Russia Adopts New Rules On Cross-border Data Transfers

On 1 March 2023, amendments to article 12 of the Federal Law on Personal Data No.152-?? dated 27 July 2006 (PDL) established transfer impact assessments and filings with the data protection authority as the pre-conditions for cross-border personal data transfers. In certain cases, Russia may suppress outgoing data flows in an extra-judicial procedure. This article outlines the legislative changes and suggests how the affected companies should comply.

Scope of application

The amendments to article 12 of the PDL apply to any data exporter that intends to transfer personal data from Russia to any importer (governmental body, natural person or legal entity) situated outside that country (The amendments were established by Federal Law No.266-??, dated 14 July 2022). The nationality of data subjects does not matter. The new rules do not affect personal data flowing into the territory of Russia.