Personal Data and OpenCart Online Store in 2025

We are not lawyers, and this text is not an official legal opinion. Everything you read below is solely our opinion, based on personal experience and publicly available sources. We have tried to explain the essence as clearly and practically as possible, so that online store owners can better understand the topic of personal data. However, please do not treat this text as the ultimate truth – always verify the information, consult with legal professionals, and keep track of changes in legislation.

1. Personal data is not just strings in a database

Any information that can be used to uniquely identify a person (full name, phone number, email, address, etc.) is considered personal data (PD). Each organization, based on its goals and specifics, independently determines which data it will collect from employees and clients (current or former). These are the data considered PD in the context of that organization’s activities. Handling such data is governed by Law No. 152-FZ. And this is not just a formality: violations may lead to hefty fines, website blocks, or in severe cases, criminal liability.

2. Registration with Roskomnadzor

If you process PD, you are required to register as a personal data operator. You need to submit a notification to Roskomnadzor on their website, and optionally duplicate this notification via a paper letter through Russian Post.

3. Foreign services: be cautious with cross-border transfers

Using Google Analytics, reCAPTCHA, a foreign online chat, or Google login? This already qualifies as cross-border PD transfer, which requires either separate permission or a complete abandonment of such services. The simplest solution is to switch to Russian alternatives, e.g., use Virtual Consultant for chat, Yandex SmartCaptcha for CAPTCHA, or code modifications to avoid external CAPTCHA services.

4. Be smart when copying legal documents from other websites

Often this can pose a serious risk. Documents published on websites may have been created by lawyers, protected by copyright, and simply may not fit your specific conditions. Pay for a lawyer's work or create your own text based on open-source guidelines, such as the Tilda privacy policy generator.

5. Data retention period

The maximum retention period for PD related to sales contracts is 5 years. After this period, the data must be deleted with proper documentation. It’s not enough to simply erase it — the deletion must be recorded. To collect PD deletion requests and delete the data easily, you can use these modules:

• Personal Data and Cookie Information
• Personal Data

6. Mandatory documents on the website

To comply with legal requirements, the following documents must be available on your website:

• Public Offer (terms of sale)

• Privacy Policy (PD processing description)

• User Agreement

• (if used on your website)

These documents must be accessible on all devices – including mobile versions. Also, the site must specify the sole proprietorship or legal entity details (name, TIN, OGRN/OGRNIP). An individual entrepreneur's registration address is considered personal data and does not have to be displayed; instead, you may use a P.O. box, for example.

7. Checkboxes

On registration, checkout, and newsletter subscription pages, the consent checkboxes for PD processing must not be pre-checked. The user must check them manually. This is important and often verified during inspections. The screenshot shows the module Simple’s settings:

8. Cookie banner

Your site must have a banner offering to accept cookies and a link to a document that explains what cookies are used, for what purpose, and how the user can opt out. This applies to analytics and ad trackers alike. The OcStore Liveopencart 3.0.3.9 already includes this functionality. Alternatively, you can install any of the popup modules:

• Cookie Policy Notifications
• Simple Popups
• Personal Data and Cookie Information
• Modal Window 2x – confirmation/information popup

9. Mass mailings

If you send users advertising or newsletter emails, you must obtain separate consent. If you don’t plan such mailings – it’s better to disable this feature on the site to avoid unnecessary risk.

Conclusion

Personal data legislation is tightening year by year. The risks are no longer what they “used to be.” This is now a full-fledged part of legal responsibility for anyone conducting business online. And yes, this applies even to small sites on OpenCart.

Don’t delay. Check your site, update the documents, register where needed. This is not only about compliance but also about customer trust and business stability. If you can’t manage it alone – contact us or hire developers, for example, for OpenCart audit and optimization under 152-FZ. There is also a dedicated thread on our forum and, of course, our Telegram chat.