Introduction
In Russia, the definition of personal data is rather broad; any
information which is directly or indirectly related to an
identified or identifiable individual, is considered to be personal
data under Article 3 of the Federal Law of 27 July 2006 No. 152-FZ
on Personal Data (as amended) ('the Personal Data Law').
The Russian personal data landscape and legal regime are regulated
mainly by the Personal Data Law. The Personal Data Law has
undergone several changes and developments recently.
Administrative sanctions for the breach of the Personal Data Law
are set in the Code of Administrative Offences ('the Code')
in particular, in Article 13.11, which contains certain sanctions
for violation of provisions on the collection, storage, use and
distribution of data related to individuals as established by the
Personal Data Law. Prior to 1 July 2017, under that article, the
maximum administrative fine which a company could face for a
typical data protection or
