Client Checks: Third Parties and API Provider

Short version: when you check a company through registers, the response contains people: the director, the founders, participants of past court disputes. You did not obtain their consent, and the client cannot give it for them.

The second question concerns the API provider. This intermediary company sends requests to state registers and passes the responses to you. An API (application programming interface) lets one program request data from another by itself, without a manual search. The question is who answers for the information the provider receives.

This is the third article in the series on client checks through an API.

What came before:

the first explained which registers are open and which are closed;
the second covered the grounds for processing data from registers.

The main points of this article:

the people in the register response never gave you consent, and the client cannot give it for them;
the consent of the director and founders can be obtained when you take the client on, and for everyone else you need different grounds;
people you do not know must be told about the processing; this cannot be done in full, so the risk remains;
an API provider either works on your assignment, and you answer for it, or decides for itself what to keep, and answers for its own database;
data of Russian citizens is stored in Russia, and for advocates a search by a client’s full name in outside services is risky.

Whose Data Appears in the Register Response?

Example. A law firm checks the company Romashka before taking its case.

The register response will show:

the director Ivan Petrov;
the founders Maria Sidorova and Oleg Orlov;
people and companies from Romashka’s court disputes.

The firm has one client, the company. But the response contains information about people, and none of them allowed the firm to collect and keep it.

Why can the client not allow it for them? Consent to the processing of personal data is given only by the person or a representative (Art. 9(1) of Federal Law No. 152-FZ of July 27, 2006 “On Personal Data”, hereinafter 152-FZ). The client company is not their representative.

Who is the operator? The operator is whoever decides what personal data to collect and why. Usually that is the firm: it chooses whom to check. Below, “the service” means whoever checks the client and answers for the data.

What can you do?

with the director and founders it is easier: when you take the client on, ask them to sign a consent;
with people from court disputes this will not work: you do not know them.

For people from court disputes the other grounds from Art. 6(1) of 152-FZ remain:

the firm’s legitimate interest (item 7): the firm may protect its interests if it does not infringe the person’s rights;
information that the law requires to be published (item 11);
fulfilling a legal duty (item 2): for example, a client check that Law No. 115-FZ on countering money laundering requires.

The ground “published as required by law” works best for the bankruptcy register (EFRSB) and less well for the register of legal entities (EGRUL) and the bailiff service database (FSSP). More in the second article.

The scope rule. The firm needs to check the client, not everyone who appears in the response. You may not take more information than the purpose needs (Art. 5(5) of 152-FZ).

In the technical specification, that is, the document of requirements for the service, three rules are written down for such people:

take only the part of the register response that the client’s task needs;
do not build dossiers on the people in the response;
do not accumulate responses in a shared database.

How to Notify People You Do Not Know

If information about a person was not received from the person, the firm must tell them the following before processing starts (Art. 18(3) of 152-FZ):

the name and address of the operator;
the purpose of processing and its legal ground;
the list of data;
the circle of expected users of the data;
the person’s rights under the law;
the source of the data.

When may you skip it? The exceptions are listed in Art. 18(4) of 152-FZ.

Two exceptions may fit:

the person has already been notified;
the information was obtained under a federal law or in connection with a contract to which the person is a party.

An exception releases you only from the notification. It does not replace the ground for processing.

What is the difficulty?

with the client everything is simple: the notice can be shown when you take the client on;
with people from the register there are no contacts, and the law does not name a way to notify;
you have no contract with them, so one exception remains: the information was obtained under a federal law.

I found neither a direct answer from the regulator nor case law on whether this exception fits registers (open sources, October 19, 2026).

What can you do? Publish a notice on the service’s website.

It should:

say who the operator is;
say where the information comes from, what exactly and why;
explain how a person can demand its deletion.

Such a notice does not replace a personal one: for people you do not know, a personal notice cannot be given at all. It reduces the risk but does not remove it. The law does not name this way.

From there the service has two paths:

rely on the exception in Art. 18(4) of 152-FZ;
knowingly accept the risk.

The size of the fine. As I read the norm, an organization that fails to give a person the information about processing is fined under Art. 13.11(4) of the Code of Administrative Offenses (CAO).

The amounts for an organization:

under Art. 13.11(4), if the person was not given the information: from 40,000 to 80,000 rubles;
under Art. 13.11(1) of the same Code as amended in 2025, if the processing has no ground at all: from 150,000 to 300,000 rubles.

API Provider: Who Answers for What?

An API provider is a company through which the service gets responses from registers. Think of a courier: it brings you the register response.

Two cases are possible:

I. The provider works on your instruction. It carries out your task, like a courier who delivers parcels where you tell it.

What matters here:

the person’s consent to the instruction, unless a federal law says otherwise (Art. 6(3) of 152-FZ);
a contract that lists the data, the actions, the purposes and the protection duties;
responsibility: before the people, the operator answers for the provider, that is, you (Art. 6(5)).

An instruction does not replace the ground for processing; it is only a way to bring in an executor, and the ground stays the same, for example a legitimate interest.

II. The provider decides for itself what to keep. It has its own database and sells access to it. The courier here keeps its own warehouse.

What this means:

such a provider is itself an operator, and there is no instruction;
passing data to it still needs a ground, usually the same as for the processing itself;
the duty to notify the person (Art. 18(3) of 152-FZ) remains.

I found no position of Roskomnadzor, the Russian data protection regulator, on such providers in open sources.

What does this mean for people from court disputes? You cannot get their consent to an instruction: you do not know them.

And for the director and founders? It is easier. When they sign the consent to the processing of their data, one more phrase can go into the same document: that you may pass their data to the provider. One consent then covers both the processing and the provider’s work. If the consent is in writing, the law requires it to name the person to whom processing is entrusted (Art. 9(4) of 152-FZ).

The first case. On the literal text of Art. 6(3) it is closed for people from court disputes: I found no exception for client checks in the law. The second case remains, the provider as an independent operator.

Another reading. Consent to an instruction is needed only when the processing itself rests on consent. On other grounds an instruction is allowed without it. I found no official clarification either way. The main risk: the regulator reads Art. 6(3) literally and demands consent to the instruction as well.

Consent to passing information to the provider settles the question only for the person who gave it.

Where to store data? Data of Russian citizens is recorded and stored in databases located in Russia, except in the cases listed in Art. 18(5) of 152-FZ. The place of storage is checked when you choose a provider and a cloud.

If the Firm Works Through Advocates

Advocate privilege covers any information connected with an advocate’s legal assistance to a client of the advocate (Art. 8(1) of Law No. 63-FZ on Advocate Activity and the Bar). It is the Russian counterpart of attorney-client privilege.

What this means in practice:

the secret covers not only the content of a conversation but also the very fact that a person came to an advocate (as legal commentaries explain);
if an advocate enters a person’s name in an outside service, a third party receives this information;
without the client’s written consent it is better not to make such a query.

I found no clarifications of the Federal Chamber of Advocates or case law on such services (open sources, October 19, 2026).

For advocates, a search by the organization’s INN (taxpayer ID) and in local databases is safer than a search by the client’s full name in someone else’s service. That is my advice, and the law does not require it. For other firms, in my view, a confidentiality agreement with the provider is enough.

What a Service Needs in Any Case

An operator has duties that do not depend on the ground:

notifying Roskomnadzor about the processing;
the operator’s documents: the personal data policy and internal acts;
a separate notice if data is transferred abroad.

They are covered in a separate article of the series on the duties of a personal data operator in LegalTech.

Frequently Asked Questions

Can a client consent on behalf of the people in a register response? No. Consent is given by the person or a representative, and the operator verifies the representative’s authority (Art. 9(1) of 152-FZ).

You can ask the director and founders to consent themselves, and for people from court disputes other grounds remain: legitimate interest, publication required by law, fulfilling a legal duty.

Is a contract with an API provider needed? If the provider works on the operator’s instruction, a contract is needed. It lists the data, the actions, the purposes and the protection duties.

Entrusting processing is allowed with the person’s consent, unless a federal law provides otherwise (Art. 6(3) of 152-FZ). I found no exception for client checks.

There is another reading: consent to an instruction is needed only when the processing itself rests on consent. There is no official clarification, so the risk of the literal reading remains.

Where must data of Russian citizens be stored in an API check? It must be recorded and stored in databases located in Russia, except in the cases in Art. 18(5) of 152-FZ. The place of storage is checked when you choose a provider and a cloud.

Third Parties and the API Provider in Client Checks