Short version: client consent remains the most durable ground for a check. But it works only if it is drafted separately and you can prove that the client gave it.
For a credit history the rules are stricter: a separate law sets the form of the consent, its term and the contract with the bureau.
This is the fourth article in the series on client checks through an API.
What came before:
- the first explained which registers are open and which are closed;
- the second covered the grounds for processing data from registers;
- the third dealt with the people in a register response and the API provider.
The main points of this article:
- consent is drafted separately from other documents, and the firm must prove that it was obtained;
- the consent should record the purpose, the sources, the data, the provider, the term with withdrawal, and the way the consent is confirmed;
- consent is given freely and can be withdrawn, so you need a fallback;
- a firm requests a credit history only under a contract with the bureau and with the client’s consent in a special form;
- it is simpler to ask the client to bring his or her own report.
What Must the Consent Be Like?
Consent to the processing of personal data must be:
- specific;
- substantive;
- informed;
- conscious;
- unambiguous.
It is drafted separately from other documents and information that the client confirms or signs (Art. 9(1) of Federal Law No. 152-FZ of July 27, 2006 “On Personal Data”, hereinafter 152-FZ). A general checkbox “I agree to the terms of the service” does not meet this requirement. Do not use a pre-ticked box either: consent must be unambiguous (Art. 9(1)), and a contract cannot treat a person’s inaction as a condition (Art. 6(1), item 5).
Is an electronic form acceptable? Yes. Consent may be given in any form that allows the fact of its receipt to be confirmed, unless a federal law provides otherwise (Art. 9(1)).
What is needed for this:
- a separate checkbox with the text of the consent next to it or behind a link;
- a record that will later prove the consent: date, time, version of the text, session identifier.
A paper signature or an electronic signature is required only where the law demands written form (Art. 9(4)).
Who proves that consent was given? The operator, that is, the firm: the burden of providing the evidence lies on it (Art. 9(3)). The record of consent protects the firm in a dispute.
What Should the Consent Record?
A separate consent should record six things:
- Purpose. For example, “risk assessment before concluding a legal services agreement”.
- Sources. The list of registers the service will query.
- Data. What information about the client the service sends to the registers and what it receives back.
- Provider. The name and address of the company to which the processing is entrusted.
- Term and withdrawal. How long the consent lasts and how to withdraw it.
- Confirmation. The service records the date, the time and the method, so that it can prove the consent in a dispute.
The law does not require exactly these six items for consent in ordinary form. The model is taken from Art. 9(4) of 152-FZ, which lists the content of written consent: I kept the items needed for a client check.
What Are the Limits of Consent?
Consent has two limits.
I. It is given freely (Art. 9(1)). Consent without which the service is unavailable is hard to call free. I did not find a direct rule on such a condition in Art. 9.
The closest example from practice. In a ruling of a Supreme Court judge dated October 5, 2018, No. 306-AD18-16256, an insurance company put a condition in its contract: it may pass the client’s data to any third parties, including for purposes outside insurance. The client had no choice to agree or to refuse. The courts held the condition to infringe consumer rights (Art. 16 of the Consumer Protection Law No. 2300-1, Arts. 6 and 9 of 152-FZ). They upheld the fine of 10,000 rubles under Art. 14.8(2) of the Code of Administrative Offenses (KoAP RF). The Supreme Court judge refused to refer the company’s appeal to a court hearing.
Caveats:
- this is an insurance contract with a consumer, not a client check by a law firm;
- the consumer protection law does not apply to corporate clients, so the analogy is weaker;
- the ruling refuses to refer the appeal and does not express the position of the Judicial Panel of the Supreme Court.
The Roskomnadzor position. I could not open the Roskomnadzor pages, so I did not check its clarification. A commentary by A. I. Saveliev in ConsultantPlus gives this position: if data is processed on the terms of a contract, a separate consent is not needed (Art. 6(1), item 5 of 152-FZ). This is a different ground, and it does not bear directly on a condition “no checkbox, no service”.
What you can do: provide a fallback, for example a manual check by a lawyer from the client’s documents.
II. It can be withdrawn (Art. 9(2)). After withdrawal, processing may continue without consent only on another ground:
- from items 2 to 11 of Art. 6(1) of 152-FZ;
- from Art. 10(2) (special categories of data);
- from Art. 11(2) (biometrics).
The fate of the check result is written into the technical specification, the document with the requirements for the service: the result is deleted or kept on another ground.
How to Draft Consent to a Credit History Request?
A credit history belongs to the information that is not openly given to a private firm. The rules are set by Federal Law No. 218-FZ of December 30, 2004 “On Credit Histories” (hereinafter 218-FZ). For a firm it contains five conditions.
Who may request it. A user of a credit history may be a legal entity or an individual entrepreneur that has obtained the subject’s consent (Art. 3, item 7). A private individual without entrepreneur status may not obtain someone else’s report, except a legal representative and a person holding a notarized power of attorney (Art. 6(3)).
Contract. A credit report is issued under a contract for information services with the bureau (Art. 6(2)).
Content and form of consent. The consent states the subject’s data, the purpose, the date it was drawn up and the name of the user. It is made on paper with a handwritten signature, or in electronic form signed in one of the ways listed in Art. 6(9), for example with an enhanced qualified electronic signature. An ordinary checkbox does not fit these ways.
Term. The consent is valid for six months from the day it is drawn up. For a small or medium-sized business and for an individual who gives consent for a deal with such a business, the term is one year. If during that time a loan, leasing, pledge or surety agreement is concluded with the client, or an independent guarantee is issued, the consent stays in force. It then lasts for the whole term of the agreement or guarantee (Art. 6(10)). After the term ends, the main part of the history may not be requested (Art. 6(10.1)).
Confirmation and storage. With the request, the user informs the bureau about the consent: its purpose and date of issue (Art. 6(12)). The consent for the main part of the history is kept for three years after its term ends, in any form that allows its integrity and authenticity to be checked.
What Is the Fine for an Unlawful Request?
Unlawfully obtaining a credit report, where there is no criminal offense, is punished under Art. 14.29 of KoAP RF. I did not find court practice on a fine against a firm for requesting a report without consent (open sources and the Supreme Court case file, October 23, 2026).
Amounts:
- individuals: from 1,000 to 2,500 rubles;
- officials: from 2,500 to 5,000 rubles or disqualification for up to three years;
- legal entities: from 30,000 to 50,000 rubles.
How to Manage Without a Request to the Bureau?
For most legal services a credit history is not needed.
If it is still needed, for example in a dispute with a bank, there is a safer path: the client obtains his or her own report. In each bureau that holds the history, the client may get a report free of charge no more than twice per calendar year, only one of them on paper (Art. 8(2)). The client then hands the file to the service voluntarily.
A caveat. An uploaded file is easy to alter. By law, an electronic report for the client is signed by the head of the bureau or another authorized person, with an electronic signature or its equivalent (Art. 6(6)). A signed file can in principle be checked, while a screenshot or an unsigned copy cannot. I checked what the bureaus themselves say on their websites (October 23, 2026). The United Credit Bureau (OKB) writes that the authenticity of a report sent by mail is confirmed by a signature. The National Bureau of Credit Histories (NBKI) says in its blog that a report from the personal account arrives as a PDF file (an electronic document format) with the bureau’s signature. How a client can verify that signature (a separate file or inside the document, with what program) is not described on those pages. Automatic verification should therefore not be built in without the bureau’s instructions.
Until the signature is checked, a report the client brings is good for a conversation with the client, but not for an automatic assessment of solvency.
Frequently Asked Questions
Is a general checkbox “I agree to the terms of the service” enough? No. Consent is drafted separately from other documents the client signs (Art. 9(1) of 152-FZ). You need a separate checkbox with the text of the consent next to it or behind a link, and a record of when and how it was given.
May a law firm request a client’s credit history? A legal entity or an entrepreneur may, if it has a contract with the bureau and has obtained the client’s consent in the prescribed form (Art. 6 of 218-FZ). For most cases this is excessive. It is simpler to ask the client to upload his or her own report.
What should be done if the client withdraws consent? Processing may continue only on another ground: from items 2 to 11 of Art. 6(1) of 152-FZ, from Art. 10(2) or from Art. 11(2). The fate of the check result is written into the technical specification in advance: it is deleted or kept on another ground.
How long is consent to a credit history request valid? Six months from the day it is drawn up, and one year for a small or medium-sized business. If a loan, leasing, pledge or surety agreement is concluded during that time, the consent is valid for the whole term of the agreement (Art. 6(10) of 218-FZ).
Read Also
- Third Parties and the API Provider in Client Checks: whose data appears in a register response and who answers for it
- How a Service Reads a Register Response: Five Rules: what a service does with what is found and not found
- “The Register Is Open” Does Not Mean “You May Use the Data”: on what ground a service may process data from registers
- Client API Verification: What a Legal Service May Check: which registers are open and which are closed
- How to Write a LegalTech Spec: six steps from a parameter table to test scenarios
Need a legal architect to write the client-checking rules for your service? Write to me: +7 (902) 899-07-58 (Telegram, WhatsApp, KakaoTalk) or send a request.