Federal Law on Personal Data (No. 152-FZ)

This law governs the processing of personal data by organizations in Russia. It includes provisions on data collection, storage, use, and disclosure, and mandates that personal data of Russian citizens must be stored on servers located within Russia.

JurisdictionRussia
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

The Federal Law on Personal Data (No. 152-FZ) imposes several key requirements on organizations processing personal data of Russian citizens:

  • Data Localization: Personal data of Russian citizens must be stored and processed using databases located within the territory of the Russian Federation[](https://www.gorodissky.com/publications/articles/data-protection-in-the-russian-federation-overview-2021/)
  • Consent: Organizations must obtain explicit consent from individuals before collecting and processing their personal data, except in cases stipulated by law[](https://secureprivacy.ai/blog/comprehensive-guide-russian-data-protection-law-152-fz)
  • Data Subject Rights: The law grants individuals rights to access, correct, and delete their personal data, as well as the right to withdraw consent[](https://www.gorodissky.com/publications/articles/data-protection-in-the-russian-federation-overview-2021/)
  • Security Measures: Organizations must implement appropriate technical and organizational measures to protect personal data from unauthorized access, destruction, modification, or disclosure[](https://incountry.com/blog/russian-data-protection-laws-essential-guide-on-compliance-requirements-in-russia/)
  • Data Processing Agreement: When using third-party data processors, organizations must have a written agreement specifying the scope and purpose of data processing[](https://secureprivacy.ai/blog/comprehensive-guide-russian-data-protection-law-152-fz)
  • Registration: Data operators must register with Roskomnadzor, the Russian data protection authority, before processing personal data[](https://www.cloud4y.ru/en/blog/152-fz-for-websites/)

Compliance Challenges

Organizations face several challenges when complying with Federal Law No. 152-FZ:

  • Data Localization: Many international companies struggle to set up local data storage infrastructure in Russia while maintaining their global operations[](https://incountry.com/blog/russian-data-protection-laws-essential-guide-on-compliance-requirements-in-russia/)
  • Consent Management: Obtaining and managing valid consent for various data processing activities can be complex, especially for organizations with large user bases[](https://secureprivacy.ai/blog/comprehensive-guide-russian-data-protection-law-152-fz)
  • Cross-border Data Transfers: Restrictions on transferring personal data outside of Russia can complicate international business operations[](https://www.gorodissky.com/publications/articles/data-protection-in-the-russian-federation-overview-2021/)
  • Regulatory Uncertainty: Frequent amendments and lack of clear guidance on certain aspects of the law create uncertainty for businesses[](https://incountry.com/blog/russian-data-protection-laws-essential-guide-on-compliance-requirements-in-russia/)

Implementation Best Practices

To implement Federal Law No. 152-FZ effectively, organizations should:

  • Conduct a thorough data audit to identify all personal data processing activities[](https://secureprivacy.ai/blog/comprehensive-guide-russian-data-protection-law-152-fz)
  • Implement a robust consent management system to obtain and track user consent[](https://secureprivacy.ai/blog/comprehensive-guide-russian-data-protection-law-152-fz)
  • Establish local data storage and processing capabilities in Russia, either through own infrastructure or trusted local partners[](https://incountry.com/blog/russian-data-protection-laws-essential-guide-on-compliance-requirements-in-russia/)
  • Develop and implement comprehensive data protection policies and procedures[](https://www.gorodissky.com/publications/articles/data-protection-in-the-russian-federation-overview-2021/)
  • Regularly train employees on data protection requirements and best practices[](https://secureprivacy.ai/blog/comprehensive-guide-russian-data-protection-law-152-fz)
  • Use encryption and other security measures to protect personal data[](https://incountry.com/blog/russian-data-protection-laws-essential-guide-on-compliance-requirements-in-russia/)

Recent Updates

Recent updates to Federal Law No. 152-FZ include:

  • 2022 Amendment: Introduced stricter rules for cross-border data transfers, requiring prior approval from Roskomnadzor for transfers to certain countries[](https://www.gorodissky.com/publications/articles/data-protection-in-the-russian-federation-overview-2021/)
  • 2021 Amendment: Expanded the definition of publicly available personal data and introduced new requirements for its processing[](https://secureprivacy.ai/blog/comprehensive-guide-russian-data-protection-law-152-fz)
  • 2020 Amendment: Increased fines for non-compliance and introduced new requirements for data breach notifications[](https://incountry.com/blog/russian-data-protection-laws-essential-guide-on-compliance-requirements-in-russia/)

Related Regulations

Federal Law No. 152-FZ interacts with several other Russian regulations:

  • Federal Law No. 149-FZ on Information, Information Technologies and Information Protection: Regulates the broader aspects of information handling and cybersecurity[](https://www.gorodissky.com/publications/articles/data-protection-in-the-russian-federation-overview-2021/)
  • Federal Law No. 242-FZ on Amendments to Certain Legislative Acts of the Russian Federation: Introduced the data localization requirement[](https://incountry.com/blog/russian-data-protection-laws-essential-guide-on-compliance-requirements-in-russia/)
  • GDPR: While not directly related, organizations dealing with both Russian and EU citizens' data must navigate compliance with both regulations[](https://secureprivacy.ai/blog/comprehensive-guide-russian-data-protection-law-152-fz)

Industry Impact

The law has had significant impacts across various industries:

  • Technology: Global tech companies have had to invest in local data centers or partner with Russian cloud providers to comply with data localization requirements[](https://incountry.com/blog/russian-data-protection-laws-essential-guide-on-compliance-requirements-in-russia/)
  • E-commerce: Online retailers have had to adapt their data collection and storage practices, particularly for customer information[](https://www.gorodissky.com/publications/articles/data-protection-in-the-russian-federation-overview-2021/)
  • Financial Services: Banks and fintech companies have faced challenges in balancing compliance with international financial regulations and Russian data protection laws[](https://secureprivacy.ai/blog/comprehensive-guide-russian-data-protection-law-152-fz)

Sources

Recent developments

  • — Overview of how the 2024–2025 amendments to 152‑FZ (Law No. 420‑FZ) are fully applying in 2026, including significantly tougher requirements for personal data processing, expanded scope of “operators,” and increased administrative and criminal liability for violations.[7] (source)
  • — Explanation of the new version of Article 18(5) of Law 152‑FZ in force from 1 July 2025, introducing an explicit ban on collecting personal data of Russian citizens using databases outside Russia and tightening localization obligations for both controllers and processors.[6] (source)
  • — Detailed analysis of Federal Law No. 23‑FZ amending 152‑FZ, which from 1 July 2025 replaces the previous “positive obligation” to use Russian databases with a **mandatory prohibition** on storing and processing Russian citizens’ data abroad, subject to limited exceptions.[4] (source)
  • — Industry-focused breakdown of the 2025 changes to 152‑FZ, including broadened definitions of personal and biometric data, mandatory use of Russian software where analogues exist, strict bans and controls on cross‑border transfers (especially to “unfriendly” states), and new registration and reporting duties to Roskomnadzor.[5] (source)
  • — Summary of Law No. 420‑FZ (effective 30 May 2025) that substantially increases fines under 152‑FZ for personal data violations up to 18 million RUB, signaling a regulatory crackdown and prompting companies to reassess compliance programs.[6] (source)
  • — Description of how the 30 May 2025 amendments under Law No. 420‑FZ toughen personal data rules, expand who is treated as an operator (including small businesses and self‑employed), and introduce much higher sanctions for data leaks, especially involving biometrics and minors.[7] (source)
  • — Practical guidance article for Russian businesses on avoiding million‑ruble fines under the updated 152‑FZ, highlighting operational impacts such as compulsory database localization, pre‑approval of cross‑border transfers by Roskomnadzor, and mandatory provision of anonymized data to a state information system from 1 September 2025.[5] (source)
  • — International practitioner guide updating the overview of 152‑FZ through the latest amendments (including 2023–2025 changes), noting higher fines, stricter consent and localization rules, and positioning Russia’s regime as increasingly stringent compared with other jurisdictions, affecting multinational data flows.[3] (source)
  • — Law firm commentary on the publication of Federal Law No. 23‑FZ on 28 February 2025, warning organizations that they must restructure data architectures and contracts ahead of the 1 July 2025 deadline due to the new absolute ban on using foreign databases for Russian citizens’ data.[4] (source)
  • — Industry reaction piece discussing business concerns and anticipated compliance costs from the 2025 tightening of 152‑FZ, including fears about mandatory transfer of anonymized datasets to the state, expanded rights such as a “right to be forgotten,” and heavy penalties for non‑compliance in digital marketing and online services sectors.[5] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates