Clarifications Published On Russia's Personal Data Localization Law

On August 3, 2015, the Russian Ministry of Communications and Mass Media (commonly referred to as "Minsviaz") published detailed—and the only written—guidelines clarifying the new personal data localization requirements implemented by the Amendments to the Personal Data Law,¹ signed into law by Russian President Vladimir Putin on December 31, 2014. A summary of the new law can be found in June 15, 2015 Duane Morris Alert on this topic.

The new law became effective on September 1, 2015, and mandates that data operators,² while collecting personal data about Russian citizens, must "record, systematize, accumulate, store, amend, update and retrieve" data using databases physically located in Russia. This law apparently makes Russia one of the few countries in the world, including China, Vietnam, Indonesia and Malaysia, that require the personal information of its citizens generally to be kept on locally housed servers. The guidelines, largely in the form of answers to