Context first
First understand the actual processing, the purpose and what the person expects — then pick the legal construct.
CPAO
Wildberries & Russ
Chief Privacy & Awareness Officer
01 · Practice
I built the privacy function of the merged company (RWB) from scratch and lead an international team — from Russia to Asia and Africa.
Privacy and Awareness in one department means managing expectations on both sides. Inside the company, the business needs to understand what is expected of it and why. Outside, customers, partners and regulators need to see how the company actually handles data.
Rules nobody was told about don’t get followed. A story without rules is a promise with nothing to back it up.
The team launched privacy.wildberries.ru — a public site about treating personal data with care. I led the launch of legal.wildberries.ru — a single place to publish legal documents: versions, languages, jurisdictions.
20+jurisdictions
#1The Department 2026
20+professionals on the team
Finance → Big Tech → Global e-commerce · UniCredit · Sber · Yandex · Wildberries & Russ. Early compliance track — Stryker.
The Department — 2026
First place
“Effective Legal Protection of Personal Data” category in Legal Insight’s ranking of in-house legal departments.
“Any complex field becomes clear once you turn it into a system” Speaker · Builder
How I build
privacy
02 · Operating model
Context → Law → Product → Process → Control → Metrics → Automation
Shift everywhere
Privacy isn’t just shifted left, to the start of a project — it’s built into every stage of the product and process lifecycle.
DPO as partner
The DPO is part of decision-making, not someone who shows up at final sign-off.
Product & UX
Transparency lives not only in the policy but also in the interface and the user experience.
Risk & ownership
Privacy is a shared responsibility of process and product owners, managed through risk-based controls.
Proactive control
Not just reviewing incoming projects but auditing processes already in production.
Automate the repeatable
The routine gets templated and automated — expert attention goes to the ambiguous.
Selected
impact
03 · Impact
Not the number of documents but the quality of the system
- No privacy function at all→ An international privacy function across 20+ jurisdictions
- One-off privacy reviews→ Processes, controls and reusable solutions
- Privacy on paper→ Privacy by design in services and interfaces
- Manual routine→ Automation and standardization of the routine
- One lawyer’s responsibility→ Shared responsibility of product owners
- Reacting to incidents→ Proactive audits of live processes
- Applying the rules→ Helping shape regulation in several jurisdictions
- Expertise kept in one head→ Methodologies and courses the community actually uses
Law × Privacy ×
Technology
04 · Technology
AI is a layer of working infrastructure, not a chat with answers: research, analysis, agents, RAG, MCP and the automation of expert processes.
I’ve been exploring the automation of legal work since 2022 — from machine-assisted anti-corruption review of legal acts to privacy tools: automated checks, observation-first scanning, AI-assisted research.
Knowledgeable Privacy Benchmark — an experimental research project: testing how much AI actually knows about privacy rather than how confidently it talks about it.
Privacy evaluation of AI models — I research how to test open-weight models for memorization and data extractability: membership ≠ memorization ≠ extractability, synthetic canaries instead of real data. The legal side: how to honor a data subject’s erasure request when their data has ended up inside a model.
Research → Teach →
Build community
05 · Selected talks & teaching
I teach what I’ve done myself: where the boundaries of the personal data concept lie, how a legal basis is chosen and how a privacy function is built — from the first conversation with the business and the budget to the team and the signs that it all works. Examiner for the PPCP/C certification, member of working groups on improving data protection legislation.
I speak in Russia and at in-person international conferences — Minsk, Tashkent, Bishkek. My own venue is WB Privacy & Day, which we put together in 2025 and 2026.
Guest of the fifth episode of Privacy.Seasons, Comply’s podcast (in Russian): the all-directions role of a DPO, weaving the privacy function into GR, PR, Legal and Security, managing expectations, and why personal data is not a commodity.
Privacy —
shipped
06 · Products
Board
games
07 · Privacy as a playable system
Privacy Strikes
A narrative card game for two teams: ~100 cards, real cases under the GDPR and Russia’s Personal Data Law, live discussion. I came up with the idea, the mechanics and the rules — the first game of its kind in the Russian-speaking privacy community.
Learn morePrivacy Sprint
A five-minute privacy sprint: 2–6 players, no legal knowledge needed — even people far from privacy play it.
Learn moreData subject consent
and beyond
08 · Research
I research consent and the architecture of legal bases — across national regimes rather than within one.
Russian Foreign Trade Academy — international law → HSE University — master’s in compliance → HSE University — PhD in Law, information law.
Consent-centricity
My own research concept: a critique of consent as the universal “default” legal basis.
Function over form
Consent is judged by the functions it actually performs, not just its formal elements.
Legal bases architecture
The choice of basis follows the context of processing, not the convenience of documentation. The reverse hierarchy ranks the bases by two criteria — how tied they are to the context and how much they depend on the data subject’s own action.
Privacy as informed control
What matters to a person isn’t documents but transparency, clarity and a real ability to influence the processing.
Selected publications
- Terms of Service: A Legal Basis Without Limits?
- Personal Data Is Not a Commodity
-
The Scope of Regulatory Risk for Internal Control Purposes
- Consent as a Sui Generis Act
-
Personal Data Protection in the Age of Surveillance Capitalism
- The Scope of the Personal Data Concept in Russia
-
Consent to Personal Data Processing: A Classification of Forms
Practical materials
Community
09 · Community
PROPD channel
Whispers about Personal Data
Events, discussion clubs and materials for privacy enthusiasts — including the “Whispers about AI” format. In Russian.
Co-founder
Personemes
My own takes, observations and memes about personal data — this is where I’m a privacy memologist. In Russian.
Associate partner
Privacy Advocates
A channel of case law analyses and presentations on personal data. In Russian.
Off the clock
10 · Off the clock
10·1 · Birdwatching
162 species
Field observations and bird photography — from Moscow to Selous: 135 checklists on eBird. My photos and notes (in Russian) are in the channel Beak-Bearing Surface.
10·2 · Travel
27+ countries
From Central Asia to Western Europe — the full route runs in the ticker below.
10·3 · D&D
D20
Dungeon Master: original storylines and horror one-shots — from Exandria to the “Scary Tavern.”
10·4 · Magic
10+ years
I collect rare and unusual magic props from all corners of the planet.
10·5 · Film
Reviews
Films, series and theater — reviewed (in Russian) in the channel Temporary Art Asylum.
10·6 · Music
Guitar · Piano
I play guitar and piano, and I sing.
10·7 · Chess
e2–e4
I play: the same logic as at work — think a few moves ahead.
Let’s talk
11 · Contact
Research — PhD in Law, HSE University · ORCID
Writing — Zakon.ru
Languages — RU native · EN C1 · DE B2
MSK · open to professional conversation