Personal data protection

Legal and regulatory framework

Federal Law No. 152-FZ “On Personal Data” (the “Data Protection Law”) was adopted in July 2006. A number of its provisions are based on the 1981 Strasbourg Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (the “Strasbourg Convention”) that Russia signed on 7 November 2001.

The Data Protection Law provides a framework that is complemented by a number of regulations of the Russian Government and governmental authorities as well as certain provisions of Russian labour and administrative law.

Key developments

In 2015, the Data Protection Law was amended with a personal data localisation requirement, according to which personal data of Russian citizens must be stored on servers physically located in Russia. In 2019, significant fines for violation of this requirement were introduced in addition to the previous sanctions which include blocking access to the infringer’s website.

In 2017, administrative fines for violation of personal data law requirements were substantially increased.

In 2018, Russia signed an Amending Protocol updating the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data. The national data protection law is expected to be amended in order to comply with this Protocol. For example, an obligation on data controllers to notify the data protection authority and data subjects of any personal data breach, as well as the concept of genetic data as a new category of sensitive personal data, should be introduced in Russian law. At this stage, the law ratifying the Amending Protocol has not yet been adopted.

Supervisory authority

The authority in charge of personal data protection in Russia is the Federal Service for Supervision of Communications, Information Technology and Mass Media (“Roskomnadzor”).