Входим в число лучших юридический компаний по версии Право-300 и Коммерсантъ в области технологий (ТМТ) и IP
Патентные поверенные всех специализацией: товарные знаки, программы для ЭВМ, изобретения, пром. образцы
Money-back guarantee in case of refusal Data localization, Roskomnadzor notifications, cross-border transfers and breach response — handled by a Moscow law firm ranked by Pravo-300 and Kommersant. We work in English.
Personal Data Lawyers in Russia: 152-FZ Compliance for Foreign Companies
Order a consultation now
Russian personal data law in one paragraph
Russia's Federal Law No. 152-FZ "On Personal Data" applies to any company that collects personal data of people in Russia — including foreign companies with no Russian entity whose website or app is aimed at Russian users. A personal data lawyer in Russia maps your data flows, moves the initial collection of Russians' data to servers in Russia, files notifications with Roskomnadzor (the data protection regulator), drafts Russian-language policies and separate consent forms, and defends the company during inspections and data breaches.
- Localization: since 1 July 2025 the law directly prohibits collecting Russians' data into databases located abroad. Data may be transferred abroad only after it has first been recorded in a database in Russia.
- Filings: a notification to Roskomnadzor before processing starts, and a separate notification before any cross-border transfer.
- Consent: since 1 September 2025 consent must be a separate document — not a clause in terms of use, an offer or an employment contract.
- Breaches: Roskomnadzor must be notified within 24 hours and again within 72 hours.
- Fines: up to RUB 20 million (≈ USD 222,000) for a first data leak and 1–3% of revenue (up to RUB 500 million, ≈ USD 5.6 million) for a repeat one.
- New in 2026: the list of countries with adequate data protection is now set by Roskomnadzor Order No. 253 (in force since 30 October 2026): 88 countries, including the EU, the UK, Switzerland, China and India; the USA and the UAE are not on it.
Does Russian data protection law apply to your company?
152-FZ follows the data, not the company's place of registration. Find your situation below.
Full compliance required
The Russian entity is a data operator for its employees, clients and website users. It needs a Roskomnadzor notification, local documents, a responsible person and Russian servers for initial collection.
152-FZ applies in full
No entity in Russia, but you target the market
Roskomnadzor treats a foreign service as targeting Russia if it has a Russian-language version, prices in rubles, delivery to Russia, a .ru domain or advertising aimed at Russian users. Such services must localize data and comply with 152-FZ.
152-FZ applies, incl. localization
Russian data goes to your HQ or global systems
HR, CRM, ERP, ticketing and analytics shared across the group mean cross-border transfer. Data must first be collected in Russia, then transferred after notifying Roskomnadzor and checking the recipient's country.
Localization + cross-border rules
People working for you from Russia
Employment and contractor data of people in Russia is personal data under 152-FZ. Payroll, HR platforms and background checks need a legal basis, consent where required and compliant storage.
152-FZ applies to that data
You process data on a Russian company's behalf
A Russian operator may engage you only under a data processing instruction (Art. 6(3) of 152-FZ) that lists your security obligations. Large Russian clients audit this before signing.
Contractual obligations under 152-FZ
You don't target Russia and receive no Russian data
Occasional visits from Russia to an English-language site with no Russian targeting usually do not trigger 152-FZ. Re-check when you add a Russian version, payment in rubles or a Russian partner.
Usually out of scope
Roskomnadzor can restrict access in Russia to a website that violates the localization rules by adding it to the Register of violators of data subjects' rights. LinkedIn has been blocked in Russia on this ground since 2016.
What 152-FZ compliance requires: 10-point checklist
The list we use to scope a project for a foreign company. Each point is a separate legal requirement checked by Roskomnadzor.
-
Data localization in Russia
Personal data of Russian citizens must be recorded, systematized, accumulated, stored, updated and retrieved using databases located in Russia. Web forms, chats and analytics must send data to Russian servers first. Art. 18(5) of 152-FZ, as amended by Federal Law No. 23-FZ, in force since 1 July 2025 -
Notification to Roskomnadzor and the register of operators
Before processing starts, the operator notifies Roskomnadzor of its purposes, data categories, legal grounds and database locations. Changes must be reported by the 15th of the following month. Art. 22 of 152-FZ; fine for failure to notify — RUB 100,000–300,000 (≈ USD 1,100–3,300) -
Cross-border transfer notification
A separate notification is filed before transferring data abroad, after collecting information from each foreign recipient about its data protection measures. For countries outside the adequacy list, transfers may start only after 10 working days. Art. 12 of 152-FZ; Federal Law No. 265-FZ of 26 July 2026; Roskomnadzor Order No. 253 -
A legal basis for every purpose — and separate consent where needed
Consent is one of several legal grounds. Where it is used, it must be a standalone document. Health data, other special categories and biometrics require written consent. Arts. 6, 9, 10, 11 of 152-FZ; separate consent rule in force since 1 September 2025 -
A published privacy policy in Russian
Every legal entity acting as an operator must adopt a personal data processing policy and give unrestricted access to it — on the website, if data is collected online. Art. 18.1 of 152-FZ; fine for no published policy — RUB 30,000–60,000 (≈ USD 330–670) -
A person responsible for data processing (DPO)
The operator appoints a person responsible for organizing data processing. The law allows this role to be performed by an external legal entity, such as a law firm. Arts. 18.1, 22.1 of 152-FZ -
Internal documents and security measures
Data processing regulations, orders, a harm assessment, a list of employees with access, the security level of each information system and, where required, a threat model. Art. 19 of 152-FZ; Government Decree No. 1119; Roskomnadzor Order No. 178 -
Processing agreements with vendors
Hosting, CRM, payroll and mailing providers process data on your instruction. Each needs a processing instruction with mandatory terms; group companies need intra-group agreements. Art. 6(3) of 152-FZ -
Data subject requests
Requests from users, clients and employees must be answered within 10 working days; the term can be extended by 5 working days with a reasoned notice. Arts. 14, 20 of 152-FZ -
Breach response within 24 and 72 hours
Notify Roskomnadzor of an incident within 24 hours of detection and report the results of the internal investigation within 72 hours. Cookies and web analytics are also in scope: Roskomnadzor treats them as personal data, and foreign analytics such as Google Analytics creates a localization risk. Art. 21(3.1) of 152-FZ
Personal data compliance services in Russia: fees for 2026
Fixed fees in Russian rubles, with US dollar equivalents for reference. Work is done in English; Russian is used for documents that Roskomnadzor and Russian users read.
| Service | Fee | Timing |
|---|---|---|
| Consultation of a personal data lawyer | from RUB 30,000≈ from USD 333 | 1–2 working days |
| 152-FZ compliance audit of a company | from RUB 50,000≈ from USD 556 | from 5 working days |
| Website audit and 152-FZ compliance (forms, cookies, analytics) | RUB 90,000≈ USD 1,000 | from 5 working days |
| Website documents: privacy policy and consent forms | RUB 50,000≈ USD 556 | 2 working days |
| Internal documents: regulations, orders, job instructions | from RUB 100,000≈ from USD 1,111 | from 3 working days |
| Data processing agreement (processing instruction) | from RUB 50,000≈ from USD 556 | 3 working days |
| Notification to Roskomnadzor on processing personal data | RUB 50,000≈ USD 556 | 2 working days |
| Cross-border transfer notification to Roskomnadzor | RUB 90,000≈ USD 1,000 | 5 working days |
| Response to a Roskomnadzor request or demand | RUB 70,000≈ USD 778 | 3 working days |
| Data breach support: 24- and 72-hour notifications, investigation | RUB 15,000 / hour≈ USD 167 / hour | from the first hour |
| Defense during a Roskomnadzor inspection | from RUB 100,000≈ from USD 1,111 | from the first hour |
| Appealing Roskomnadzor fines and decisions | from RUB 300,000≈ from USD 3,333 | 4–8 months on average |
| External DPO: ongoing 152-FZ support | from RUB 50,000 / month≈ from USD 556 / month | ongoing |
| GDPR audit (for groups subject to both regimes) | from RUB 100,000≈ from USD 1,111 | from 5 working days |
Fees as of 3 November 2026. VAT is not charged: Afonin, Bozhor & Partners LLC is not a VAT payer. Fees marked "from" are fixed after we review the task. A typical baseline for a small company with one website — website documents, notification and internal documents — starts at RUB 200,000 (≈ USD 2,222).
USD amounts are indicative and calculated at RUB 90 per USD 1. The fee is fixed in rubles.
How we work with foreign companies
Remote by default: most projects need no travel to Moscow. You get one point of contact and deliverables your global privacy team can review.
Scoping call and NDA
A call in English with your legal or privacy team. We sign an NDA, agree the scope and fix the fee in the engagement letter.
Data flow mapping
A questionnaire and interviews: which Russian data you collect, where it is stored, which vendors and group companies receive it.
Gap analysis report
A report in English: each gap with the legal provision, the fine it carries, priority and the fix. Ready from 5 working days.
Documents in Russian, explained in English
Policies, consents, processing agreements and internal orders are drafted in Russian — the version Roskomnadzor reviews — with English summaries for your team.
Roskomnadzor filings
We prepare the processing and cross-border transfer notifications, collect the required information from foreign recipients and handle questions from the regulator.
Ongoing support
Updates when the law changes, answers to data subject and regulator requests, breach response — or the full external DPO role.
152-FZ vs GDPR: why GDPR compliance is not enough in Russia
The principles are similar, the mechanics are not. The biggest differences for a GDPR-compliant company entering Russia are localization, filings with the regulator and the form of consent.
| Topic | Russia — 152-FZ | EU — GDPR |
|---|---|---|
| Data localization | Mandatory: initial collection of Russian citizens' data only into databases in Russia | No localization requirement |
| Registration with the regulator | Notification to Roskomnadzor before processing; public register of operators | No general registration |
| Cross-border transfers | Separate notification to Roskomnadzor; adequacy list (Order No. 253); regulator may ban or restrict a transfer | Adequacy decisions, SCCs, BCRs; no notification |
| Legal bases | Consent plus other grounds, incl. contract and legitimate interests; in practice consent is relied on more often than in the EU | Six bases; legitimate interests widely used |
| Form of consent | Separate document since 1 Sep 2025; written consent for special categories and biometrics | Freely given, specific, informed, unambiguous; no separate-document rule |
| DPO | Responsible person required for every legal entity; may be an external company | Required only in specific cases |
| Breach notification | To Roskomnadzor within 24 hours, then within 72 hours | To the supervisory authority within 72 hours |
| Maximum fines | Up to RUB 20 million (≈ USD 222,000) for a first leak; 1–3% of revenue, up to RUB 500 million (≈ USD 5.6 million), for a repeat leak | Up to €20 million or 4% of worldwide turnover |
| Criminal liability | Art. 272.1 of the Criminal Code (illegal use and transfer of personal data), since 11 Dec 2024 | Not at EU level |
If you serve users in both Russia and the EU, you need documents that work under both regimes. Our team also advises Russian companies on GDPR compliance.
Penalties for violating Russian data protection law in 2026
Fines for companies under Article 13.11 of the Code of Administrative Offences, as amended by Federal Law No. 420-FZ (in force since 30 May 2025). Officers are fined separately. USD equivalents are indicative, at RUB 90 per USD 1.
| Violation | Fine for a company |
|---|---|
| Repeat data leak | 1–3% of revenue, RUB 25–500 million≈ USD 278,000–5.6 million |
| Leak of biometric data | RUB 15–20 million≈ USD 167,000–222,000 |
| Leak of special categories (e.g. health data) | RUB 10–15 million≈ USD 111,000–167,000 |
| Data leak, by number of data subjects | RUB 3–15 million≈ USD 33,000–167,000 |
| Collecting Russians' data into foreign databases (repeat) | RUB 6–18 million≈ USD 67,000–200,000 |
| Collecting Russians' data into foreign databases | RUB 1–6 million≈ USD 11,000–67,000 |
| Failure to notify Roskomnadzor of a leak | RUB 1–3 million≈ USD 11,000–33,000 |
| Processing without the required written consent | RUB 300,000–700,000≈ USD 3,300–7,800 |
| Processing without a legal basis | RUB 150,000–300,000≈ USD 1,700–3,300 |
| No notification of processing to Roskomnadzor | RUB 100,000–300,000≈ USD 1,100–3,300 |
| No published privacy policy | RUB 30,000–60,000≈ USD 330–670 |
A turnover-based fine for a repeat leak can be reduced if the company proves it spent at least 0.1% of revenue on information security in each of the three years before the incident and complied with mandatory data protection requirements for the year before it.
Transferring personal data out of Russia
Cross-border transfer is allowed, but only for data first collected in Russia, after notifying Roskomnadzor, and on rules that depend on the recipient's country.
EU, UK, Switzerland, Norway, China, India, Japan, Korea, Kazakhstan, Turkey, Brazil and others — 88 countries
- Notification to Roskomnadzor — required
- Information on the recipient's protection measures — required
- Transfers may start right after the notification is filed
For example, the USA and the UAE
- Notification to Roskomnadzor — required
- Information on protection measures and on the country's data protection laws — required
- Transfers may start after 10 working days if Roskomnadzor has not banned or restricted them
Since Federal Law No. 265-FZ of 26 July 2026, being a party to Council of Europe Convention 108 no longer makes a country "adequate" automatically: Roskomnadzor assesses each country's law, regulator and sanctions. The current list was approved by Roskomnadzor Order No. 253 of 16 September 2026, in force since 30 October 2026, replacing Order No. 128 of 2022. Using foreign cloud services, CRM, e-mail platforms or analytics usually counts as cross-border transfer.
Selected data protection cases
International brands, platforms working with Russia's largest companies, and services handling sensitive data.
LG — legal audit of the Russian website and online store
Level Travel — audit of data processing and cross-border transfers
Happy Job — HR platform processing data for enterprise clients
SberHealth — ongoing support for a medical data operator
Who will work on your project
Mikhail Bozhor — Head of Digital Law Practice
Ranked among the Top-30 personal data protection lawyers in Russia by Kommersant Publishing House (individual ranking, 2026). Heads the firm's digital law practice, which includes personal data protection.
Nikita Morozov — Senior Associate and data protection officer (DPO), working with personal data since 2020.
FAQ: Russian personal data law for foreign companies
Does Russia's personal data law apply to a foreign company without a Russian entity?
Yes, if the company targets Russian users. Roskomnadzor considers a website or app to be aimed at Russia if it has a Russian-language version, prices in rubles, delivery to Russia, a .ru domain or advertising aimed at Russian users. Such a company must collect Russians' data into databases in Russia and comply with Federal Law No. 152-FZ. A non-compliant website can be blocked in Russia.
What is data localization in Russia and what changed in 2025?
Localization means that personal data of Russian citizens must be recorded, systematized, accumulated, stored, updated and retrieved using databases located in Russia. Since 1 July 2025, Article 18(5) of 152-FZ directly prohibits using foreign databases for these operations. A web form that sends data to a foreign server first is a violation, even if a copy is later stored in Russia. The fine is RUB 1–6 million (≈ USD 11,000–67,000), and RUB 6–18 million (≈ USD 67,000–200,000) for a repeat violation.
Do we need to notify Roskomnadzor, and who files the notification?
Almost every operator must notify Roskomnadzor before it starts processing personal data (Article 22 of 152-FZ), even if it only processes employee data or website enquiries. The notification lists purposes, categories of data subjects, data categories, legal grounds and the location of databases. It is filed by the operator; we prepare it and guide your team through submission. Failure to notify is fined RUB 100,000–300,000 (≈ USD 1,100–3,300).
Can we transfer personal data from Russia to the EU or the US?
Yes, after the data has been collected in Russia and after a cross-border transfer notification has been filed with Roskomnadzor. EU countries are on the adequacy list approved by Roskomnadzor Order No. 253, so transfers may start right after the notification. The USA is not on the list: transfers may start only after 10 working days if Roskomnadzor has not banned or restricted them, and you must also provide information about US data protection law.
We are GDPR-compliant. Is that enough for Russia?
No. GDPR has no localization requirement, no registration with the regulator, no cross-border transfer notification and no separate-document rule for consent. A GDPR-compliant company usually needs Russian servers for initial collection, two notifications to Roskomnadzor, Russian-language documents and separate consent forms.
Do we need a DPO in Russia? Can it be an external firm?
Every legal entity acting as an operator must appoint a person responsible for organizing personal data processing (Article 18.1 of 152-FZ). The law allows this role to be performed by an external legal entity, and its name is then stated in the notification to Roskomnadzor. Our external DPO service starts at RUB 50,000 (≈ USD 556) per month.
Can we use Google Analytics or a foreign CRM for Russian users?
Not for initial collection of Russians' data. Roskomnadzor treats cookies and analytics data as personal data, so foreign analytics and CRMs that receive data directly from Russian users create a risk of a fine of up to RUB 6 million (≈ USD 67,000). The usual solution is Russian analytics and a Russian database that receives data first, with transfer to global systems after a cross-border transfer notification.
Do the privacy policy and consent have to be in Russian?
In practice, yes. Documents addressed to Russian users, clients and employees must be understandable to them, consumer information in Russia must be provided in Russian, and Roskomnadzor reviews the Russian text. We draft the Russian version and provide English summaries so your global privacy team can review them.
What should we do in the event of a data breach in Russia?
Stop the leak and record what happened, then notify Roskomnadzor within 24 hours of detection about the incident, its likely causes, the harm and the measures taken. Within 72 hours, report the results of the internal investigation (Article 21(3.1) of 152-FZ). Failure to notify is fined RUB 1–3 million (≈ USD 11,000–33,000) on top of the fine for the leak itself.
How much does 152-FZ compliance cost and how long does it take?
A consultation starts at RUB 30,000 (≈ USD 333), a company audit at RUB 50,000 (≈ USD 556), and a Roskomnadzor notification costs RUB 50,000 (≈ USD 556). For a small company with one website, a baseline package — website documents, notification and internal documents — starts at RUB 200,000 (≈ USD 2,222). The final fee and timing depend on the number of websites and systems, data categories and cross-border transfers. USD amounts are indicative, at RUB 90 per USD 1.
Legal sources
Laws
- Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" — current version (in Russian)
- Code of Administrative Offences, Article 13.11 — fines for data protection violations
- Criminal Code, Article 272.1 — illegal use and transfer of personal data
Amendments 2024–2026
- Federal Law No. 420-FZ of 30.11.2024 — turnover-based fines for leaks, in force since 30.05.2025
- Federal Law No. 421-FZ of 30.11.2024 — criminal liability, in force since 11.12.2024
- Federal Law No. 156-FZ of 24.06.2025 — consent as a separate document, since 01.09.2025
- Federal Law No. 265-FZ of 26.07.2026 — new rules for cross-border transfers
Roskomnadzor
- Roskomnadzor Order No. 253 of 16.09.2026 — list of 88 countries with adequate data protection, in force since 30.10.2026
- Roskomnadzor personal data portal — register of operators, notification forms
- Data breach notification on the Roskomnadzor portal
EU
OGRN 1187746441255
INN/KPP 7707413213/770901001
Personal data processing policy
Offer Agreement for the Provision of Legal Services
By clicking the "OK" button, you consent to the processing of information using recommendation technologies in accordance with the personal data processing policy and the rules for the use of recommendation technologies