Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Russia: Amendments to Law on Personal Data published in Official Gazette

The Federal Law of 14 July 2022 No. 266-FZ on Amending the Federal Law on Personal Data ('the Amendment Law') was published, on 20 July 2022, in the Official Gazette, following its adoption by the State Parliament ('Duma') on 6 July 2022. In particular, the Amendment Law provides for significant changes to the Federal Law of 27 July 2006 No. 152-FZ on Personal Data ('the Law on Personal Data') and introduces the following provisions, among other things:

  • extraterritorial application of the Law on Personal Data in cases where the personal data of Russian data subjects is processed by a foreign entity on the basis of an agreement or consent;
  • minimum standards applicable to contracts concluded with data subjects for the processing of personal data;
  • minimum standards applicable to contracts concluded between controllers and processors for the processing of personal data, as well as obligations for processors;
  • prohibition against mandatory provision of biometric data, whereby the controller is not entitled to refuse to provide a service if the data subject objects;
  • for the purpose of cross-border data transfers:
    • expanded authorisation for the Federal Service for Supervision of Communications, Information Technology, and Mass Media ('Roskomnadzor') to approve third countries that provide adequate data protection;
    • requirements on the controller to notify the Roskomnadzor, prior to conducting transfers;
    • requirements on the controller to conduct an assessment of the intended third country, prior to conducting transfers;
    • powers for the Roskomnadzor to prohibit certain transfers; and
  • clarified controller obligations in relation to policies and procedures, data subject rights, and data breach notifications.

Notably, the Amendment Law enters into effect on 1 September 2022, although some provisions will be delayed until 1 March 2023, including those concerning cross-border data transfers.

You can read the Amendment Law here and view its legislative process here, both only available in Russian.