Law Messenger

New rules regarding the localization of personal data of Russian citizens

06.03.2025

Federal Law No. 23-FZ “Concerning Amendments to the Federal Law “Concerning Personal Data” and Certain Legislative Acts of the Russian Federation”, which was published on 28 February 2025, amends the wording of the requirement regarding the localization of the personal data of Russian citizens. The new provisions will take effect on 1 July 2025, so affected entities have until then to prepare for the impact of the rewording of Article 18(5) of Federal Law No. 152-FZ of 27.07.2006 “Concerning Personal Data” (“Law No. 152-FZ”).

The localization requirement is reworded as follows:

Current version *

When personal data is collected, including via the Internet, an operator shall be obliged to ensure that the recording, systematization, capture, storage, refinement (updating, amendment) and retrieval of personal data of Russian citizens takes place using databases situated in the territory of Russia, except in the cases referred to in clauses 2, 3, 4 and 8 of part 1 of Article 6 of Law No. 152-FZ.

* Text excluded by the amending law is shown in italics.

New version from 1 July 2025 **

When personal data is collected, including via the Internet, the recording, systematization, capture, storage, refinement (updating, amendment) and retrieval of personal data of Russian citizens using databases situated outside the territory of Russia shall not be permitted, except in the cases referred to in clauses 2, 3, 4 and 8 of part 1 of Article 6 of Law No. 152-FZ.

** Text inserted by the amending law is shown in italics.

The current version of the law imposed a positive obligation on operators to use databases situated in Russia when collecting personal data of Russian citizens. The new wording establishes a mandatory prohibition. The existing exceptions remain in place, namely the processing of personal data on the basis of international agreements or legislation, in connection with involvement in legal proceedings, for the purposes of the exercise of powers conferred on state bodies, and for the purposes of the conduct of the professional activities of journalists and mass media.

As yet, no official interpretation of the new requirement has been published, and the explanatory note to the bill provides no further commentary. This makes it difficult to assess the precise impact the changes will have on operators’ activities.

It should be noted that the mention of personal data operators has been excluded from part 5 of Article 18 of Law No. 152-FZ, which probably means that the relevant obligations would also apply to persons that process personal data on an operator’s behalf. There is also uncertainty over whether personal data of Russian citizens may be held in foreign databases after it has been localized in Russia. Previously, it was accepted without question that this was allowed, but the new amendments may indicate a shift towards a stricter approach.

In view of the absence of any official interpretation of the new rules, we advise operators and persons that process personal data on an operator’s behalf to stay alert to changes in the law and official clarifications and to act swiftly to adjust their business processes. Russia’s internet and communications regulator, Roskomnadzor, could probably release its position on how the new localization requirements should be interpreted in the very near future.