Russia Data Protection & Privacy Regulation

Lawful Processing & Special Data

The 2022 amendments under Federal Law No. 266-FZ are reported to have eliminated bundled or pre-checked consent in Russian data-protection practice: each processing purpose now understood to require a separate, affirmative act by the data subject, rather than a single blanket consent covering multiple purposes. Distribution of personal data to an unlimited audience is reported to require separately and specifically obtained consent, distinct from consent to processing generally. This consent architecture is broadly comparable in structure to purpose-specific consent requirements found in GDPR-style regimes, though the Russian statute operates under its own enforcement and definitional framework. No primary statutory text was directly retrieved this cycle to confirm the precise wording of the affirmative-act standard; the claim rests on secondary legal-summary sourcing, and confidence is accordingly held at Uncertain.

Outlook

Whether Roskomnadzor issues implementing guidance further specifying what constitutes a valid separate affirmative act for consent purposes is the development to watch for this module.

Controller/Processor Duties

Data operators in Russia are reported to face a 24-hour breach-notification duty to Roskomnadzor, running from the point of detection of a personal-data-security incident, under the Federal Law No. 266-FZ amendment framework. A fuller follow-up notification addressing causes, harm and mitigation measures is understood to be required after the initial 24-hour notification. This is a materially shorter initial window than the 72-hour standard found in GDPR-style regimes, and represents one of the more distinctive compliance burdens facing controllers and processors operating in the Russian market. No primary statutory or Roskomnadzor-issued guidance text was directly retrieved this cycle confirming the exact mechanics of the follow-up notification; the claim rests on secondary legal-summary sourcing, and confidence is held at Uncertain.

Outlook

Whether Roskomnadzor publishes operational guidance detailing the follow-up notification's required content and format is the item to watch for this module.

Cross-Border & Adequacy

Russia's cross-border data-transfer regime tightened materially this cycle through Federal Law No. 23-FZ, which recast the mandatory data-localisation requirement for Russian citizens' personal data with higher penalties, effective 1 July 2025: RUB 1-6 million for a first offence and RUB 6-18 million for a repeat offence by a legal entity, with website-blocking available as an additional sanction. This recast sits on top of, rather than replacing, the long-standing notify-and-wait transfer-approval model under Article 12 of Federal Law No. 152-FZ, under which a data controller must notify Roskomnadzor before conducting a cross-border personal-data transfer, specifying the destination country, lawful basis, purpose and categories of data involved; Roskomnadzor retains the power to prohibit the transfer within ten business days of notification. The 34-state adequacy list maintained under Order No. 128 continues to operate alongside this notify-and-wait requirement, meaning even a transfer to a listed adequate jurisdiction remains subject to the prior-notification obligation.

The combined effect of these two instruments is a transfer-control model considerably more restrictive in practice than an adequacy-only framework: localisation is mandatory and now carries escalated penalties, and any transfer that does occur is gated by a notify-and-wait mechanism rather than relying solely on destination-country assessment. For a controller already localising Russian citizens' data domestically, as required since the data-localisation rules took effect, the immediate practical consequence of this cycle's development is a sharply higher downside if localisation is breached, rather than a change to the transfer-notification mechanics themselves.

Outlook

Whether Roskomnadzor brings an enforcement action testing the new RUB 6-18 million repeat-offence penalty tier under 23-FZ is the next material development to watch in this module; no such action was located within this cycle's research window.

Cross-Border & Adequacy

Federal Law No. 242-FZ requires that personal data of Russian citizens be initially recorded, stored and processed in databases located within the Russian Federation -- a data-localisation requirement materially stricter than most GDPR-style adequacy-based transfer regimes. A 2025 amendment, Federal Law No. 23-FZ, is reported to have further tightened this localisation requirement, though the precise operational content of that tightening has not been independently confirmed against a primary source this cycle. Cross-border transfers outside the localisation requirement are otherwise understood to remain permitted to Strasbourg Convention states and to jurisdictions Roskomnadzor has separately approved, functioning as Russia's rough analogue to an adequacy mechanism, albeit one with a materially different legal basis and narrower footprint than the EU adequacy-decision framework.

Outlook

Whether Roskomnadzor's updated guidance operationalising the 2025 tightening amendment (23-FZ) is published remains an open gap; its absence this cycle limits confidence in exactly how the tightened localisation requirement will be applied in practice.

Algorithmic, Biometric & Surveillance Governance

Russia's internet-governance regulation, in force since March 2026, authorises Roskomnadzor to disconnect the Russian segment of the internet (Runet) from external resources and to block sites found non-compliant. Reporting dated 8 October 2026, just ahead of the primary window, describes a bill that would commit approximately RUB60 billion to traffic-filtering infrastructure over three years and establish a register of VPN-hosting providers. Taken together, the disconnection and blocking authority and the prospective hosting register describe a surveillance and network-control apparatus whose technical capacity continues to expand. No data-subject-facing safeguard, oversight mechanism, or redress channel tied to this infrastructure was identified in the material reviewed this period; the absence of any counterbalancing protection is itself part of the picture, not merely a gap in reporting.

Outlook

The VPN-hosting register bill's progress through the legislative process is the principal item to track going forward. If enacted, it would extend the state's existing disconnection and blocking powers into the infrastructure layer that currently allows circumvention of network filtering, a point at which the surveillance architecture and the question of effective access to external digital services converge most directly.

Algorithmic, Biometric & Surveillance Governance

The clearest evidence this cycle that Russian law treats biometric data as a distinct governance category comes from the enforcement side rather than from a dedicated processing-conditions statute: Federal Law No. 420-FZ sets a fine of RUB 15-20 million per incident specifically for unauthorised disclosure of biometric data, a materially heavier tier than the RUB 3-5 million to RUB 10-15 million range applicable to general personal-data disclosure incidents scaled by the number of individuals affected. This is an enforcement-side signal of a biometric-specific category rather than confirmation of a standalone biometric-processing statute; no distinct statutory definition, consent mechanism, or processing-condition framework specific to biometric data was located this cycle beyond the penalty tier itself.

The practical implication is that an entity handling biometric data in Russia faces a demonstrably higher regulatory downside from a breach than an entity handling general personal data, even though the upstream rules governing when and how biometric data may lawfully be collected and processed have not been separately sourced this cycle. This asymmetry, a heavy enforcement tier sitting above an unconfirmed processing-conditions framework, is itself the notable feature of this module's current state.

Outlook

Locating the underlying processing-conditions framework for biometric data, distinct from the general 152-FZ regime, would materially complete this module's picture; absent that, the RUB 15-20 million per-incident fine tier stands as the clearest marker of biometric data's elevated status under current Russian law.

Enforcement & Redress

A reported budget of approximately RUB 60 billion over three years for AI-powered traffic filtering was disclosed on 8 October 2026, representing a substantial new resourcing commitment behind Russia's blocking and filtering infrastructure. This investment continues to build out the technical capacity that underlies site-blocking enforcement generally, including the blocking mechanisms that are also used to enforce personal-data-localisation requirements. The enforcement significance of this development lies less in any single action taken against a specific controller or processor and more in the scale of resourcing now committed to the underlying enforcement infrastructure itself: a three-year, nearly RUB 60 billion commitment signals a sustained institutional investment in blocking capability as an enforcement tool, independent of any particular case or sanction decision reached this period.

Outlook

The three-year horizon of the reported AI-filtering budget suggests enforcement capacity in this space will continue to expand incrementally over the coming periods rather than through a single discrete event. Whether any specific enforcement action against a controller or processor is attributed explicitly to this new filtering capability, as opposed to general content-control enforcement, would be the clearest signal that the convergence between the two regimes has moved from capability to applied enforcement.

Enforcement & Redress

Russia's enforcement and redress architecture for data-protection violations escalated materially across two instruments taking effect within roughly six months of each other. Federal Law No. 421-FZ, effective 11 December 2024, introduced Article 272.1 into the Criminal Code, criminalising illegal collection, storage, use or transfer of computerised personal data. The basic offence carries a fine of up to RUB 300,000, forfeiture of income for up to one year, or imprisonment of up to four years; higher sentencing tiers apply where the data involved concerns minors, falls into a special category, or is biometric in nature. This is the first criminal-liability mechanism recorded for personal-data offences in Russia's framework, a structural shift from the previously administrative-only enforcement model.

Federal Law No. 420-FZ, effective 30 May 2025, raised administrative fines for unauthorised personal-data disclosure substantially: RUB 3-5 million for incidents affecting between 1,000 and 10,000 individuals, rising to RUB 10-15 million for incidents affecting more than 100,000 individuals, with a separate RUB 15-20 million per-incident tier specifically for biometric-data breaches. Taken together with the new criminal offence, Russian controllers now face a materially different risk calculus than before December 2024: a serious data-handling failure can now trigger both substantially higher administrative fines and personal criminal exposure for those responsible for the handling.

Outlook

No enforcement action under either Article 272.1 or the Federal Law No. 420-FZ fine tiers was located within this cycle's research window; whether Roskomnadzor or prosecutors bring cases under these now-escalated instruments is the central development to watch for this module going forward.

Enforcement & Redress

Roskomnadzor holds the power to order suspension of data-processing activities and to order website blocking against non-compliant operators. Administrative fines for data-localisation violations are reported to range from ₽1-6 million for a first offence to ₽6-18 million for a repeat offence. Separately, penalties for repeated data leaks are reported to have been raised to up to 3 percent of annual turnover under a 2025 amendment (Federal Law No. 420-FZ), and Federal Law No. 421-FZ is reported to have introduced criminal liability of up to 10 years' imprisonment for illegal personal-data trafficking. Together these represent a marked escalation in the enforcement posture available to Roskomnadzor, moving from fixed administrative-fine bands toward turnover-based penalties and criminal exposure. All of the specific figures above are drawn from secondary vendor and compliance-database sourcing; no rkn.gov.ru primary text for either 420-FZ or 421-FZ was retrieved this cycle, so confidence on the precise figures is held at Uncertain even though the general direction of escalation is corroborated across multiple independent secondary sources.

Outlook

Retrieval of primary statutory text for 420-FZ and 421-FZ remains the key outstanding item for this module; until then, the figures reported here should be treated as indicative rather than confirmed.