Navigating Amendments To Russian Personal Data Law

Introduction

In Summer 2022, Russia significantly amended its Personal Data Law (Federal Law on Personal Data No.152-?? dated 27 July 2006). The new rules and restrictions concern, among other things:

• cross-border transfers;
• the extra-territorial application of the law; and
• data breach notification procedures.

This article outlines the key amendments and provides guidance on how businesses can ensure their compliance.

Extra-territorial scope

Currently, the Personal Data Law applies within the borders of Russia. According to guidance from the Ministry of Digital Development, Communications and Mass Media, it also applies to international websites that contain content in Russian and meet other criteria which indicate that "the website owner seeks to expand its business over the Russian market".