Russia. Data localisation / cross-border. Federal law (amending)
242-FZ (localisation)Federal Law No. 242-FZ of 21 July 2014 (data localisation amendments to 152-FZ Art. 18(5)), as tightened by the February 2025 amendment
Partly verified
Medium confidence.2025 amending law believed to be 23-FZ of 28 Feb 2025; number not confirmed by sources consulted.
§1Summary
- Synopsis
Requires operators to record, systematise, store and update personal data of Russian citizens in databases located in Russia. From July 2025 the rule was tightened so that processing via foreign databases is generally prohibited, not only primary collection abroad.
- Key themes
- Unique features
One of the strictest localisation rules globally; enforced through registry of violators and blocking (e.g. LinkedIn 2016).
- SaaS relevance
A foreign SaaS provider collecting data from people in Russia must host the primary database in Russia; from July 2025 even mirrored foreign processing is restricted.
§2Obligations
- Extraterritorial
- Yes
- Cross-border transfers
- Localisation of Russian citizens' data
- Maximum penalty
- RUB 1–6m for legal entities; RUB 6–18m for repeat violations; blocking
§3Dates
- Key dates
- Adopted
- In force
- Localisation duty from 2015-09-01; amendment signed/published 2025-02-28 effective 2025-07-01 banning processing of Russian citizens' data using databases located abroad (subject to exceptions)
§4Text and authority
- Text
- Authoritative text pravo.gov.ru
- Authority
- Roskomnadzor
§5Where it applies
- Domestic law of
- Russia
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.2025 amending law believed to be 23-FZ of 28 Feb 2025; number not confirmed by sources consulted.