Federal Law on Personal Data (No. 152-FZ)

· About Federal Law on Personal Data (No. 152-FZ)

Key Takeaways

  • Federal Law No. 152-FZ applies to operators processing personal data in Russia, including foreign companies that collect Russian citizens’ data, and it now requires Russian-citizen data collected online to be recorded and stored in databases located in Russia.[10][1]
  • The localization rule was tightened by Federal Law No. 23-FZ, which took effect on 1 July 2025 and prohibits recording, systematization, accumulation, storage, updating, and retrieval of Russian citizens’ personal data using databases outside Russia when the data are first collected.[1][4]
  • From 30 May 2025, administrative liability increased materially for violations such as unlawful processing, missing consent, and failure to notify the data authority, with fines now reaching the hundreds of thousands of rubles for individuals and much higher amounts for companies in aggravating cases.[11][15]
  • From 1 September 2025, consent wording must be kept separate from other contractual or business clauses, and controllers may not hide consent inside unrelated documents.[12]
  • Cross-border transfer rules changed again in 2026: Federal Law No. 265-FZ amended Article 12, and Roskomnadzor’s authority to approve “adequate” countries is now tied to international criteria and an official order-based list.[7][10]
  • The law is enforced by Roskomnadzor, Russia’s communications and data protection regulator, which can impose administrative sanctions and order corrective action.[7][10]

What It Is

Federal Law No. 152-FZ of 27 July 2006 is Russia’s core personal data statute, governing collection, recording, storage, use, disclosure, transfer, and destruction of personal data processed by operators in Russia and, in practice, by entities outside Russia that target Russian residents or process their data in the Russian market.[10]

The primary enforcement body is the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), which oversees compliance, receives certain notices, and applies administrative measures under the personal data regime.[7][10]

The law has been amended repeatedly, with notable recent changes including Federal Law No. 23-FZ published on 28 February 2025 and effective from 1 July 2025, and Federal Law No. 265-FZ of 26 July 2026, which amended cross-border transfer rules under Article 12.[1][7][10]

Key phase-in milestones that matter today are 1 July 2025 for the tightened localization wording, 30 May 2025 for new or increased liability provisions, 1 September 2025 for the standalone-consent requirement, and 26 July 2026 for the latest cross-border transfer amendments reflected in the official text.[1][10][11][12]

Who Must Comply

The law applies to operators that organize or carry out personal data processing, including Russian companies, branches and representative offices, and foreign entities that process personal data in connection with goods, services, or monitoring of individuals in Russia.[10]

For the localization rule, the practical threshold is not a revenue or employee count; it is whether an operator collects personal data of Russian citizens and uses databases located outside Russia for initial recording or core processing activities covered by Article 18(5).[1][10]

The law generally does not contain a broad “small business” exemption from its main obligations, although specific procedural duties, sectoral rules, or limited statutory exceptions may apply depending on the type of processing and legal basis.[10]

Exemptions are narrow and tied to statutory grounds in Article 6 and special regimes, including cases where processing is necessary for the fulfillment of a contract, legal duty, judicial acts, or other enumerated grounds rather than general consent.[1][10]

The cross-border transfer regime now also depends on whether the receiving state is treated as providing adequate protection under the amended Article 12 and Roskomnadzor’s current list and criteria.[7][10]

Core Requirements

  1. Lawful basis and purpose limitation — Personal data may be processed only on a statutory basis and for specific, predefined purposes; operators must be able to show why each category of data is collected and why processing is necessary.[10]
  2. Localization for Russian citizens’ data — When collecting personal data of Russian citizens, including via the internet, operators must initially record, systematize, accumulate, store, update, and retrieve that data using databases located in Russia, subject only to the statutory exceptions listed in the law.[1][10]
  3. Separate and valid consent where required — Where consent is the legal basis, it must be specific, informed, and now kept distinct from other text; from 1 September 2025, it cannot be bundled into unrelated agreements or clauses.[12]
  4. Transparency duties — Operators must publish required policies and provide data subjects with prescribed information about processing, including who the operator is, what data are processed, for what purpose, and under what legal basis.[11][10]
  5. Security and confidentiality — Operators must implement organizational and technical measures to protect personal data from unlawful or accidental access, alteration, blocking, copying, distribution, or destruction, and must restrict access on a need-to-know basis.[10]
  6. Cross-border transfer controls — Transfers abroad must comply with Article 12, including the updated adequacy framework and any required approvals, notices, or restrictions, and operators must stop or limit transfers if Roskomnadzor imposes a restriction or prohibition.[7][10]
  7. Deletion and retention discipline — Data must not be retained longer than necessary for the stated purpose, and unlawful or no-longer-needed data must be destroyed or anonymized in line with the law and any regulator order.[10]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Localization amendment effective | 1 July 2025 | Tighter Article 18(5) wording for Russian citizens’ data collected online and initial processing in Russia[1][4] | | Consent-clause restriction effective | 1 September 2025 | Consent may not be embedded in unrelated documents or contractual clauses[12] | | Latest cross-border transfer amendment | 26 July 2026 | Amended Article 12 framework for adequacy and transfer controls[10] |

Maximum fines and other sanctions depend on the specific offence and whether it is repeated, but recent 2025 amendments materially raised exposure. For common administrative violations, reported ranges include up to ₽300,000 for not notifying Roskomnadzor about processing, up to ₽700,000 for processing without the required form of consent, and higher repeat-offence amounts that can reach ₽1 million to ₽1.5 million in cited summaries of the current sanctions schedule.[11][15]

The official legal text also leaves room for additional enforcement measures, including orders to cease unlawful processing, delete unlawfully obtained data, or restrict transfers, and related administrative or criminal exposure may arise under other Russian laws in serious cases.[10][15]

How to Comply

  1. Map your data flows — Identify every collection point for Russian personal data, including websites, apps, CRM, HR, analytics, and vendors, then document the legal basis and purpose for each flow.
  2. Localize the first-stage database — Ensure the initial record, storage, and core processing of Russian citizens’ data occur in Russia before any onward replication, backup, or downstream processing outside Russia.
  3. Separate consent artifacts — Review forms, website checkboxes, employment documents, and service terms so that any consent is standalone, specific, and not bundled with unrelated language.
  4. Harden security controls — Use an ISO 27001-aligned information security management system for access control, logging, encryption, vendor oversight, incident response, and risk treatment.
  5. Build governance against NIST CSF 2.0 — Use the Identify, Protect, Detect, Respond, and Recover functions to structure control ownership, monitoring, and incident handling for personal data incidents.
  6. Add AI and automation governance where relevant — If AI systems process personal data, map them to ISO 42001 controls for policy, risk assessment, lifecycle governance, and human oversight.
  7. Refresh cross-border transfer procedures — Reassess vendor countries, transfer mechanisms, and internal approvals against the amended Article 12 and Roskomnadzor’s current adequacy approach.
  8. Train and test regularly — Train HR, marketing, product, and security teams on lawful basis, localization, breach escalation, and deletion, and run periodic audits and tabletop exercises.

Related Regulations

  • EU GDPR overlaps on lawful basis, transparency, security, and international transfers, but its rules are structurally different and can conflict with Russian localization and transfer limits.
  • Russia’s Federal Law No. 242-FZ is the key localization amendment history for Russian citizen data and is essential context for interpreting Article 18(5).
  • Russia’s administrative code provisions on personal data offences drive the practical fine exposure, especially after the 2025 penalty increases.
  • Russia’s sectoral data secrecy laws, including telecom and state-secrets rules where relevant, can impose stricter handling obligations than 152-FZ alone.
  • The Russian AI and experimental-regime rules may overlap where automated systems collect or infer personal data, but they do not displace 152-FZ’s baseline obligations.

FAQ

Does 152-FZ apply to companies outside Russia?

Yes. Foreign companies can fall under 152-FZ if they collect or process personal data of individuals in Russia, especially when offering goods or services or monitoring behavior in the Russian market.[10] The practical test is whether the processing is connected to Russian subjects and falls within the statute’s territorial reach.

Does the law require personal data to stay in Russia?

For Russian citizens’ personal data collected online, the law requires the initial recording, systematization, accumulation, storage, updating, and retrieval to use databases located in Russia.[1][10] Later cross-border transfer may still be possible if Article 12 conditions are met, but the first-stage localization rule must be satisfied.

What changed in 2025?

Three changes stand out: tighter localization language effective 1 July 2025, higher administrative penalties effective 30 May 2025, and a new rule from 1 September 2025 that keeps consent separate from other documents.[1][11][12] Those changes significantly increased compliance risk for websites, SaaS providers, employers, and adtech operators.

Who enforces 152-FZ?

Roskomnadzor is the main regulator overseeing personal data compliance and cross-border transfer controls.[7][10] It can investigate, require corrective action, and trigger administrative liability through the Russian enforcement system.

Are cross-border transfers still allowed?

Yes, but the regime is stricter and has changed again in 2026.[7][10] Operators need to check whether the destination state is treated as adequate under the current framework, whether any notice or restriction applies, and whether Roskomnadzor has imposed limits on the specific transfer.

Sources

Put it into practice

More compliance guides