide
Free plan — 10 monitors, checks every 5 min, no card required. Upgrade for 1-minute interval and multi-region monitoring.