Russia

Article 1(1.1) of Law 152-FZ was added in 2022. It extends the law to foreign companies and foreign individuals handling Russian citizens' data under a contract or with consent. Article 22 requires you to notify Roskomnadzor before you start. The exemptions are narrow and no longer cover ordinary employee or customer data. Article 12(3) requires a separate notice before data goes abroad. A second, harder threshold sits in Law 236-FZ of 1 July 2021, the so-called 'landing law'. It covers a foreign owner of a website, app or information system used by more than 500,000 people a day in Russia. It applies if that owner also does one of four things. Publishes in Russian. Sells advertising to Russian consumers. Handles data about users in Russia. Or takes money from Russian persons. Such an owner must publish a complaints form. It must open a personal account on the regulator's site. And it must set up a Russian branch, representative office or Russian company. Hosting providers, advertising system operators and internet messaging organisers are caught whatever their user count, once the regulator names them.

Article 18(5) of Law 152-FZ was rewritten by Law 23-FZ of 28 February 2025, with effect from 1 July 2025. The old wording was a positive duty. You had to 'ensure' the listed steps happened in databases located in Russia. The new wording bans carrying them out using databases located outside Russia. There are only four exceptions. They are work required by an international treaty or statute, court and enforcement proceedings, delivering state and municipal services, and journalism, science and creative work. Industry exceptions, each rated separately. Payments and electronic money: data must stay in the country Law 161-FZ bars sending information on any domestic transfer abroad, or giving access to it from abroad. Biometrics: data must stay in the country Law 572-FZ requires databases located only in Russia and bars foreign-controlled operators. Telecoms: data must stay in the country Law 126-FZ requires three years of call and connection records, and up to six months of content, to be stored on Russian territory. Internet messaging and communication services: data must stay in the country Law 149-FZ applies. The period was raised from one year to three years on 1 April 2025. Government and public sector: data must stay in the country FSTEC Order 117 applies from 1 March 2026, alongside Presidential Decrees 166 and 250. Critical infrastructure across banking, energy, health and transport: data must stay in the country for software. Significant objects must run software from the Russian register from 1 September 2025. Mapping and location data: data must stay in the country for state and municipal spatial data. The Government also holds an unused power to regulate any use of geospatial technology in Russia by foreign persons. Health, insurance and securities: we found no separate rule about where the data must sit, checked 18 August 2026. So the national copy-in-Russia rule and the general transfer rules apply. But health records are a special category, with much higher penalties for leaks.

Article 12 of Law 152-FZ governs this. The regulator approves the list of states that protect data well enough. The current list is Roskomnadzor Order No. 128 of 5 August 2022. It has been in force since 1 March 2023 and was still unchanged on 18 August 2026. It names roughly 56 states in two blocks. The first block is the parties to Council of Europe Convention 108. That covers all European Union member states, the United Kingdom, Switzerland, Turkey, Ukraine and others. The second block is non-parties judged to protect data well enough. That covers China, India, Japan, South Korea, Canada, Australia, New Zealand, Brazil, Singapore, Belarus, Kazakhstan and others. The United States is in neither block. Law 265-FZ of 26 July 2026 came into force the day it was published. It quietly removed the automatic recognition of Convention 108 parties from article 12 parts 5, 10 and 11. From that date, only being on the regulator's own list counts. The regulator must positively decide that a country's rules match Convention 108. The list still names those countries, so nothing changed on the day. But the legal hook that guaranteed their place is gone. The list can now be cut back by a single order. The regulator has ten working days from your notice to ban or restrict a transfer. The grounds there are morality, health or citizens' rights. It can also ban a transfer at any time on grounds of the constitutional order, defence, the economy or foreign policy. That happens on a proposal from the security, defence, economic or foreign ministries. If it does ban one, you must make the foreign recipient destroy everything you already sent.

Article 23 of Law 152-FZ names Roskomnadzor as the body that protects the rights of the people whose data is used. Article 23.1 gives it federal state control powers. Those include monitoring done with no contact at all with the organisation being checked. So it does go looking. Its powers grew sharply in 2025. Law 420-FZ rewrote the Code of Administrative Offences with effect from 30 May 2025. It added fines based on turnover for repeat data leaks. The most serious personal data cases now go to a judge, rather than being decided by officials. An investigation stage is also available. Separate criminal liability for data leaks took effect in December 2024. We rate enforcement 'active' rather than 'aggressive', on the evidence we could verify from official Russian sources. Roskomnadzor's own website cannot be reached from outside Russia. So we could not check its 2026 case volumes and fine totals. That is listed as unconfirmed.

Maximums: article 21 of Law 152-FZ. If you are using data unlawfully and cannot make it lawful, you must stop within three working days. You must then destroy the data within ten working days. If the purpose is achieved, or consent is withdrawn, destroy within 30 days. If destroying it is technically impossible in that window, you must block the data and destroy it within six months. The regulator sets the rules for proving destruction. Minimums. Personnel records closed after 1 January 2003 must be kept 50 years. Those closed before that date must be kept 75 years. That comes from article 22.1 of the Archives Law 125-FZ. It survives an employee's deletion request. Telecoms operators keep three years of call and connection records, and up to six months of message content, on Russian territory. Internet communication service organisers keep the same content period. Since 1 April 2025 they keep three years of records about those messages, rather than one. Accounting and tax records carry their own five-year minimums under accounting and tax law. We did not check those line by line.

Article 21(3.1) of Law 152-FZ sets the 24-hour and 72-hour clocks. They start when the incident is identified. That can be by you, by the regulator, or by any other interested person. They do not start when you decide it is serious. The 24-hour report must cover what happened and the suspected cause. It must also cover the harm expected, what you have done about it, and the named person who will deal with the regulator. Article 19(12) adds a separate duty. You must interact with the state system for detecting, preventing and dealing with computer attacks. The Federal Security Service runs it. You must tell it about computer incidents that caused an unlawful transfer of personal data. Operators of significant critical infrastructure must keep continuous contact with that system. That comes from the Critical Information Infrastructure Law as amended from 1 September 2025. Failing to tell the data regulator is penalised under article 13.11 part 11 of the Code of Administrative Offences. For a company that is 1 to 3 million roubles.

(1) Article 272.1 of the Criminal Code was added by Law 421-FZ of 30 November 2024 and took effect in December 2024. It makes it a crime to use, transfer, collect or store computer information containing personal data obtained unlawfully. Part 4 adds up to eight years in prison and a fine of up to 2 million roubles. That applies where the act involves sending that data across the border. It also applies to physically carrying storage media in or out of Russia. Part 6 makes it a crime to run a website or system designed to store or spread leaked personal data. (2) Article 13.11 parts 15 and 18 of the Code of Administrative Offences have been in force since 30 May 2025. For a second leak they impose 1 to 3 percent of the previous calendar year's total revenue from all goods and services. The minimum is 20 million roubles. The maximum is 500 million roubles, about $6.2 million. Individual entrepreneurs are punished as companies. (3) The 50-year and 75-year staff record rules in the Archives Law sit directly against the 30-day destruction duty in the Personal Data Law. (4) Law 572-FZ bars accreditation of any organisation that is a foreign company, or is more than 49 percent foreign-owned. It also requires biometric data and biometric vectors to be handled using databases located only in Russia. (5) Article 14.8 part 8 of the Code of Administrative Offences fines a company 200,000 to 500,000 roubles. That is for refusing to enter into, perform, change or end a consumer contract because the consumer refused biometric identification.

Dated. Article 2 of Law 265-FZ of 26 July 2026 starts on 1 September 2027. It lets the Mayor of Moscow order city bodies, municipal bodies and organisations doing publicly significant work onto a common technology platform. The same law lets the Government relax the Russian-software requirement for significant critical infrastructure until 2030. That relaxation applies in regions the President names. So the rule may soften in places rather than nationally. Powers that already exist and can be used at any time, in order of how much damage they can do. (1) Article 12(2), as amended on 26 July 2026. The regulator alone decides which countries protect data well enough. Convention 108 membership no longer guarantees a place. A single order could remove the European Union and the United Kingdom overnight. (2) Article 12(12). The security service, the defence ministry, the economic authorities or the foreign ministry can propose a ban. The regulator must then ban or restrict the transfer within five working days. You must then make the recipient destroy everything already sent. (3) Article 23(6) of the geodesy law. The Government has an unused power here. It can set the terms on which foreign states, foreign companies, foreign individuals, Russian dual nationals and their affiliates may use any geospatial technology in Russia. (4) Article 12(15). The Government may excuse some public-sector transfers from the notice duty. That tells you the notice duty is expected to bind everyone else.