# Russian Review Checklists

Use only the relevant section. Do not paste the whole checklist into the final answer.

## General Contract

- Parties: full legal names, OGRN/OGRNIP, INN, authority of signatory, PoA/charter basis.
- Subject matter: specific enough to be enforceable; for services, clear scope and acceptance; for goods, name/quantity/quality/delivery.
- Price and payment: amount, currency, VAT wording, payment date, setoff, unilateral changes.
- Documents: acts, УПД, invoices, EDI operator, motivated refusal period, deemed acceptance.
- Term and termination: start/end, unilateral refusal, cure periods, consequences, return/delete data.
- Liability: penalties, losses, limitation of liability, exclusions for intentional breach, force majeure.
- Confidentiality: definition, term, permitted disclosure, remedies, commercial secret regime if needed.
- IP: ownership, license scope, territory, term, sublicensing, source code, open source, employee/contractor chain of title.
- Personal data: roles, processing agreement, purposes, categories, localization, processors, cross-border transfer, deletion.
- Disputes: governing law, venue, претензионный порядок, arbitration enforceability.
- Consumer issues: public offer, unilateral changes, refunds, mandatory consumer rights, unfair penalty or waiver clauses.

## Personal Data / RKN

- Is the company an operator, processor, or both?
- Is there a lawful basis under 152-ФЗ Article 6 or a valid consent?
- Does consent need to be separate, specific, informed, conscious, and unambiguous?
- Are special categories, biometrics, minors, employees, or publicly disseminated data involved?
- Is RKN notification required and current?
- Are databases used for first collection/recording/systematization/accumulation/storage of Russian citizens located in Russia?
- Is cross-border transfer present and was the RKN procedure checked?
- Are privacy policy, consent texts, cookie/tracking notices, and ad consents aligned with actual processing?
- Are processors bound by written instructions and confidentiality/security duties?
- Are retention, deletion, subject requests, breach response, and access logs defined?
- Are technical/security measures assigned to the right owner and checked against FSTEC/RKN requirements when relevant?

## SaaS / IT / Marketplace

- User account and access rules; suspension and deletion.
- SLA, support, maintenance, planned downtime, backups, restore commitments.
- Data ownership, export, deletion, and portability.
- Acceptable use, prohibited content, moderation, 149-ФЗ risks.
- Payment flow, fiscal receipts, agent/marketplace role, refunds.
- Subprocessors, hosting region, analytics, ads, cookies, SDKs.
- Open-source, third-party APIs, model outputs, user-generated content.

## Risk Severity

- Critical: illegal/unworkable term, material unenforceability, large regulatory exposure, loss of core asset, impossible operational duty.
- High: materially one-sided economics, unclear acceptance/payment, personal-data compliance gap, broad indemnity, missing IP rights.
- Medium: ambiguity likely to cause dispute, missing procedure, weak evidence trail.
- Low: drafting cleanup, consistency, formatting, non-material typo.