Yegelev Consulting –
Legal Partners for IT Business
From privacy compliance and IP transactions to cross-border AI product launches and strategic legal planning – we help tech businesses operate safely in the EU and Russia.
- 16+ YearsManaging Partner with experience as an in-house Tech Legal Lead and Senior Advisor
- IAPP CertifiedConsultants holding recognized CIPP/E and CIPM certifications
- Cross-Border ExpertiseEU and Russian qualified lawyers specializing in AI, IT, IP, and privacy law
- € 3.5 B M&Asecured through Privacy & IP due diligence
- € 150 M Savedpreventing GDPR fines
- 30+ Countriesof B2C and AI product launches
CIS-rooted lawyers practicing in the EU and Russia, preventing regulatory exposure
and winning cases against government agencies – we know how to get things done
and winning cases against government agencies – we know how to get things done
Behind The Scenes
Our experienced lawyers specialize in data privacy, IP, IT, and AI regulation, providing strategic legal management services. We work as legal business partners, not just external counsels.
Kamil Egelev – founder & managing partner
For more than half of my 16 years of legal practice, I've worked at large tech companies, managing privacy functions and legal teams, supporting major M&A and IP asset transactions, and communicating directly with business owners. Therefore, I understand what businesses expect from lawyers and offer solutions that meet those expectations.
Cross-border lawyers for cross-border projects – with dedicated EU
and Russia desks, we help businesses operate safely in both markets.
and Russia desks, we help businesses operate safely in both markets.
EU Desk
- Data privacy & GDPR complianceTo prevent hefty fines and data processing bans under the GDPR, our IAPP-certified specialists conduct thorough privacy audits, implement robust compliance frameworks, and provide the necessary documentation, policies, and assessments.
- Alignment with diverse privacy regimesEntering the EU market with a domestic legal framework may lead to penalties both in the EU and your country of incorporation. We help non-EU companies align with the GDPR, ePrivacy, and the DSA while preserving the resilience of their existing privacy framework.
- AI product launchesFines under the EU AI Act are 75% higher than those under the GDPR. We help local and international companies launch AI-powered products in the EU in compliance with evolving AI regulation.
-
GDPR
GDPR compliance audit and documentation development:- Data mapping, ROPA, DPIA, LIA
- Privacy policies, DSAR, response planning
- Data processing agreements (DPA)
- Marketing communications and ePrivacy
- Outsourced DPO
-
Cross-border data transfers
International data transfer and localization structuring:- GDPR + CCPA, HIPAA, PDPL, 152-FZ
- Transfer Impact Assessments (TIA)
- Data transfer agreements, SCCs
- Data localization requirements
- Global privacy frameworks
-
Product + AI
Pre-launch product readiness and EU tech and AI regulation alignment:- Product compliance review
- EU AI Act Risk Classification
- Alignment with DSA, DMA
- Transparency documentation
- ISO 27001 readiness
Russia Desk
- Data localization & cross-border transfersTo prevent fines of up to $225,000 or personal data processing bans under Russian data protection law, we help companies comply with data localization requirements and cross-border transfer notification obligations, enabling them to operate safely in the Russian digital market.
- Roskomnadzor audits readinessSince 2018, we have helped businesses prepare for inspections, on-site visits, and online privacy audits conducted by the Russian data protection authority (Roskomnadzor).
- IT products & digital services complianceTo avoid web-service blocking, we assess compliance and close regulatory gaps, ensuring your IT products meet the requirements of Russian information law, including transparency, data retention, and content moderation obligations.
- Intellectual property protection & transactionsIn addition to trademark and software registration, we conduct IP due diligence for M&A and investment transactions, structure IP asset deals, and support B2B and B2C contracting.
-
152-FZ audit
Compliance with 152-FZ and Roskomnadzor inspection readiness:- Data localization and cross-border transfers
- 152-FZ compliance audit
- Privacy documents and processes
- Notification requirements
- Support prior and during inspections
-
IT product check
IT product and digital service alignment with national information law:- Web-service and app compliance check
- Requiring documents and notices
- Data retention requirements
- Marketing communication compliance
- TOSs and TOUs
-
IP
Intellectual property protection, registration, and transactions:- IP due diligence
- Intellectual property rights check
- IP transactions structuring and contracting
- Trademark, design, and software registration
- EULAs and agreements
The results speak for themselves – we have helped tech businesses across EMEA and the U.S. launch and grow their products.
Selected Projects
Over the past few years, we have:
- Completed privacy audits for six (6) IT companies under the GDPR, CCPA, HIPAA, 152-FZ
- Supported EU market entry for U.S.-based AI startups (B2B and B2C)
- Led IP and Privacy Due Diligence for multiple M&A and asset transactions totaling €3.5B
- Delivered privacy compliance training for 100+ employees and management teams
- Provided legal support for 30+ international B2C product launches
- Built legal and privacy functions for technology businesses from the ground up
Popular Engagements
- -1-
Investor Readiness
Privacy and IP due diligence before funding rounds and M&A.
- -2-
EU Expansion
Privacy, contractual, and regulatory frameworks for entering European markets.
- -3-
AI Product Launch
Assessment of privacy, AI, consumer protection, and platform risks before launch.
- -4-
Technology Contract
Review and drafting of SaaS and licensing arrangements, EULAs, DPAs, MSAs, and commercial contracts.
FAQ
- Yes. The GDPR applies if your company target services or goods at representatives of your potential clients (businesses) in the EU and collect their contact information.
- Yes. The GDPR applies to non-EU companies if you target goods or services to EU-based clients or monitor their behavior.
- Additionally, your country of incorporation may have international agreements with the EU, which can make GDPR enforcement and fines applicable even without you having an EU office.
- In most cases, yes.
- GDPR requires companies to appoint a data protection officer (DPO) to oversee data processing activities.
- This function can be outsourced.
- Yes, we help tech companies assess legal risks before entering new markets, including privacy, IP, and regulatory compliance issues.
- Your intellectual property (IP) is a valuable company asset, including trademarks, software, designs, visual content, and written materials.
- During an IP audit (IP due diligence), we verify who owns the company’s IP, whether rights have been properly transferred or obtained, and identify potential risks.
- In most cases, yes. According to Federal Law 152-FZ, a notification must be submitted to Roskomnadzor.
- The notification can be completed on the Roskomnadzor's website (does not available from outside Russia).
- The notification confirms that the company has conducted a privacy audit, have all of internal documents in place, and brought its processes into compliance.
- Currently (2026) the fine for failure to notify companies ranges from 100,000 to 300,000 rubles (~€1,200 – 3,600).
- Federal Law 152-FZ "On Personal Data" applies to foreign companies that have direct contracts with, or consents to process personal data from, Russian citizens.
- Roskomnadzor draws attention to a foreign company's online presence: metrics apps on the website (e.g., Google Analytics), server hosting IP addresses, consent checkboxes, Privacy and Cookie Policy.
- Data localization requirements can be met through Russian vendors, hosting providers, and metrics apps providers.
- Other requirements include documentation, technical, legal, and organizational security measures, and notification of cross-border transfer (if there is a physical presence in the Russian Federation and the data is transferred abroad).
- Federal Law 152-FZ prohibits the use of foreign databases for processing the personal data of Russian citizens during collection. For example, using Google Forms that transfers data to a Google Spreadsheet or using foreign registration and authorization systems now requires Russian equivalents.
- After been collected in accordance with these requirements, data can be transferred to Google or Microsoft services, provided that prior notification of the "cross-border data transfer" to Roskomnadzor is mandatory.
- Roskomnadzor has the right to prohibit such transfer.
Contact Us –
Let’s discuss your project today
Whether you are 90 days away from a vc round, launching an AI product, or entering the EU market, a brief, focused conversation provides more clarity than a dozen generic articles.
"Yes, it's legal"
Yegelev Consultng
–
Legal Partners for IT Business
–
Legal Partners for IT Business