Law Messenger
New rules regarding the localization of personal data of Russian citizens
06.03.2025
Federal Law No. 23-FZ “Concerning Amendments to the Federal Law “Concerning Personal Data” and Certain Legislative Acts of the Russian Federation”, which was published on 28 February 2025, amends the wording of the requirement regarding the localization of the personal data of Russian citizens. The new provisions will take effect on 1 July 2025, so affected entities have until then to prepare for the impact of the rewording of Article 18(5) of Federal Law No. 152-FZ of 27.07.2006 “Concerning Personal Data” (“Law No. 152-FZ”).
The localization requirement is reworded as follows:
Current version *
When personal data is collected, including via the Internet, an operator shall be obliged to ensure that the recording, systematization, capture, storage, refinement (updating, amendment) and retrieval of personal data of Russian citizens takes place using databases situated in the territory of Russia, except in the cases referred to in clauses 2, 3, 4 and 8 of part 1 of Article 6 of Law No. 152-FZ.
* Text excluded by the amending law is shown in italics.
New version from 1 July 2025 **
When personal data is collected, including via the Internet, the recording, systematization, capture, storage, refinement (updating, amendment) and retrieval of personal data of Russian citizens using databases situated outside the territory of Russia shall not be permitted, except in the cases referred to in clauses 2, 3, 4 and 8 of part 1 of Article 6 of Law No. 152-FZ.
** Text inserted by the amending law is shown in italics.
The current version of the law imposed a positive obligation on operators to use databases situated in Russia when collecting personal data of Russian citizens. The new wording establishes a mandatory prohibition. The existing exceptions remain in place, namely the processing of personal data on the basis of international agreements or legislation, in connection with involvement in legal proceedings, for the purposes of the exercise of powers conferred on state bodies, and for the purposes of the conduct of the professional activities of journalists and mass media.
As yet, no official interpretation of the new requirement has been published, and the explanatory note to the bill provides no further commentary. This makes it difficult to assess the precise impact the changes will have on operators’ activities.
It should be noted that the mention of personal data operators has been excluded from part 5 of Article 18 of Law No. 152-FZ, which probably means that the relevant obligations would also apply to persons that process personal data on an operator’s behalf. There is also uncertainty over whether personal data of Russian citizens may be held in foreign databases after it has been localized in Russia. Previously, it was accepted without question that this was allowed, but the new amendments may indicate a shift towards a stricter approach.
In view of the absence of any official interpretation of the new rules, we advise operators and persons that process personal data on an operator’s behalf to stay alert to changes in the law and official clarifications and to act swiftly to adjust their business processes. Russia’s internet and communications regulator, Roskomnadzor, could probably release its position on how the new localization requirements should be interpreted in the very near future.
The B1 team constantly monitors changes in the law and administrative practice and is ready to provide advisory support on matters concerning the processing of personal data, including insofar as it affects cross-border data transfer and dealings with foreign counterparties and offices.
.jpg)
Authors
Vasily Makovkin
B1 Partner
Legal Services
Contact
.jpg)
Anton Sidnin
B1 Senior Associate
Legal Services
Contact
.jpg)
Polina Bychenok
B1 Associate
Legal Services
Contact
Draft amendments to strengthen control over foreign investment in "strategic" assets published
The Federal Anti-Monopoly Service has drafted amendments to current laws aimed at strengthening control over foreign investments in business entities and assets of strategic importance for national defense and state security in accordance with Law No. 57-FZ of April 29, 2008 "On the Procedure for Making Foreign Investments in Business Entities of Strategic Importance for Ensuring National Defense and State Security".
23.04.2025
.jpg)
Sanctions pressure and prosecution risks: important considerations for Russian companies and their employees
There has recently been an increase in regulatory pressure exerted by the EU in terms of monitoring compliance with European sanctions, including by Russian companies controlled by European entities. This may create additional prosecution risks both for the Russian subsidiaries themselves and, especially, for their employees, including senior executives, who are often forced to take foreign sanctions restrictions into account in their activities.
11.04.2025
Taxis under SPIC rules: new localization requirements
Bill No. 481272-8 (amendments to Federal Law No. 580-FZ “Concerning the Organization of the Transport of Passengers and Baggage by Taxi…”), which proposes to toughen the requirements for vehicles used in taxi services, is about to undergo a second reading. The bill was initially submitted to the State Duma in January 2024 but was later sent back for revision. The official text of the amendments has not been published, but the key provisions were disclosed in press. Below is a summary of the possible key changes and their potential impact on the industry.
28.03.2025
Non-use cancellation of a trademark: risks for foreign rights holders start to materialize
In 2025, the three-year grace period for the non-use of a trademark expires for many foreign right holders which exited the Russian market in 2022. This poses a risk of a non-use cancellation action against such trademarks from companies that continues to operate in Russia. Such precedents are already in place. One of such “fresh” precedents is discussed below.
25.03.2025
New rules regarding the localization of personal data of Russian citizens
Federal Law No. 23-FZ “Concerning Amendments to the Federal Law “Concerning Personal Data” and Certain Legislative Acts of the Russian Federation”, which was published on 28 February 2025, amends the wording of the requirement regarding the localization of the personal data of Russian citizens.
06.03.2025
.jpg)
New draft law on compulsory patent licenses: extension of the authority’s powers and grounds for issuing such licenses
On 15 January 2025 a bill “On Amendments to Part Four of the Civil Code of the Russian Federation” was submitted to the State Duma. The State Duma has not considered the Bill on the merits yet.
13.02.2025
Increased responsibility of EU operators to ensure that Russian companies under their control comply with restrictive measures
On 24 June 2024 the EU passed a 14th package of sanctions which significantly increased the responsibility of EU companies to ensure that Russian companies under their control comply with restrictive measures. Specifically, the newly inserted Article 8a of Council Regulation (EU) 833/2014 requires such companies to undertake their best efforts to ensure that their subsidiaries outside the EU do not participate in activities that undermine the application of restrictive measures imposed by the EU. However, the Regulation does not specify precisely what measures must be taken to comply with these requirements, thus causing uncertainty as to what actions may be considered adequate from an EU law perspective.
16.12.2024