The Federal Law of 14 July 2022 No. 266-FZ on Amending the Federal Law on Personal Data ('the Amendment Law') was published, on 20 July 2022, in the Official Gazette, following its adoption by the State Parliament ('Duma') on 6 July 2022. In particular, the Amendment Law provides for significant changes to the Federal Law of 27 July 2006 No. 152-FZ on Personal Data ('the Law on Personal Data') and introduces the following provisions, among other things:

• extraterritorial application of the Law on Personal Data in cases where the personal data of Russian data subjects is processed by a foreign entity on the basis of an agreement or consent;
• minimum standards applicable to contracts concluded with data subjects for the processing of personal data;
• minimum standards applicable to contracts concluded between controllers and processors for the processing of personal data, as well as obligations for processors;
• prohibition against mandatory provision of biometric data, whereby the controller is not entitled to refuse to provide a service if the data subject objects;
• for the purpose of cross-border data transfers:
  • expanded authorisation for the Federal Service for Supervision of Communications, Information Technology, and Mass Media ('Roskomnadzor') to approve third countries that provide adequate data protection;
  • requirements on the controller to notify the Roskomnadzor, prior to conducting transfers;
  • requirements on the controller to conduct an assessment of the intended third country, prior to conducting transfers;
  • powers for the Roskomnadzor to prohibit certain transfers; and
• clarified controller obligations in relation to policies and procedures, data subject rights, and data breach notifications.

Notably, the Amendment Law enters into effect on 1 September 2022, although some provisions will be delayed until 1 March 2023, including those concerning cross-border data transfers.

You can read the Amendment Law here and view its legislative process here, both only available in Russian.