Introduction
The General Data Protection Regulation (Regulation (EU)
2016/679) ('GDPR') and the Federal Law of 27 July 2006 No.
152-FZ on Personal Data ('the Law on Personal Data') both
aim to guarantee protection for individuals' personal data and
apply to organisations that collect, use, or share such data.
In particular, both laws share similar provisions, for example,
in relation to legal basis for processing. Under both the GDPR and
the Law on Personal Data, data processing shall only be lawful if
the data subject has given consent to processing, where processing
is necessary for the performance of a contract, as well as for
compliance with a legal obligation, among other things. In
addition, the GDPR and the Law on Personal Data both outline fairly
consistent cross-border data transfers obligations, providing that
such transfers only take place to countries ensuring an adequate
level of protection. Moreover, both laws are fairly consistent in
relation to the
