The State Parliament ('Duma') announced, on 24 May 2022, a bill amending Federal Law of 27 July 2006 No. 152-FZ on Personal Data (as amended) was adopted at first reading. In particular, the Duma highlighted that the amendments require data operators to immediately report all cyber attacks and data breaches to relevant authorities. In addition, the Duma outlined that data operators will be required to inform relevant authorities of the intention to transfer personal data to third countries, and that such transfers may be limited dependent on threats to defence and national security. More specifically, the Duma provided amendments which allow for the extraterritorial application of the Law on Personal Data, establishing the possibility of relevant authorities interfering in the processing of personal data of Russian data subjects in third countries.

Furthermore, the Duma noted the amendments reduce the timeframe for data operators compliance with relevant authorities requests relating to the processing of personal data, from 30 to 10 days. Notably, the Duma detailed the amendments provide protection for data subjects, establishing a direct ban on the refusal to provide services to citizens if they are unwilling to provide their personal data, even if necessary. Likewise, the Duma pointed out the amendments place restrictions on processing the biometric data of minors.

You can read the announcement, only available in Russian, here.