Russia. Comprehensive data protection. Act

152-FZFederal Law No. 152-FZ of 27 July 2006 'On Personal Data'

In force

Partly verified

Medium confidence. Russia is no longer a CoE member (expelled 2022) and denounced Convention 108. Details of 2022/2023 amendment law numbers from prior knowledge.

§1Summary

Synopsis

Russia's main personal data law, requiring a legal basis (often written consent), Roskomnadzor notification of processing, data localisation for Russian citizens, breach reporting and prior notification of cross-border transfers. Since May 2025, leaks carry heavy fines including turnover-based fines for repeat offences.

Key themes

consent
operator notification
localisation
breach notification
cross-border notification
DPO
turnover fines

Unique features

Mandatory local storage of Russian citizens' data; 24-hour initial breach notice to Roskomnadzor; transfer notifications with Roskomnadzor power to block; repeat leaks fined at 1–3% of revenue (RUB 20m–500m).

SaaS relevance

Foreign SaaS providers targeting Russian users (e.g. Russian-language sites, ruble payments) are expected to localise and register; non-compliance risks blocking and fines.

§2Obligations

Extraterritorial: Yes
Breach notification: Roskomnadzor within 24h (initial) and 72h (investigation results)
DPO: Yes
Cross-border transfers: Prior notification to Roskomnadzor; adequacy list; approval for non-adequate countries
Maximum penalty: Leaks: up to RUB 15–20m per incident; repeat leaks 1–3% of revenue (min RUB 20m, max RUB 500m); criminal liability for illegal data trafficking

§3Dates

Key dates

Adopted 27 July 2006
In force 26 January 2007
Breach notification (24h/72h) from 2022-09-01 (266-FZ); cross-border transfer notification regime from 2023-03-01; turnover-based fines via 420-FZ (30 Nov 2024) effective 2025-05-30; strengthened localisation from 2025-07-01

§4Text and authority

Text

Authoritative text pravo.gov.ru

Authority

Roskomnadzor (Federal Service for Supervision of Communications, IT and Mass Media)

§5Where it applies

Domestic law of: Russia

§6Sources and verification

Sources consulted

storage.delret.ru

Verification

Medium confidence.

Partly verified

Medium confidence. Russia is no longer a CoE member (expelled 2022) and denounced Convention 108. Details of 2022/2023 amendment law numbers from prior knowledge.