Multinationals Beware: New Russian Data Localisation Law Already Being Enforced

Russia's new law requiring the local storage of personal data of Russian citizens in databases on Russian territory came into force on 1 September 2015. The new law is very broad and new obligations are stretchable and can fit almost any situation where personal data of Russians are processed. This includes data collected by foreign operators without permanent establishment in the Russian Federation. To date, enforcement authorities have not issued any official clarifications. Recent unofficial explanatory notes by the Ministry of Communications and sporadic publications by the Russian data protection authority provide some guidance on how the supervisory authorities are inclined to interpret the new law. The new law has already been used to block a website that is violating localisation and data protection requirements. Foreign companies with Russian offices or with companies that target Russian individuals, for example, via Russian language websites, are advised to