Personal Data Protection in Russia

Any business that collects data about people in Russia must follow Federal Law 152-FZ "On Personal Data". This applies to foreign companies too, if they target Russian users through a website, app or sales office. The core duties are to have a lawful basis such as consent, to store data of Russian citizens initially in databases located in Russia, and to notify Roskomnadzor before processing.

Attorney Elena Petrova helps US companies and startups assess whether the Russian law reaches them and build a compliance set that fits their product.

What 152-FZ Covers

Personal data means any information relating to an identified or identifiable person: name, phone, email, IP address combined with other data, photos. The company deciding why and how data is processed is the operator. A contractor processing data on the operator's instructions acts under a written assignment that must list security measures.

Special categories, such as health data, political views and religious beliefs, may be processed only in limited cases. Biometric data, including face images used for identification, carries its own strict rules and state systems.

Consent and Other Lawful Grounds

Consent is one of several grounds. Others include performance of a contract with the person and compliance with a legal duty. Consent must be specific, informed and freely given. A pre-ticked box or consent buried in general terms is a common error that regulators flag.

Data the person allows to be published, for example on a public profile, requires a separate consent for dissemination. Written consent on paper or with an electronic signature is needed for special and biometric data.

Localization of Russian Citizens' Data

When collecting data of Russian citizens, including online, the operator must record, organise, accumulate and store it using databases located in Russia. Copies can later be transferred abroad, but the primary database stays in Russia. The rule applies regardless of where the operator is registered.

For a US company this usually means a Russian hosting provider for the primary database and a documented synchronisation scheme. Each cross-border transfer must be notified to Roskomnadzor in advance.

Duties Towards Roskomnadzor

Roskomnadzor keeps a public register of operators, and missing from it is often the first thing an inspection notices.

Enforcement and Liability

Violations are punished under the Code of Administrative Offences. Fines depend on the breach: processing without a ground, missing policy, failure to localise, failure to notify. Since 2025 data leaks carry much higher fines, and repeated leaks may lead to fines calculated from turnover.

Roskomnadzor can also restrict access to a website that breaks the localization rule. Illegal trade in personal data has been made a separate criminal offence.

Building a Compliance Programme

A working programme starts with a data map: what data you collect, where it goes and on what ground. From there, the company adopts a public privacy policy, internal rules and consent texts. It also appoints a person responsible for processing and sets retention periods with destruction procedures.

Technical measures must match the threat level defined by government regulations. Staff with access to data should sign confidentiality undertakings and receive training.

Getting Help With Russian Data Rules

We review your product, map data flows and tell you in plain English which rules apply. Then we draft the policy, consents and Roskomnadzor notices and help plan localization. If an inspection or incident has already happened, we prepare the response and represent you.

The main channel of communication with the attorney is email: attorneypetrova1@gmail.com.