Russia's New Data Law

Russia's new Data Localisation Law went live yesterday on 1 September. Many companies with operations in Russia are scratching their heads about how to comply.

The Basics

The new law applies to businesses with a physical presence in Russia or with websites "directed at" Russian users (eg. sites that use Russian domain names, Russian language or transact in roubles are all likely to be caught).

The new rules say that where you collect data about Russian citizens, you must store it on a database in Russia. This doesn't have to be the exclusive location for processing. It is sufficient that the Russian database is your primary or "entry-level" database. You can export the data outside Russia subject to compliance with the usual data protection export rules (these will usually require individual consents and transfer agreements).