--- title: "Russia Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/russia/ source_html: /jurisdictions/russia/index.html description: "Russia data protection and privacy regulation: 10 categories, 62 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: d7fa2b408976dc84a96baf69bdf7f06874a3bb417df545aa541e308b94fef6d2 generator: "fe-fleet/md-twin@1.0" --- # Russia Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/russia/), [World Payments](https://payments.gi/jurisdictions/russia/), artificial-intelligence Last updated 2026-10-25 · 10 categories · 62 claims · 48 sources in the cumulative register Download report (PDF) Expand all A Challenger fold this cycle corrects the record on Russia's territorial scope. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: Children & Vulnerable Groups. Not fully checked this cycle: Controller/Processor Duties, Sectoral Watch (2 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=RUSSIA)[Build Report](/reports/?j=RUSSIA)[Compare](/compare/?j=RUSSIA) Framework posture Regulated (omnibus) 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Roskomnadzor (Federal Service for Supervision of Communications, Information Technolo Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 8 Probable · 1 Uncertain · 1 Not yet assessed 10 Categories 2 Red categories 57 Sub-modules 62 Claims 5 Tier-1 sources Traffic-light mix 1 green 6 amber 2 red 1 n/a (sums to 10 rendered categories; click to filter) 2 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 1,129 Full executive summary 534 ###### Latest update · 25 October 2026 #### Lead Signal The operative development in Russia's data-protection-adjacent landscape this period sits not in the personal-data law itself but in the surveillance and internet-governance infrastructure surrounding it. Roskomnadzor's internet-governance authority, in force since March 2026, permits the disconnection of Runet from external resources and the blocking of non-compliant sites. Reporting from 8 October 2026 describes a bill that would fund traffic-filtering infrastructure with roughly RUB60 billion and create a register of VPN-hosting providers. Read together, these developments describe a state apparatus whose technical reach over network traffic continues to expand, with no corresponding expansion of data-subject safeguards reported in the same period. #### Other Developments No dated change was identified this period in the personal-data framework itself. The data-localisation mandate under Article 18 of Federal Law No. 152-FZ, requiring that databases holding Russian citizens' personal data be located within Russia on pain of a fine of RUB1,000,000 to RUB6,000,000, continues unaltered and is carried forward as standing law rather than as a new finding. #### Cross-Monitor Connections The infrastructure described here, particularly the prospective VPN-hosting register and the expanded traffic-filtering funding, has a direct bearing on how cross-border data flows and foreign digital services are mediated at the network level, a dimension the crypto monitor's coverage of licensed settlement rails and the world-payments monitor's coverage of domestic payment infrastructure both touch from adjacent angles; neither is re-analysed here. #### Outlook The VPN-hosting register bill reported on 8 October 2026 has not been confirmed as enacted, and its progress toward a vote is the principal item to track. Should it pass, the practical effect would be a further narrowing of the channels through which Russian users and data controllers reach external services and infrastructure outside the domestically filtered network, reinforcing the direction already set by the March 2026 disconnection and blocking authority. 3 earlier updates not shown here. ###### Standing brief · as of 5 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal A Challenger fold this cycle corrects the record on Russia's territorial scope. Federal Law No. 266-FZ, signed 14 July 2022 and effective from 1 September 2022, is now understood to have expanded the extraterritorial application of Federal Law No. 152-FZ beyond Russian-based offices of foreign companies. This corrects a prior baseline that had treated the same 2022 reform package as an unconfirmed first-reading bill even though its companion breach-notification provisions were already recorded as enacted. Because the verifying source is single-tier, the finding is held at a qualified level of confidence pending confirmation against the official gazette text. #### Other Developments Roskomnadzor is confirmed as the Competent Authority for protecting personal data subjects' rights under Article 23 of Federal Law No. 152-FZ. The statute recognises consent, contract-performance necessity and legal-obligation compliance as lawful processing bases. Operators must provide free access for data-subject inspection on request. They must respond to a subject's request within thirty days with a reasoned written reply. They must also destroy unlawfully-obtained or no-longer-needed personal data within seven working days. The statute contains no exemptions to the right to erasure comparable to the GDPR. Companies operating in Russia must designate a person responsible for the processing of personal data, functionally analogous to a GDPR Data Protection Officer. That individual, or the CEO where none is appointed, may incur personal administrative liability for non-compliance, a materially higher exposure than under the GDPR's controller/DPO model. Federal Law No. 420-FZ has introduced administrative fines for unauthorised disclosure of personal and biometric data and for breach-notification failures, entering force around 29 May 2025. This reinforces a 2022 duty requiring immediate reporting of cyberattacks and data breaches, effective 1 September 2022. A second Challenger correction this cycle revises Roskomnadzor's adequate-country whitelist under Order No. 128, effective 1 March 2023, from a previously reported approximately 23 countries up to 89, including Canada, Australia and New Zealand but still excluding the United States. This finding is also held at a qualified confidence level pending primary-source confirmation. Since September 2015, personal data of Russian citizens has had to be recorded, stored and processed in databases physically located within Russia. The statute contains no concept of standard contractual clauses, binding corporate rules or an approved code of conduct as an alternative transfer safeguard. Non-compliance with localisation exposes an operator to fines of RUB 1-6 million for a first offence and RUB 6-18 million for a repeat offence under Article 13.11 of the Code of Administrative Offences, with separate manager liability of RUB 100,000-800,000. A single lower-tier source reports that amended Article 12 of 152-FZ, also effective 1 March 2023, may additionally require a transfer-impact assessment of a destination country's confidentiality and security measures before transfer can proceed, a claim not yet confirmed at a higher source tier. The "Yarovaya package" requires telecommunications and internet providers to store transmitted traffic content for a defined period and disclose it to law enforcement on request. External commentary assesses this surveillance carve-out as falling short of the EU's "European Essential Guarantees" standard relevant to any GDPR transfer-risk analysis of Russia-linked processing. FAS Russia enforces Article 18 of the Law on Advertising against unsolicited direct marketing sent without prior consent. Moscow FAS found an Estée Lauder subsidiary in violation on this basis in September 2021. A 2025 amendment to the Law on Advertising is understood to prohibit advertising on platforms designated as "undesirable" foreign resources or liquidated associations, effective 1 September 2025. The Code of Administrative Offences caps the maximum single fine for 152-FZ violations at RUB 18 million, substantially below the GDPR's global-turnover-linked ceiling. Roskomnadzor separately retains the power to order rectification, blocking or destruction of unlawfully processed data and to block access to non-compliant websites outright, as it has done to LinkedIn since 2016 over localisation non-compliance. #### Cross-Monitor Connections The financial-integrity monitor should track the sanctions-regime overlay affecting Russia-linked cross-border data transfers and a draft Ministry of Digital Development amendment addressing biometric data collection by credit institutions via the Unified Biometric System. The world-payments monitor should separately assess how Russia's mandatory data localisation regime and the absence of any SCC/BCR-equivalent safeguard interact with payment-processor data flows involving Russian data subjects. The artificial-intelligence monitor should watch the interaction between the Unified Biometric System's remote-identification infrastructure and any emerging Russian AI-regulation framework, which this cycle's research did not locate. #### Outlook Two items from this cycle's Challenger fold warrant primary-source follow-up next cycle: confirmation of Federal Law No. 266-FZ's extraterritorial-scope enactment against the official gazette text, and confirmation of the 89-country adequate-country whitelist against the text of Order No. 128 itself. The reported Article 12 transfer-impact-assessment precondition remains an open verification item. No development within the 180 days preceding this dispatch was identified beyond Federal Law No. 420-FZ's administrative-fine provisions, which took effect in late May 2025. Read full brief · 1129 words ###### Latest update · 11 October 2026 #### Regulatory Status Russia's data-protection enforcement framework escalated materially this cycle across three dimensions: data-localisation penalties were recast with higher fines under Federal Law No. 23-FZ (effective 1 July 2025); biometric-data breaches now carry a distinct RUB 15-20 million per-incident fine tier under Federal Law No. 420-FZ (effective 30 May 2025), alongside raised general administrative fines; and illegal personal-data handling became a criminal offence under new Criminal Code Article 272.1, introduced by Federal Law No. 421-FZ (effective 11 December 2024). The pre-existing notify-and-wait cross-border transfer regime under Article 12 of Federal Law No. 152-FZ, requiring Roskomnadzor notification before any cross-border transfer with a ten-business-day prohibition window, continues in force alongside these developments. #### Outlook Whether these newly escalated administrative and criminal tools are actually used in enforcement is the central open question; no enforcement action under any of the three newly-effective instruments was located within this cycle's research window. ###### Standing brief · as of 5 September 2026 #### Regulatory Status Russia's personal-data regime is anchored in Federal Law No. 152-FZ, administered by Roskomnadzor as the designated Competent Authority under Article 23. This cycle's baseline population spans all ten Data Protection Monitor modules bar children and vulnerable groups, where no dedicated framework was located. The regime combines GDPR-parallel features, including consent- and contract-based lawful bases. The DPO-equivalent or CEO may incur personal administrative liability for non-compliance, unlike the GDPR. The statute also contains no exemptions to the right to erasure comparable to the GDPR. Personal data of Russian citizens has, since September 2015, had to be recorded, stored and processed in databases physically located within Russia. Two Challenger-fold corrections define this cycle's risk-tracker movement. Federal Law No. 266-FZ, effective 1 September 2022, is now understood to have already enacted an extraterritorial expansion of 152-FZ, correcting a baseline that had treated the same reform package as an unresolved bill. Roskomnadzor Order No. 128's adequate-country whitelist, effective 1 March 2023, is corrected from a reported approximately 23 countries to 89, including Canada, Australia and New Zealand but excluding the United States. A further caveat, an unconfirmed Article 12 transfer-impact-assessment precondition also dated 1 March 2023, is carried forward for backfill. Roskomnadzor can order rectification, blocking or destruction of unlawfully processed data. It can also block a non-compliant website outright, as with LinkedIn since 2016. And it is empowered to file court actions in defence of data subjects' rights. The statutory fine ceiling of RUB 18 million sits well below GDPR-scale penalties. Federal Law No. 420-FZ, entering force around 29 May 2025, adds fines for unauthorised biometric-data disclosure and breach-notification failures, the most recent substantive development located. Sectoral overlays are best evidenced in telecoms, via the "Yarovaya package" traffic-retention and disclosure regime. Direct marketing is separately evidenced through FAS Russia's Article 18 enforcement against unsolicited communications. #### Outlook The jurisdiction risk tracker rates Russia's overall regulatory direction as stable but ELEVATED, driven by the localisation, surveillance and enforcement complex rather than by fresh regulatory movement. Priority follow-up items are the primary-source confirmation of the 266-FZ enactment status and the Order No. 128 whitelist count, and verification of the reported Article 12 transfer-impact-assessment precondition. Read full brief · 534 words Key regulatory facts for Russia Regulatory Dimension Russia Standing Position Jurisdiction Russia (RU) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 62 sourced findings) Regulator & Framework Core regulator, statute and registration mechanics are clearly documented and stable; residual uncertainty concerns the final status of 2022 extraterritoriality-extension amendments. Lawful Processing & Special Data Lawful bases and biometric rules are reasonably well evidenced, but consent-threshold detail (freely given/informed/revocable) and a formal anonymisation safe-harbour are thinly sourced or absent. Data Subject Rights Access, erasure and response-deadline mechanics are well evidenced (T1 primary-law text), but restriction/objection and portability rights are an evidenced gap. Controller/Processor Duties DPO-equivalent and breach-notification duties are well evidenced and increasingly strict, but ROPA, granular security-measure standards, and joint-controller concepts are gaps relative to GDPR-style regimes. Primary Instruments Cited Roskomnadzor, OneTrust DataGuidance, OneTrust DataGuidance (hosting official-text translation), OneTrust DataGuidance, Wikipedia Last Confirmed / Updated 2026-10-25 (48 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Russia: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Uncertain▾ Core regulator, statute and registration mechanics are clearly documented and stable; residual uncertainty concerns the final status of 2022 extraterritoriality-extension amendments. Primary framework Federal Law No. 152-FZ 'On Personal Data' (27 July 2006, as amended) Supervisory authority [Roskomnadzor (Federal Service for Supervision of Communications, Information Technology and Mass Media)](https://rkn.gov.ru/) Traffic-light rationale — Green Core regulator, statute and registration mechanics are clearly documented and stable; residual uncertainty concerns the final status of 2022 extraterritoriality-extension amendments. #### Sub-modules (5) #### Regulator And AuthorityGreen Roskomnadzor is designated the Competent Authority for protecting personal data subjects' rights under Article 23 of 152-FZ. Claims (3): - Roskomnadzor is the Competent Authority for protecting the rights of personal data subjects in Russia pursuant to Article 23 of Federal Law No. 152-FZ. - Roskomnadzor is the federal executive body responsible for supervision of personal-data processing compliance in Russia, in addition to its media/internet-censorship functions. - Roskomnadzor — Russia's data-protection supervisory authority under Federal Law No. 152-FZ #### Act And InstrumentsGreen 152-FZ (2006, as amended) is the core instrument, functioning as Russia's GDPR-analogue statute. Claims (3): - Federal Law No. 152-FZ of 27 July 2006 'On Personal Data' is the core statute governing personal data processing in Russia and is treated as the functional analogue to the GDPR. - Federal Law No. 152-FZ — 152-FZ has been amended by Federal Law No. 420-FZ (2025), raising fines for repeated data leaks to up to 3% of annual turnover, and by Federal Law No. 421-FZ, introducing criminal liability of up to 10 years for illegal personal-data trafficking. - KoAP Art. 13.11 — As amended with effect from 30 May 2025 under Federal Law No. 420-FZ, multiplies fines for unlawful processing, failure to notify Roskomnadzor, and for leaks themselves; repeat-leak turnover-based fines of 1-3% of annual revenue (min 20m, max 500m rubles) #### Material ScopeGreen Scope covers automated processing and manual processing functionally equivalent to automated processing, by state, municipal and private operators. Claims (1): - 152-FZ regulates personal data processing by state bodies, municipal bodies, legal entities and individuals using automated means (including telecommunications networks) or non-automated means where processing is functionally similar to automated processing. #### Territorial ScopeAmber Applies to Russian-based offices of non-Russian companies; a 2022 first-reading bill would have extended extraterritorial application, but final enactment status of that specific provision was not confirmed in this pass. Claims (2): - The Law on Personal Data applies to legal entities processing personal data of Russian data subjects, including Russian-based offices of non-Russian companies that physically process such data in Russia. - A 2022 first-reading bill amending 152-FZ proposed extraterritorial application of the Law on Personal Data alongside mandatory notification of intended cross-border transfers; final enactment status of the extraterritoriality provision specifically was not confirmed. #### Regulator Registration And FilingGreen Pre-processing notification to Roskomnadzor is mandatory, recorded in a public Register of Operators, with 10-business-day update obligations; foreign hosting providers face separate registration duties since Feb 2024. Claims indexed in baseline register · source extraction in progress Russia's data-protection regime is anchored in Federal Law No. 152-FZ 'On Personal Data' (27 July 2006, as amended), supervised by Roskomnadzor (the Federal Service for Supervision of Communications, Information Technology and Mass Media). The framework applies to state/municipal bodies, legal entities and private individuals processing personal data by automated or functionally-equivalent manual means, and extends to Russian-based offices of foreign companies. Operators must notify Roskomnadzor before processing and are recorded on a public Register of Operators, with periodic filing updates required. Periodic update · new data 2026-10-18 #### Regulator & Framework Roskomnadzor's standing as the central regulator overseeing both internet-content control and personal-data enforcement in Russia has expanded this period. Decree No. 1667 gives Roskomnadzor direct deep-packet-inspection blocking capability through the TSPU system, extending the regulator's enforcement reach without requiring the involvement of internet service providers as an intermediary step. This is understood to broaden Roskomnadzor's practical authority over how content and, by extension, data flows are blocked at the network level, consolidating its position as the dominant regulatory actor across both the content-control and data-protection domains. The development reflects an expansion of enforcement infrastructure and capability rather than a change to the underlying statutory basis for Roskomnadzor's authority, which remains otherwise unchanged this period. #### Outlook Whether Decree No. 1667's TSPU capability is formally invoked for personal-data-localisation enforcement specifically, as opposed to content-control enforcement generally, is the key development to watch. The structural overlap between the two enforcement domains means that any future exercise of this capability could plausibly be framed under either heading. 1 earlier distinct update(s) Periodic update · new data 2026-09-28 #### Regulator & Framework Roskomnadzor is the federal executive body understood to be responsible for supervision of personal-data processing compliance in Russia, a function it exercises alongside its separate media and internet-censorship remit. The core statute, Federal Law No. 152-FZ, has been amended repeatedly, most recently and materially by Federal Law No. 420-FZ and Federal Law No. 421-FZ, both reported in 2025, which are understood to raise fines for repeated data leaks to up to 3 percent of annual turnover and to introduce criminal liability of up to 10 years for illegal personal-data trafficking respectively. No rkn.gov.ru or pravo.gov.ru primary text for either amendment was retrieved this cycle; the figures above rest on secondary and vendor-compliance-database summaries, which caps confidence at Uncertain for the specific fine and liability figures even though the general direction of tightening is reasonably well corroborated across independent secondary sources. #### Outlook The key marker for this module is whether primary statutory text for 420-FZ and 421-FZ becomes available in a subsequent cycle, which would allow the reported figures to move from secondary-sourced to primary-confirmed status. Sources and claims (9) - [Roskomnadzor](https://eng.pd.rkn.gov.ru/) — Roskomnadzor is the Competent Authority for protecting the rights of personal data subjects in Russia pursuant to Article 23 of Federal Law No. 152-FZ. - [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v_russia_update_2022.pdf) — Federal Law No. 152-FZ of 27 July 2006 'On Personal Data' is the core statute governing personal data processing in Russia and is treated as the functional analogue to the GDPR. - [OneTrust DataGuidance (hosting official-text translation)](https://www.dataguidance.com/sites/default/files/en_20190809_russian_personal_data_federal_law_2.pdf) — 152-FZ regulates personal data processing by state bodies, municipal bodies, legal entities and individuals using automated means (including telecommunications networks) or non-automated means where processing is functionally similar to automated processing. - [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v_russia_update_2022.pdf) — The Law on Personal Data applies to legal entities processing personal data of Russian data subjects, including Russian-based offices of non-Russian companies that physically process such data in Russia. - [OneTrust DataGuidance](https://www.dataguidance.com/news/russia-amendments-law-personal-data-adopted-first) — A 2022 first-reading bill amending 152-FZ proposed extraterritorial application of the Law on Personal Data alongside mandatory notification of intended cross-border transfers; final enactment status of the extraterritoriality provision specifically was not confirmed. - [Wikipedia](https://en.wikipedia.org/wiki/Roskomnadzor) — Roskomnadzor is the federal executive body responsible for supervision of personal-data processing compliance in Russia, in addition to its media/internet-censorship functions. - [https://www.recordinglaw.com/world-laws/world-data-privacy-laws/russia-data-privacy-laws/](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/russia-data-privacy-laws/) — Federal Law No. 152-FZ — 152-FZ has been amended by Federal Law No. 420-FZ (2025), raising fines for repeated data leaks to up to 3% of annual turnover, and by Federal Law No. 421-FZ, introducing criminal liability of up to 10 years for illegal personal-data trafficking. - [https://www.dlapiperdataprotection.com/index.html?t=law&c=RU](https://www.dlapiperdataprotection.com/index.html?t=law&c=RU) — Roskomnadzor — Russia's data-protection supervisory authority under Federal Law No. 152-FZ - [RNK.ru](https://www.rnk.ru/article/217361-shtrafy-za-persdannye) — KoAP Art. 13.11 — As amended with effect from 30 May 2025 under Federal Law No. 420-FZ, multiplies fines for unlawful processing, failure to notify Roskomnadzor, and for leaks themselves; repeat-leak turnover-based fines of 1-3% of annual revenue (min 20m, max 500m rubles) ### Russia: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Lawful bases and biometric rules are reasonably well evidenced, but consent-threshold detail (freely given/informed/revocable) and a formal anonymisation safe-harbour are thinly sourced or absent. Primary framework Federal Law No. 152-FZ 'On Personal Data'; Code of Administrative Offences (Federal Law No. 195-FZ) as amended by Federal Law No. 420-FZ (2024) Supervisory authority [Roskomnadzor](https://rkn.gov.ru/) Traffic-light rationale — Amber Lawful bases and biometric rules are reasonably well evidenced, but consent-threshold detail (freely given/informed/revocable) and a formal anonymisation safe-harbour are thinly sourced or absent. Periodic update · new data 2026-09-28 #### Lawful Processing & Special Data The 2022 amendments under Federal Law No. 266-FZ are reported to have eliminated bundled or pre-checked consent in Russian data-protection practice: each processing purpose now understood to require a separate, affirmative act by the data subject, rather than a single blanket consent covering multiple purposes. Distribution of personal data to an unlimited audience is reported to require separately and specifically obtained consent, distinct from consent to processing generally. This consent architecture is broadly comparable in structure to purpose-specific consent requirements found in GDPR-style regimes, though the Russian statute operates under its own enforcement and definitional framework. No primary statutory text was directly retrieved this cycle to confirm the precise wording of the affirmative-act standard; the claim rests on secondary legal-summary sourcing, and confidence is accordingly held at Uncertain. #### Outlook Whether Roskomnadzor issues implementing guidance further specifying what constitutes a valid separate affirmative act for consent purposes is the development to watch for this module. D2 · Lawful Processing — Full Module Record 4 sub-modules · 78 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Russia: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Access, erasure and response-deadline mechanics are well evidenced (T1 primary-law text), but restriction/objection and portability rights are an evidenced gap. Primary framework Federal Law No. 152-FZ 'On Personal Data', Articles 14, 20-21 Supervisory authority [Roskomnadzor](https://rkn.gov.ru/) Traffic-light rationale — Amber Access, erasure and response-deadline mechanics are well evidenced (T1 primary-law text), but restriction/objection and portability rights are an evidenced gap. #### Sub-modules (5) #### Access RightGreen Operators must make personal data available for inspection by the subject free of charge. Claims (1): - An operator must make personal data relating to a particular data subject available for inspection by that data subject or their representative free of charge. #### Rectification And ErasureGreen Unlawfully-obtained or no-longer-needed data must be destroyed within 7 working days; unlike the GDPR, no statutory exemptions apply to this erasure duty. Claims (2): - Where a data subject demonstrates that personal data were unlawfully obtained or are no longer needed for the stated processing purpose, the operator must destroy that data within seven working days and notify the subject and, where feasible, downstream third-party recipients. - Unlike the GDPR, the Law on Personal Data does not provide statutory exemptions to the right to erasure. #### Restriction And ObjectionRed No explicit GDPR Art 18/21-style restriction or objection-to-profiling right was located in the sources reviewed. #### Data PortabilityRed No GDPR Art 20-style data-portability right was located in 152-FZ or secondary commentary reviewed. #### Deadlines And Response WindowsGreen 30-day windows apply both to reasoned refusal responses to data subjects and to operator responses to Roskomnadzor information requests. Claims (2): - An operator must give a reasoned written reply to a data subject's request within thirty days from the date of the application or request. - An operator must supply information requested by Roskomnadzor within thirty days from the date of receipt of that request. Data subjects have access, rectification and erasure rights with defined response windows (7 working days for destruction of unlawfully-obtained/unneeded data; 30 days for reasoned written responses and for regulator information requests). No GDPR-style exemptions apply to the erasure right. Explicit restriction-of-processing, objection-to-profiling, and data-portability rights analogous to GDPR Articles 18, 21 and 20 were not identified in the sources reviewed. Periodic update · new data 2026-09-28 #### Data Subject Rights Under the Federal Law No. 266-FZ amendment framework, data operators are reported to be required to cease processing within 10 working days of a valid withdrawal-of-consent or objection request from a data subject. This creates a defined statutory response window for rights requests, distinct from the separate 24-hour breach-notification duty that applies to security incidents rather than subject-rights requests. Evidence for the specific 10-working-day figure rests on secondary legal-summary sourcing rather than a directly retrieved primary statutory text this cycle, so confidence is held at Uncertain pending further corroboration. #### Outlook Confirmation of the 10-working-day cessation window against a primary Roskomnadzor or pravo.gov.ru source remains the outstanding item for this module. Sources and claims (5) - [Roskomnadzor](https://pd.rkn.gov.ru/authority/p146/p164/) — An operator must make personal data relating to a particular data subject available for inspection by that data subject or their representative free of charge. - [Roskomnadzor](https://pd.rkn.gov.ru/authority/p146/p164/) — Where a data subject demonstrates that personal data were unlawfully obtained or are no longer needed for the stated processing purpose, the operator must destroy that data within seven working days and notify the subject and, where feasible, downstream third-party recipients. - [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v_russia_update_2022.pdf) — Unlike the GDPR, the Law on Personal Data does not provide statutory exemptions to the right to erasure. - [Roskomnadzor](https://pd.rkn.gov.ru/authority/p146/p164/) — An operator must give a reasoned written reply to a data subject's request within thirty days from the date of the application or request. - [Roskomnadzor](https://pd.rkn.gov.ru/authority/p146/p164/) — An operator must supply information requested by Roskomnadzor within thirty days from the date of receipt of that request. ### Russia: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ DPO-equivalent and breach-notification duties are well evidenced and increasingly strict, but ROPA, granular security-measure standards, and joint-controller concepts are gaps relative to GDPR-style regimes. Primary framework Federal Law No. 152-FZ 'On Personal Data'; Code of Administrative Offences as amended by Federal Law No. 420-FZ (2024) Supervisory authority [Roskomnadzor](https://rkn.gov.ru/) Traffic-light rationale — Amber DPO-equivalent and breach-notification duties are well evidenced and increasingly strict, but ROPA, granular security-measure standards, and joint-controller concepts are gaps relative to GDPR-style regimes. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Data operators in Russia are reported to face a 24-hour breach-notification duty to Roskomnadzor, running from the point of detection of a personal-data-security incident, under the Federal Law No. 266-FZ amendment framework. A fuller follow-up notification addressing causes, harm and mitigation measures is understood to be required after the initial 24-hour notification. This is a materially shorter initial window than the 72-hour standard found in GDPR-style regimes, and represents one of the more distinctive compliance burdens facing controllers and processors operating in the Russian market. No primary statutory or Roskomnadzor-issued guidance text was directly retrieved this cycle confirming the exact mechanics of the follow-up notification; the claim rests on secondary legal-summary sourcing, and confidence is held at Uncertain. #### Outlook Whether Roskomnadzor publishes operational guidance detailing the follow-up notification's required content and format is the item to watch for this module. D4 · Controller & Processor — Full Module Record 7 sub-modules · 86 words · 8 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Russia: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ The localisation mandate is materially stricter than GDPR-style regimes, enforcement includes website-blocking, no SCC/BCR safe harbour exists, and the sanctions overlay adds acute cross-border compliance risk — collectively warranting a red rating per the CAUTION flags. Primary framework Federal Law No. 152-FZ 'On Personal Data' (localisation provisions); Code of Administrative Offences Art. 13.11 Supervisory authority [Roskomnadzor](https://rkn.gov.ru/) Traffic-light rationale — Red The localisation mandate is materially stricter than GDPR-style regimes, enforcement includes website-blocking, no SCC/BCR safe harbour exists, and the sanctions overlay adds acute cross-border compliance risk — collectively warranting a red rating per the CAUTION flags. Periodic update · new data 2026-10-11 #### Cross-Border & Adequacy Russia's cross-border data-transfer regime tightened materially this cycle through Federal Law No. 23-FZ, which recast the mandatory data-localisation requirement for Russian citizens' personal data with higher penalties, effective 1 July 2025: RUB 1-6 million for a first offence and RUB 6-18 million for a repeat offence by a legal entity, with website-blocking available as an additional sanction. This recast sits on top of, rather than replacing, the long-standing notify-and-wait transfer-approval model under Article 12 of Federal Law No. 152-FZ, under which a data controller must notify Roskomnadzor before conducting a cross-border personal-data transfer, specifying the destination country, lawful basis, purpose and categories of data involved; Roskomnadzor retains the power to prohibit the transfer within ten business days of notification. The 34-state adequacy list maintained under Order No. 128 continues to operate alongside this notify-and-wait requirement, meaning even a transfer to a listed adequate jurisdiction remains subject to the prior-notification obligation. The combined effect of these two instruments is a transfer-control model considerably more restrictive in practice than an adequacy-only framework: localisation is mandatory and now carries escalated penalties, and any transfer that does occur is gated by a notify-and-wait mechanism rather than relying solely on destination-country assessment. For a controller already localising Russian citizens' data domestically, as required since the data-localisation rules took effect, the immediate practical consequence of this cycle's development is a sharply higher downside if localisation is breached, rather than a change to the transfer-notification mechanics themselves. #### Outlook Whether Roskomnadzor brings an enforcement action testing the new RUB 6-18 million repeat-offence penalty tier under 23-FZ is the next material development to watch in this module; no such action was located within this cycle's research window. Periodic update · new data 2026-09-28 #### Cross-Border & Adequacy Federal Law No. 242-FZ requires that personal data of Russian citizens be initially recorded, stored and processed in databases located within the Russian Federation -- a data-localisation requirement materially stricter than most GDPR-style adequacy-based transfer regimes. A 2025 amendment, Federal Law No. 23-FZ, is reported to have further tightened this localisation requirement, though the precise operational content of that tightening has not been independently confirmed against a primary source this cycle. Cross-border transfers outside the localisation requirement are otherwise understood to remain permitted to Strasbourg Convention states and to jurisdictions Roskomnadzor has separately approved, functioning as Russia's rough analogue to an adequacy mechanism, albeit one with a materially different legal basis and narrower footprint than the EU adequacy-decision framework. #### Outlook Whether Roskomnadzor's updated guidance operationalising the 2025 tightening amendment (23-FZ) is published remains an open gap; its absence this cycle limits confidence in exactly how the tightened localisation requirement will be applied in practice. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 140 words · 12 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Russia: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Telecoms and employment overlays are reasonably evidenced; financial-sector biometric rules remain at draft stage; health, education, insurance and credit-scoring overlays are unevidenced gaps. Primary framework Federal Law No. 152-FZ 'On Personal Data'; Federal Law 'On Communications'; Yarovaya-package amendments Supervisory authority [Roskomnadzor](https://rkn.gov.ru/) Traffic-light rationale — Amber Telecoms and employment overlays are reasonably evidenced; financial-sector biometric rules remain at draft stage; health, education, insurance and credit-scoring overlays are unevidenced gaps. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 68 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Russia: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Direct marketing enforcement is reasonably well evidenced under a distinct sectoral regulator (FAS Russia); cookie-consent, dark-pattern, opt-out-signal and clean-room concepts are unevidenced gaps. Primary framework Federal Law No. 38-FZ 'On Advertising' (13 March 2006); Federal Law 'On Communications' Art. 44.1 Supervisory authority [Roskomnadzor](https://rkn.gov.ru/) Traffic-light rationale — Amber Direct marketing enforcement is reasonably well evidenced under a distinct sectoral regulator (FAS Russia); cookie-consent, dark-pattern, opt-out-signal and clean-room concepts are unevidenced gaps. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 82 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Russia: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ The combination of an expansive, weakly-constrained state-surveillance/data-retention regime and the absence of any profiling, ADM-transparency, AI-risk-assessment or genetic-data framework warrants a red rating. Primary framework Federal Law No. 152-FZ 'On Personal Data'; Code of Administrative Offences as amended by Federal Law No. 420-FZ (2024); Yarovaya-package communications-retention amendments Supervisory authority [Roskomnadzor](https://rkn.gov.ru/) Traffic-light rationale — Red The combination of an expansive, weakly-constrained state-surveillance/data-retention regime and the absence of any profiling, ADM-transparency, AI-risk-assessment or genetic-data framework warrants a red rating. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance Russia's internet-governance regulation, in force since March 2026, authorises Roskomnadzor to disconnect the Russian segment of the internet (Runet) from external resources and to block sites found non-compliant. Reporting dated 8 October 2026, just ahead of the primary window, describes a bill that would commit approximately RUB60 billion to traffic-filtering infrastructure over three years and establish a register of VPN-hosting providers. Taken together, the disconnection and blocking authority and the prospective hosting register describe a surveillance and network-control apparatus whose technical capacity continues to expand. No data-subject-facing safeguard, oversight mechanism, or redress channel tied to this infrastructure was identified in the material reviewed this period; the absence of any counterbalancing protection is itself part of the picture, not merely a gap in reporting. #### Outlook The VPN-hosting register bill's progress through the legislative process is the principal item to track going forward. If enacted, it would extend the state's existing disconnection and blocking powers into the infrastructure layer that currently allows circumvention of network filtering, a point at which the surveillance architecture and the question of effective access to external digital services converge most directly. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance The clearest evidence this cycle that Russian law treats biometric data as a distinct governance category comes from the enforcement side rather than from a dedicated processing-conditions statute: Federal Law No. 420-FZ sets a fine of RUB 15-20 million per incident specifically for unauthorised disclosure of biometric data, a materially heavier tier than the RUB 3-5 million to RUB 10-15 million range applicable to general personal-data disclosure incidents scaled by the number of individuals affected. This is an enforcement-side signal of a biometric-specific category rather than confirmation of a standalone biometric-processing statute; no distinct statutory definition, consent mechanism, or processing-condition framework specific to biometric data was located this cycle beyond the penalty tier itself. The practical implication is that an entity handling biometric data in Russia faces a demonstrably higher regulatory downside from a breach than an entity handling general personal data, even though the upstream rules governing when and how biometric data may lawfully be collected and processed have not been separately sourced this cycle. This asymmetry, a heavy enforcement tier sitting above an unconfirmed processing-conditions framework, is itself the notable feature of this module's current state. #### Outlook Locating the underlying processing-conditions framework for biometric data, distinct from the general 152-FZ regime, would materially complete this module's picture; absent that, the RUB 15-20 million per-incident fine tier stands as the clearest marker of biometric data's elevated status under current Russian law. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 79 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Russia: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No comprehensive children/vulnerable-groups provisions within the personal-data framework were located; this is an explicit, fully-scoped evidentiary gap rather than a silent omission. Supervisory authority [Roskomnadzor](https://rkn.gov.ru/) Traffic-light rationale — Not assessed No comprehensive children/vulnerable-groups provisions within the personal-data framework were located; this is an explicit, fully-scoped evidentiary gap rather than a silent omission. #### Sub-modules (5) #### Age VerificationRed No age-verification requirement specific to personal-data processing was identified. #### Parental ConsentRed No GDPR Art 8-style parental-consent mechanism specific to personal-data processing was identified. #### Minor Profiling BansRed No minor-specific profiling ban was identified. #### Education SettingsRed No education-setting-specific personal-data rule for minors was identified. #### Dependent AdultsRed No dependent-adult-specific personal-data protection was identified. No GDPR Article 8-style age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adult protection specific to personal-data processing was identified for Russia in this research pass. General civil-law capacity rules (age of majority) may bear on contractual consent capacity, but no personal-data-specific minor/vulnerable-group framework was substantively evidenced. ### Russia: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Regulator powers, penalty ceilings and website-blocking sanctions are well evidenced; regulator funding/capacity, standalone private-right-of-action mechanisms, and confirmed within-180-day developments are gaps. Primary framework Code of Administrative Offences (Federal Law No. 195-FZ), Article 13.11, as amended; Federal Law No. 152-FZ Article 23 Supervisory authority [Roskomnadzor](https://rkn.gov.ru/) Traffic-light rationale — Amber Regulator powers, penalty ceilings and website-blocking sanctions are well evidenced; regulator funding/capacity, standalone private-right-of-action mechanisms, and confirmed within-180-day developments are gaps. Periodic update · new data 2026-10-18 #### Enforcement & Redress A reported budget of approximately RUB 60 billion over three years for AI-powered traffic filtering was disclosed on 8 October 2026, representing a substantial new resourcing commitment behind Russia's blocking and filtering infrastructure. This investment continues to build out the technical capacity that underlies site-blocking enforcement generally, including the blocking mechanisms that are also used to enforce personal-data-localisation requirements. The enforcement significance of this development lies less in any single action taken against a specific controller or processor and more in the scale of resourcing now committed to the underlying enforcement infrastructure itself: a three-year, nearly RUB 60 billion commitment signals a sustained institutional investment in blocking capability as an enforcement tool, independent of any particular case or sanction decision reached this period. #### Outlook The three-year horizon of the reported AI-filtering budget suggests enforcement capacity in this space will continue to expand incrementally over the coming periods rather than through a single discrete event. Whether any specific enforcement action against a controller or processor is attributed explicitly to this new filtering capability, as opposed to general content-control enforcement, would be the clearest signal that the convergence between the two regimes has moved from capability to applied enforcement. Periodic update · new data 2026-10-11 #### Enforcement & Redress Russia's enforcement and redress architecture for data-protection violations escalated materially across two instruments taking effect within roughly six months of each other. Federal Law No. 421-FZ, effective 11 December 2024, introduced Article 272.1 into the Criminal Code, criminalising illegal collection, storage, use or transfer of computerised personal data. The basic offence carries a fine of up to RUB 300,000, forfeiture of income for up to one year, or imprisonment of up to four years; higher sentencing tiers apply where the data involved concerns minors, falls into a special category, or is biometric in nature. This is the first criminal-liability mechanism recorded for personal-data offences in Russia's framework, a structural shift from the previously administrative-only enforcement model. Federal Law No. 420-FZ, effective 30 May 2025, raised administrative fines for unauthorised personal-data disclosure substantially: RUB 3-5 million for incidents affecting between 1,000 and 10,000 individuals, rising to RUB 10-15 million for incidents affecting more than 100,000 individuals, with a separate RUB 15-20 million per-incident tier specifically for biometric-data breaches. Taken together with the new criminal offence, Russian controllers now face a materially different risk calculus than before December 2024: a serious data-handling failure can now trigger both substantially higher administrative fines and personal criminal exposure for those responsible for the handling. #### Outlook No enforcement action under either Article 272.1 or the Federal Law No. 420-FZ fine tiers was located within this cycle's research window; whether Roskomnadzor or prosecutors bring cases under these now-escalated instruments is the central development to watch for this module going forward. Periodic update · new data 2026-09-28 #### Enforcement & Redress Roskomnadzor holds the power to order suspension of data-processing activities and to order website blocking against non-compliant operators. Administrative fines for data-localisation violations are reported to range from ₽1-6 million for a first offence to ₽6-18 million for a repeat offence. Separately, penalties for repeated data leaks are reported to have been raised to up to 3 percent of annual turnover under a 2025 amendment (Federal Law No. 420-FZ), and Federal Law No. 421-FZ is reported to have introduced criminal liability of up to 10 years' imprisonment for illegal personal-data trafficking. Together these represent a marked escalation in the enforcement posture available to Roskomnadzor, moving from fixed administrative-fine bands toward turnover-based penalties and criminal exposure. All of the specific figures above are drawn from secondary vendor and compliance-database sourcing; no rkn.gov.ru primary text for either 420-FZ or 421-FZ was retrieved this cycle, so confidence on the precise figures is held at Uncertain even though the general direction of escalation is corroborated across multiple independent secondary sources. #### Outlook Retrieval of primary statutory text for 420-FZ and 421-FZ remains the key outstanding item for this module; until then, the figures reported here should be treated as indicative rather than confirmed. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 120 words · 11 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties