Russia's Regulatory Landscape at a Glance
Russia's framework rests on Federal Law No. 152-FZ together with government and Roskomnadzor regulations, information security legislation, and specific rules on biometric data. Compliance is procedural as much as substantive: filings with Roskomnadzor, localisation of databases, and documented internal policies carry as much weight as the substantive processing principles.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and regulatory status.
- Jurisdiction
- Russia
- Primary data protection framework
- Federal Law No. 152-FZ on Personal Data (2006)
- Defining requirements
- Data localisation for Russian citizens' data and notification of cross-border transfers
Key Regulations in Russia
Federal Law No. 152-FZ on Personal Data
Law 152-FZ was enacted in 2006 and is Russia's principal data protection statute. It applies to operators processing personal data, and has been interpreted and amended to reach foreign entities whose processing targets individuals in Russia, including through websites directed at the Russian market.
The Law is consent-centric, with consent required to be specific, informed, and conscious, and with separate written consent required in defined cases.
Depending on applicability, organisations may need to address:
- Consent or another lawful basis enumerated in the Law.
- Separate consent for specified processing, including biometric data.
- Notification to Roskomnadzor before processing begins.
- Appointment of a person responsible for personal data processing.
- Internal policies and documents on personal data processing.
- Localisation of databases containing Russian citizens' personal data.
- Notification before transferring personal data abroad.
- Security measures and incident reporting.
Russian compliance is unusually document and filing driven, and Roskomnadzor inspections focus heavily on the existence and content of required internal documents.
Data Localisation
Since 2015, operators collecting personal data of Russian citizens have been required to record, systematise, accumulate, store, and update that data using databases located within Russia. Processing outside Russia is possible in addition, but the primary database must be in-country.
The requirement applies by reference to the citizenship of the data subject rather than to the operator's location, which is why it reaches foreign businesses serving Russian users.
Organisations assessing localisation may need to consider:
- Whether they collect personal data of Russian citizens.
- Which processing operations must be performed on the in-country database.
- The relationship between the Russian database and any foreign systems.
- Evidence available to demonstrate localisation to Roskomnadzor.
- Additional localisation rules for specific data types such as biometric data.
Localisation is assessed by reference to the data subject's citizenship, so it cannot be avoided by the operator being established outside Russia.
Notification Before Processing
Operators must generally notify Roskomnadzor of their intention to process personal data before beginning, providing prescribed particulars including the purposes, categories of data and data subjects, the legal basis, the security measures, the location of databases, and the person responsible.
The notification is entered into a public register of operators, and it must be updated when the particulars change. Exemptions are narrow.
Organisations assessing notification may need to consider:
- Whether any exemption from notification applies to their processing.
- The prescribed particulars, including database locations.
- Obligations to update the notification when particulars change.
- That the register of operators is publicly accessible.
- Consistency between the notification and published privacy policies.
Inconsistency between what is filed and what an organisation actually does is a common finding in Roskomnadzor inspections.
Cross-Border Transfer Notification
Since March 2023, an operator intending to transfer personal data abroad must notify Roskomnadzor before the first transfer, separately from the general processing notification, and must provide information about the recipient and the destination country.
Where the destination is not a party to the Council of Europe data protection convention or otherwise recognised as providing adequate protection, additional information is required and Roskomnadzor has power to restrict or prohibit the transfer.
Organisations transferring data abroad may need to consider:
- Filing the transfer notification before the first transfer.
- Whether the destination is recognised as providing adequate protection.
- Additional information required for other destinations.
- Roskomnadzor's power to restrict or prohibit a transfer.
- Separate consent requirements where consent is the basis for the transfer.
- That localisation obligations continue to apply regardless of the transfer.
The transfer notification is a distinct filing from the processing notification and is frequently overlooked by organisations that filed the latter years earlier.
Biometric and Special Categories
Biometric personal data is subject to a dedicated regime, including requirements for written consent and, under subsequent legislation, for processing through a state unified biometric system in defined circumstances. Special categories including racial or ethnic origin, political views, religious beliefs, health, and intimate life require written consent subject to exceptions.
Organisations processing these categories may need to consider:
- Written consent requirements and their prescribed content.
- Obligations relating to the state unified biometric system.
- Restrictions on commercial collection of biometric identifiers.
- Enhanced security requirements for special categories.
- Localisation requirements specific to biometric data.
The biometric regime has been amended repeatedly and is among the more volatile parts of Russian data law; confirm the current position before deploying biometric features.
Security, Incidents and Sectoral Rules
Operators must implement legal, organisational, and technical measures to protect personal data, with requirements specified by government regulation and by the technical regulator, including protection levels determined by threat models. Operators must notify Roskomnadzor of incidents involving unlawful transfer of personal data within short prescribed periods.
Information security legislation, critical information infrastructure rules, and sectoral requirements in banking, telecommunications, and health apply alongside.
Organisations in scope may need to consider:
- Determination of the applicable protection level and threat model.
- Use of certified information protection tools where required.
- Short reporting periods for incidents involving unlawful transfer.
- Critical information infrastructure obligations where designated.
- Sectoral requirements in banking, telecommunications, and health.
Incident reporting periods in Russia are short, measured in hours rather than days, and involve notifications to more than one body.
Who Needs to Comply With Russian Data Protection Law?
Law 152-FZ and related requirements may apply to:
Operators in Russia
Legal entities and individuals in Russia that organise or carry out the processing of personal data.
Foreign businesses targeting Russia
Organisations outside Russia whose processing targets individuals in Russia, including through Russian-language or Russia-directed services.
Organisations collecting citizens' data
Any operator collecting personal data of Russian citizens, which triggers the localisation requirement regardless of where the operator sits.
Processors acting on instructions
Entities processing on an operator's instructions, where the operator remains responsible and the arrangement must be documented.
Employers
Organisations handling employee data, where the Labour Code imposes additional requirements alongside 152-FZ.
Operators of biometric systems
Businesses using facial recognition or other biometric identification, subject to a dedicated and frequently amended regime.
The precise obligations depend on the organisation's role, processing activities, size, risk profile, and territorial scope.
Understanding Your Obligations Under 152-FZ
Consent and Lawful Basis
Processing generally requires the data subject's consent, which must be specific, informed, and conscious, and must be capable of being evidenced. The Law enumerates other bases, including performance of a contract to which the data subject is a party and compliance with a legal obligation, but they are narrower than in GDPR-style regimes.
Consent to processing cannot generally be bundled with consent to transfer abroad or to biometric processing; separate consents are required.
Internal Documents and Responsible Person
Operators must adopt a policy on personal data processing and publish it, maintain the internal documents the Law and regulations require, and appoint a person responsible for the organisation of personal data processing who reports to management.
Roskomnadzor inspections commonly begin with a request for these documents, so their existence and content matter in practice.
Notifications to Roskomnadzor
A notification of intention to process personal data must generally be filed before processing begins and kept current. A separate notification must be filed before the first cross-border transfer, with additional information where the destination is not recognised as providing adequate protection.
Data Localisation
Personal data of Russian citizens must be recorded, systematised, accumulated, stored, and updated using databases located in Russia. Foreign processing may occur in addition, but the in-country database must be the primary record.
Security and Protection Levels
Operators must determine the applicable level of protection based on the categories of data and the relevant threat model, and implement the organisational and technical measures prescribed, which in defined cases include the use of certified information protection tools.
Incident Notification
Operators must notify Roskomnadzor of incidents involving the unlawful transfer of personal data within short prescribed periods, with an initial notification followed by a further notification on the results of internal investigation.
The initial period is measured in hours, which is materially shorter than the seventy-two hour standard found elsewhere.
Data Subject Rights Under 152-FZ
Law 152-FZ gives data subjects a number of rights over their personal data. Depending on the circumstances, these may include:
Right to Information
Data subjects may obtain confirmation of processing and information about the purposes, legal basis, categories, and recipients.
Access
Data subjects may access their personal data held by an operator, subject to the restrictions in the Law.
Clarification and Correction
Data subjects may require personal data to be clarified, blocked, or destroyed where it is incomplete, outdated, inaccurate, or unlawfully obtained.
Withdrawal of Consent
Data subjects may withdraw consent, following which the operator must cease processing and destroy the data unless another basis applies.
Objection to Marketing
Data subjects may require processing for the purpose of promoting goods and services to cease.
Complaint and Court Action
Data subjects may complain to Roskomnadzor or apply to the courts, and may claim compensation for moral harm.
Response periods under 152-FZ are short, and the Law restricts access in defined circumstances including where it would affect the rights of third parties.
Russia's Regulatory Timeline
Russia's law dates from 2006 and has been tightened repeatedly since.
- July 2006
Law 152-FZ Enacted
Federal Law No. 152-FZ established Russia's personal data framework, with Roskomnadzor as the supervisory authority.
- September 2015
Localisation in Force
The requirement to store the personal data of Russian citizens on databases located in Russia took effect.
- March 2023
Transfer Notification Introduced
A separate obligation to notify Roskomnadzor before the first cross-border transfer took effect, with powers to restrict transfers.
- Recent
Penalties Substantially Increased
Administrative penalties for personal data leaks were substantially increased and criminal liability for unlawful use of personal data was introduced.
Important: the penalty regime was substantially revised recently, including turnover-linked fines for leaks and new criminal provisions. This page does not quote amounts; confirm current figures from official sources.
Data Protection Authorities in Russia
Roskomnadzor, the Federal Service for Supervision of Communications, Information Technology and Mass Media, is the supervisory authority for personal data. It maintains the public register of operators, receives processing and cross-border transfer notifications and incident reports, conducts inspections, issues orders, and initiates administrative proceedings. It also has powers to restrict access to resources that breach the Law.
Other bodies are significant in practice, including the technical regulator responsible for information protection requirements and certified tools, the security service in relation to certain security measures, the Central Bank for financial institutions, and the courts for compensation claims and certain sanctions.
Roskomnadzor's inspection practice is document-focused, so filings and internal policies carry disproportionate practical weight.
Penalties for Non-Compliance
Russia's sanctions sit mainly in the Code of Administrative Offences rather than in 152-FZ itself, and the regime was substantially revised recently. Distinct offences cover processing without a lawful basis, processing without the required consent in the prescribed form, failing to publish a personal data policy, failing to comply with localisation, failing to file required notifications, and failing to comply with a Roskomnadzor order, with separate and significantly higher penalties introduced for personal data leaks, including turnover-linked fines for repeat incidents.
Criminal liability has also been introduced for the unlawful use and transfer of personal data obtained unlawfully, with imprisonment available. Because the amounts and the precise scope of the recent amendments are the most volatile element of the regime, this page does not quote figures. Exposure should be assessed against current official sources, and the position should be treated as liable to further change.
How RegulatoryBridge Supports Compliance in Russia
RegulatoryBridge helps organisations assess Russia's regulatory requirements and coordinate their compliance activities with wider international programmes.
152-FZ Compliance Assessment
Review your processing activities, legal bases, notices, policies, governance arrangements, and operational controls to identify potential gaps.
Responsible Person and Filing Assessment
Review the person responsible for personal data processing that the Law requires, and the notifications that must be filed with Roskomnadzor before processing and before transfers abroad.
Data Subject Rights
Review request-handling processes, response timelines, privacy notices, and related documentation against the requirements applicable to you.
Breach Response and Roskomnadzor Notification
Evaluate breach assessment procedures, escalation responsibilities, Roskomnadzor notification readiness, and coordination between privacy, security, and legal teams.
International Data Transfers
Assess transfers abroad against the notification requirement and the distinction between countries providing adequate protection and those that do not.
Sectoral Compliance Coordination
Help organise requirements across 152-FZ, information security legislation, biometric data rules, and sectoral requirements.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, Roskomnadzor guidance, or enforcement decisions change.
The scope of support is tailored to the organisation's activities, risk profile, and applicable legal requirements.
Our Approach to Russia Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to Russia.
- 02
Map Regulatory Obligations
Identify applicable provisions, relevant authorities, effective dates, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions About Russia Compliance
Need Russian data protection support?
We support your Roskomnadzor notifications, localisation assessment, and incident reporting readiness - so your global product team doesn't have to.