Russia

Article 1(1.1) of Law 152-FZ, added in 2022, extends the law to foreign legal entities and foreign individuals processing Russian citizens' data on a contractual or consent basis. Article 22 requires a prior notification to Roskomnadzor before processing begins; the exemptions are narrow and no longer cover ordinary employee or customer data. Article 12(3) requires a separate prior notification before cross-border transfer. A second, harder threshold sits in Law 236-FZ of 1 July 2021, the so-called 'landing law': a foreign owner of a website, app or information system accessed by more than 500,000 users a day located in Russia must, if it also publishes in Russian, sells advertising to Russian consumers, processes data about users in Russia or takes money from Russian persons, publish a complaints form, open a personal account on the regulator's site, and establish a Russian branch, representative office or Russian company. Hosting providers, advertising system operators and internet messaging organisers are caught regardless of the user count once the regulator designates them.

Article 18(5) of Law 152-FZ was rewritten by Law 23-FZ of 28 February 2025 with effect from 1 July 2025. The old wording was a positive duty to 'ensure' the listed operations happen in databases located in Russia; the new wording prohibits carrying them out using databases located outside Russia, with exceptions only for processing required by an international treaty or statute, court and enforcement proceedings, the delivery of state and municipal services, and journalism, science and creative work. Sector overrides, each rated separately: payments and electronic money — data must stay in the country (Law 161-FZ bars sending information on any domestic transfer abroad or giving access from abroad); biometrics — data must stay in the country (Law 572-FZ requires databases located exclusively in Russia and bars foreign-controlled operators); telecoms — data must stay in the country (Law 126-FZ requires three years of call and connection records and up to six months of content to be stored on Russian territory); internet messaging and communication services — data must stay in the country (Law 149-FZ, raised from one year to three years on 1 April 2025); government and public sector — data must stay in the country (FSTEC Order 117, in force 1 March 2026, plus Presidential Decrees 166 and 250); critical infrastructure across banking, energy, health and transport — data must stay in the country in practice for software, since significant objects must run software from the Russian register from 1 September 2025; mapping and location data — data must stay in the country for state and municipal spatial data, and the Government holds an unused power to regulate any use of geospatial technology in Russia by foreign persons; health, insurance and securities — no separate residency rule found, checked 18 August 2026, so the national mirror rule and the general transfer regime apply, but health records are a special category with much higher leak penalties.

Article 12 of Law 152-FZ. The regulator approves the list of states providing adequate protection; the current list is Roskomnadzor Order No. 128 of 5 August 2022, in force since 1 March 2023 and still unamended as at 18 August 2026. It names roughly 56 states in two blocks: Council of Europe Convention 108 parties (all EU member states, the United Kingdom, Switzerland, Turkey, Ukraine and others) and non-parties assessed as adequate (China, India, Japan, South Korea, Canada, Australia, New Zealand, Brazil, Singapore, Belarus, Kazakhstan and others). The United States is absent from both blocks. Law 265-FZ of 26 July 2026, in force the day it was published, quietly removed the automatic recognition of Convention 108 parties from article 12 parts 5, 10 and 11: from that date only membership of the regulator's own list counts, and the regulator must positively assess that a country's rules match Convention 108. The list still names those countries, so nothing changed on the day — but the legal hook that guaranteed their place is gone, and the list can now be pruned by a single order. The regulator has ten working days from the notice to prohibit or restrict a transfer on grounds of morality, health or citizens' rights, and can prohibit a transfer at any time on constitutional-order, defence, economic or foreign-policy grounds on the proposal of the security, defence, economic or foreign ministries. If it does, you must make the foreign recipient destroy everything you already sent.

Roskomnadzor is the 'authorised body for the protection of the rights of personal data subjects' under article 23 of Law 152-FZ. Article 23.1 gives it federal state control powers including monitoring carried out without any interaction with the organisation being checked, so it does go looking. Its practical armoury grew sharply in 2025: the Code of Administrative Offences was rewritten by Law 420-FZ with effect from 30 May 2025 to add turnover-based fines for repeat data leaks, and the most serious personal data cases now go to a judge rather than being decided by officials, with an administrative investigation stage available. Separate criminal liability for data leaks took effect in December 2024. We rate enforcement 'active' rather than 'aggressive' on the evidence we could verify from official Russian sources during this run; Roskomnadzor's own website is not reachable from outside Russia, so its 2026 case volumes and fine totals could not be checked and this is listed as unconfirmed.

Ceilings: article 21 of Law 152-FZ. Unlawful processing that cannot be made lawful must be stopped within three working days and the data destroyed within ten working days. Purpose achieved, or consent withdrawn: destroy within 30 days. If destruction is technically impossible in that window you must block the data and destroy it within six months. The regulator sets the rules for evidencing destruction. Floors: personnel records closed after 1 January 2003 must be kept 50 years and those closed before that date 75 years, under article 22.1 of the Archives Law 125-FZ — an obligation that survives an employee's deletion request. Telecoms operators keep three years of call and connection records and up to six months of message content on Russian territory. Internet communication service organisers keep the same content period and, since 1 April 2025, three years of metadata rather than one. Accounting and tax records carry their own five-year minimums under the accounting and tax legislation, which we did not verify line by line during this run.

Article 21(3.1) of Law 152-FZ sets the 24-hour and 72-hour clocks, and they start when the incident is identified by you, by the regulator, or by any other interested person — not when you decide it is serious. The 24-hour report must cover what happened, the suspected cause, the harm expected, what you have done about it, and the named person who will deal with the regulator. Article 19(12) separately requires operators to interact with the state system for detecting, preventing and eliminating the consequences of computer attacks, run by the Federal Security Service, and to inform it of computer incidents that caused an unlawful transfer of personal data. Operators of significant critical infrastructure must maintain continuous interaction with that system under the Critical Information Infrastructure Law as amended from 1 September 2025. Failing to notify the data regulator is penalised under article 13.11 part 11 of the Code of Administrative Offences: 1 to 3 million roubles for a company.

(1) Article 272.1 of the Criminal Code, added by Law 421-FZ of 30 November 2024 and in force since December 2024, criminalises using, transferring, collecting or storing computer information containing personal data obtained unlawfully. Part 4 adds up to eight years' imprisonment and a fine of up to 2 million roubles where the act involves cross-border transfer of that data or physically carrying storage media in or out of Russia. Part 6 criminalises running a website or system designed to store or distribute leaked personal data. (2) Article 13.11 parts 15 and 18 of the Code of Administrative Offences, in force since 30 May 2025, impose 1 to 3 percent of the previous calendar year's total revenue from all goods and services, with a floor of 20 million roubles and a ceiling of 500 million roubles, about $6.2 million, for a second leak. Individual entrepreneurs are punished as companies. (3) The 50-year and 75-year personnel retention rules in the Archives Law sit directly against the 30-day destruction duty in the Personal Data Law. (4) Law 572-FZ bars accreditation of any organisation that is a foreign legal entity or has more than 49 percent foreign ownership, and requires biometric data and biometric vectors to be processed using databases located exclusively in Russia. (5) Article 14.8 part 8 of the Code of Administrative Offences fines a company 200,000 to 500,000 roubles for refusing to enter into, perform, change or terminate a consumer contract because the consumer refused biometric identification.

Dated: article 2 of Law 265-FZ of 26 July 2026 commences on 1 September 2027 and lets the Mayor of Moscow order city bodies, municipal bodies and organisations performing publicly significant functions in Moscow onto a common technology platform. The same law lets the Government relax the Russian-software requirement for significant critical infrastructure until 2030 in regions designated by the President, so the rule may soften geographically rather than nationally. Dormant switches, in order of how much damage they can do: (1) article 12(2) as amended on 26 July 2026 — the regulator alone decides which countries are adequate, and Convention 108 membership no longer guarantees a place; a single order could remove the European Union and the United Kingdom overnight. (2) Article 12(12) — the regulator must ban or restrict a transfer within five working days of a proposal from the security service, the defence ministry, the economic authorities or the foreign ministry, and you must then make the recipient destroy everything already sent. (3) Article 23(6) of the geodesy law — the Government has an unexercised power to set the terms on which foreign states, foreign companies, foreign individuals, Russian dual nationals and their affiliates may use any geospatial technology in Russia. (4) Article 12(15) — the Government may exempt some public-sector transfers from the notification regime, which tells you the regime is expected to bind everyone else.