Data Protection & Privacy in Russia

Russia's data protection framework is one of the most demanding in the world for foreign and domestic businesses alike. Federal Law No. 152-FZ 'On Personal Data' (Федеральный закон «О персональных данных»), combined with a series of amendments that significantly tightened enforcement, creates a multi-layered compliance obligation covering data localisation, consent architecture, cross-border transfers, and mandatory breach notification. Any company that collects, stores, or processes personal data of Russian residents - regardless of where the company is incorporated - falls within the scope of this regime. The consequences of non-compliance range from administrative fines and website blocking to criminal liability for responsible officers. This article maps the legal landscape, identifies the most common compliance gaps, and explains how to build a defensible data protection strategy in Russia.

The cornerstone of Russian data protection law is Federal Law No. 152-FZ 'On Personal Data,' which defines personal data broadly as any information relating directly or indirectly to an identified or identifiable individual. The law has been amended multiple times, with the most consequential changes introduced by Federal Law No. 266-FZ, which came into force in stages and introduced mandatory breach notification, expanded the grounds for Roskomnadzor (Роскомнадзор, the Federal Service for Supervision of Communications, Information Technology and Mass Media) to impose administrative measures, and restructured the consent requirements for sensitive data categories.

Alongside 152-FZ, several other instruments shape the compliance environment. Federal Law No. 149-FZ 'On Information, Information Technologies and Information Protection' (Федеральный закон «Об информации, информационных технологиях и о защите информации») governs the blocking of websites and information systems that violate localisation requirements. The Russian Code of Administrative Offences (Кодекс Российской Федерации об административных правонарушениях, KoAP) sets out the fine schedule, which was substantially increased by amendments to Article 13.11. The Criminal Code of the Russian Federation (Уголовный кодекс Российской Федерации) contains provisions under Article 137 that can apply to unlawful collection or dissemination of private information, exposing individual officers to personal liability.

Roskomnadzor serves as the primary supervisory authority. It maintains the register of personal data operators, receives breach notifications, conducts scheduled and unscheduled inspections, and initiates administrative proceedings. A separate register - the register of violators of personal data subjects' rights - can result in ISPs blocking access to a non-compliant operator's website within Russia. For international businesses, this blocking mechanism is a significant commercial risk that is often underestimated until enforcement action begins.

The regulatory framework also incorporates Government Decree No. 1119 'On Approval of Requirements for the Protection of Personal Data When Processed in Personal Data Information Systems' (Постановление Правительства РФ № 1119), which classifies personal data information systems into four security levels and prescribes technical and organisational measures for each. Order No. 21 of the Federal Service for Technical and Export Control (FSTEC, Федеральная служба по техническому и экспортному контролю) details the specific security measures required at each level. Compliance with these technical requirements is a de facto prerequisite for passing a Roskomnadzor inspection.

The localisation requirement under Article 18.1 of Federal Law No. 152-FZ obliges operators to ensure that the initial collection, recording, systematisation, accumulation, storage, modification, and retrieval of personal data of Russian citizens is performed using databases physically located in Russia. This obligation applies at the moment of initial data collection, not merely at the storage stage - a distinction that courts and Roskomnadzor have consistently enforced.

The practical implication is that a company cannot simply replicate data to a Russian server after first collecting it abroad. The primary database must be in Russia from the outset. A secondary copy may be maintained abroad for processing purposes, but the primary write operation must occur on Russian infrastructure. This architecture requirement has forced many international companies to restructure their CRM, HR, and e-commerce platforms.

A common mistake made by international clients is assuming that using a Russian cloud provider's data centre automatically satisfies the localisation requirement. The legal obligation falls on the data operator, not the infrastructure provider. The operator must be able to demonstrate - through contracts, technical documentation, and audit logs - that the initial processing occurs in Russia. If the cloud provider routes data through foreign nodes before writing to Russian storage, the operator remains exposed.

Roskomnadzor has the authority under Article 23 of Federal Law No. 152-FZ to apply to a court for an order restricting access to an operator's information resource if localisation requirements are not met. The blocking order can be executed within 24 hours of the court decision being transmitted to the relevant ISPs. For e-commerce businesses, this represents an existential operational risk.

To receive a checklist on data localisation compliance for Russia, send a request to info@vlolawfirm.com.

Russian law under Article 6 of Federal Law No. 152-FZ recognises several lawful bases for processing personal data: consent of the data subject, performance of a contract to which the subject is a party, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest, and the legitimate interests of the operator or a third party. However, in practice, consent is the most commonly used basis for commercial operators, and the requirements for valid consent are more demanding than many international businesses expect.

Consent must be specific, informed, conscious, and unambiguous. It must identify the operator, the purpose of processing, the list of data to be processed, the actions the operator is authorised to take, the validity period, and the procedure for withdrawal. Bundled or pre-ticked consent is not valid under Russian law. For processing of special categories of data - health data, biometric data, political opinions, religious beliefs, and similar - Article 10 of Federal Law No. 152-FZ requires written consent, which in practice means either a handwritten signature or a qualified electronic signature.

The amendments introduced by Federal Law No. 266-FZ added a new category: consent for the dissemination of personal data (согласие на распространение персональных данных). This is a separate consent instrument required whenever personal data is made publicly available - for example, on a company website, in a published directory, or through a social media integration. The consent must specify which data elements may be disseminated and which conditions apply. Operators who publish employee profiles, customer testimonials, or user-generated content without this separate consent instrument are in breach.

Withdrawal of consent must be as easy as giving it. Article 9 of Federal Law No. 152-FZ requires the operator to stop processing within 30 days of receiving a withdrawal request, unless another lawful basis applies. A non-obvious risk is that many operators build consent withdrawal mechanisms that are technically functional but practically inaccessible - buried in account settings or requiring multiple steps. Roskomnadzor has treated such designs as constructive non-compliance.

In practice, it is important to consider that consent obtained before the amendments to 152-FZ came into force may not satisfy the current requirements. Operators who have not refreshed their consent forms and privacy notices since the amendments should treat their existing consent base as potentially invalid and plan a re-consent campaign.

Cross-border transfer of personal data - defined under Article 12 of Federal Law No. 152-FZ as the transmission of personal data to a foreign state, foreign authority, or foreign individual or legal entity - is subject to a two-tier framework. The first tier covers transfers to countries that Roskomnadzor has recognised as providing adequate protection. The second tier covers all other destinations.

For transfers to adequate countries, the operator may proceed without additional authorisation, provided the transfer is for a legitimate purpose and the data subject has been informed. Roskomnadzor maintains a list of adequate countries, which broadly corresponds to Council of Europe Convention 108 signatories and a number of other jurisdictions. Notably, the list does not include the United States as a whole, meaning transfers to US-based processors require additional safeguards.

For transfers to non-adequate countries, Article 12 of Federal Law No. 152-FZ requires either the written consent of the data subject to the specific cross-border transfer, or the conclusion of an agreement that provides for the protection of the rights of data subjects. The operator must also notify Roskomnadzor of the intended transfer before it takes place, providing information about the recipient, the purpose, the categories of data, and the protective measures in place. Roskomnadzor may prohibit or restrict the transfer if it concludes that adequate protection cannot be ensured.

A practical scenario that frequently arises: a European parent company operates a shared HR platform that processes data of Russian employees. The initial collection must occur in Russia (localisation requirement), but the parent company needs access to that data for payroll, reporting, and HR analytics. The lawful structure requires a data processing agreement between the Russian subsidiary and the parent, a Roskomnadzor notification, and - if the parent is in a non-adequate country - either individual consent from each employee or a contractual framework that Roskomnadzor accepts as providing equivalent protection. Many companies implement this structure incompletely, relying on the employment contract as a catch-all basis, which does not satisfy the cross-border transfer requirements.

A second scenario involves SaaS platforms. A Russian company subscribes to a foreign SaaS tool that processes customer data. Even if the SaaS provider stores data in Russia, the operator - the Russian company - remains responsible for ensuring that any access by the foreign provider's support or engineering teams constitutes a lawful cross-border transfer. The SaaS contract must be reviewed and supplemented with appropriate data protection clauses.

To receive a checklist on cross-border transfer compliance for Russia, send a request to info@vlolawfirm.com.

Federal Law No. 266-FZ introduced mandatory breach notification obligations that significantly changed the compliance burden for Russian data operators. Under the amended Article 21 of Federal Law No. 152-FZ, operators must notify Roskomnadzor of a personal data breach within 24 hours of detection if the breach involves unlawful dissemination or provision of personal data. A follow-up notification with the results of the internal investigation must be submitted within 72 hours.

The 24-hour window is extremely tight by international standards. The EU General Data Protection Regulation (GDPR, Общий регламент о защите данных) allows 72 hours for the initial notification. Russian law gives operators one-third of that time. In practice, this means that operators must have a pre-built incident response plan, a designated internal contact point, and a pre-drafted notification template ready before any breach occurs. Companies that attempt to build these processes after a breach is detected consistently miss the deadline.

Russia does not have a statutory requirement to appoint a Data Protection Officer (DPO) equivalent in the same form as the GDPR. However, Federal Law No. 152-FZ under Article 22.1 requires operators to designate a person responsible for organising the processing of personal data (лицо, ответственное за организацию обработки персональных данных). This person must be identified in the operator's internal documentation, must have the authority to issue binding instructions on data protection matters, and must be the point of contact for Roskomnadzor. For large operators or those processing sensitive data, this role carries significant personal exposure.

Enforcement has become substantially more active. Roskomnadzor conducts both scheduled inspections - announced in advance and listed in the annual inspection plan - and unscheduled inspections triggered by complaints, media reports, or its own monitoring activities. The administrative fine schedule under Article 13.11 of KoAP now includes fines of up to 6 million roubles for repeated violations, with separate fine bands for each type of violation. Multiple simultaneous violations - for example, missing a breach notification deadline while also lacking a valid privacy notice - result in cumulative fines.

A third scenario illustrates the enforcement risk: a mid-sized Russian retail company suffers a data breach affecting customer payment data. The company's IT team spends the first 24 hours investigating the scope of the breach before notifying anyone. By the time the notification is submitted to Roskomnadzor, the deadline has passed. Roskomnadzor opens an administrative case, imposes a fine for the late notification, and simultaneously initiates an inspection of the company's broader data protection practices. The inspection reveals that the company's consent forms are outdated and that cross-border transfers to a foreign payment processor were never notified. The cumulative fines and remediation costs substantially exceed what a proactive compliance programme would have cost.

We can help build a strategy for breach response and regulatory engagement with Roskomnadzor. Contact info@vlolawfirm.com.

A defensible data protection compliance programme in Russia rests on five operational pillars: documentation, consent management, localisation architecture, transfer governance, and incident response. Each pillar must be addressed in sequence, because gaps in earlier pillars undermine the effectiveness of later ones.

Documentation is the foundation. Article 18.1 of Federal Law No. 152-FZ requires operators to take measures to ensure compliance and to be able to demonstrate that compliance. This means maintaining a record of processing activities (реестр обработки персональных данных), internal policies, consent records, transfer agreements, and technical security documentation. Roskomnadzor inspectors will request these documents at the outset of any inspection. Operators who cannot produce them immediately are treated as non-compliant regardless of their actual practices.

Consent management requires a systematic audit of every data collection point - web forms, mobile applications, paper forms, verbal collection at points of sale - to verify that the consent obtained meets the current legal standard. Where consent is deficient, the operator must either re-obtain it or identify an alternative lawful basis. For operators with large existing customer databases, this is a significant operational exercise, but the risk of proceeding on invalid consent is greater.

Localisation architecture must be verified at the infrastructure level, not merely at the contractual level. The operator must be able to produce technical evidence - server logs, data flow diagrams, contracts with hosting providers - showing that initial processing occurs in Russia. Contractual representations from cloud providers are necessary but not sufficient.

Transfer governance requires a complete map of all data flows leaving Russia, including flows to parent companies, group service providers, SaaS platforms, and analytics tools. Each flow must be assessed against the Article 12 framework, and either a notification filed with Roskomnadzor or consent obtained from data subjects. Many operators discover during this exercise that they have dozens of undocumented transfer relationships.

Incident response planning must produce a written plan that assigns roles, sets internal escalation timelines shorter than the 24-hour notification deadline, and includes pre-drafted notification templates. The plan must be tested through tabletop exercises at least annually.

The business economics of compliance are straightforward. A proactive compliance programme for a mid-sized operator typically requires legal fees starting from the low thousands of USD for documentation and consent architecture work, plus IT costs for localisation and security measures. The cost of a Roskomnadzor inspection that reveals systemic non-compliance - including fines, remediation, potential website blocking, and reputational damage - is materially higher. The decision to invest in compliance is therefore not a legal formality but a risk management calculation.

Many underappreciate that compliance is not a one-time project. Russian data protection law has been amended repeatedly, and further amendments are anticipated. Operators who treat compliance as a project with a completion date, rather than an ongoing programme, consistently find themselves out of compliance within 12 to 18 months of their initial remediation effort.

To receive a checklist on building a data protection compliance programme for Russia, send a request to info@vlolawfirm.com.

What is the most significant practical risk for a foreign company processing data of Russian residents without a Russian legal entity?

The absence of a Russian legal entity does not exempt a company from the obligations of Federal Law No. 152-FZ. Roskomnadzor has the authority to block access to the company's website or application from within Russia without needing to serve process on the company abroad. The blocking mechanism operates through orders to Russian ISPs and can be executed within 24 hours of a court decision. For companies whose Russian user base represents a meaningful share of revenue, this is an immediate commercial risk. The practical response is to appoint a local representative, register as a personal data operator with Roskomnadzor, and implement localisation and consent measures before enforcement action begins.

How long does a Roskomnadzor inspection typically take, and what are the likely financial consequences of non-compliance?

A scheduled inspection typically runs for 20 working days, though this period can be extended in complex cases. An unscheduled inspection triggered by a complaint may proceed more quickly. The financial consequences depend on the number and type of violations identified. Under Article 13.11 of KoAP, fines for individual violations range from tens of thousands to several million roubles, and each distinct violation type generates a separate fine. Repeated violations attract higher fine bands. Beyond fines, operators may face orders to destroy unlawfully processed data, which can have significant operational consequences for businesses whose core product relies on that data.

When should an operator choose contractual safeguards over individual consent for cross-border transfers?

Individual consent is operationally simpler to implement but creates ongoing management obligations: consent must be obtained from each data subject, withdrawal must be honoured within 30 days, and the consent base must be refreshed when purposes change. For B2B operators or those transferring employee data within a corporate group, contractual safeguards - a data processing agreement that Roskomnadzor accepts as providing equivalent protection, combined with a pre-transfer notification - are generally more sustainable. The contractual route requires upfront legal work and a Roskomnadzor notification process, but it does not depend on the ongoing cooperation of individual data subjects. For consumer-facing operators with large and dynamic user bases, a hybrid approach is often most practical: contractual safeguards for systematic transfers to group entities, and consent for transfers to third-party processors.

Russia's data protection regime demands a structured, documented, and continuously maintained compliance programme from any operator handling personal data of Russian residents. The combination of localisation requirements, strict consent standards, cross-border transfer controls, and a 24-hour breach notification deadline creates a compliance environment that rewards preparation and penalises reactive approaches. The legal and commercial risks of non-compliance - administrative fines, website blocking, and reputational exposure - are concrete and enforceable. Operators who invest in a defensible compliance architecture reduce both their regulatory exposure and their operational vulnerability.

Our law firm VLO Law Firm has experience supporting clients in Russia on data protection and privacy matters. We can assist with compliance programme design, consent architecture review, cross-border transfer structuring, Roskomnadzor notification filings, and breach response. To receive a consultation, contact: info@vlolawfirm.com.