From 01.07.2025 the Federal Law No. 23-FZ dated 28 February 2025 “Concerning Personal Data and Certain Legislative Acts of the Russian Federation" (hereinafter referred to as the Federal Law) will enter into force, containing a new version of part 5 of Article 18 of Federal Law No. 152-FZ
|
Version of part 5 of Article 18 of Federal Law No. 152-FZ (valid until 01.07.2025) |
Version of part 5 of Article 18 of Federal Law No. 152-FZ (effective from 01.07.2025)
|
|
"When personal data is collected, including via the Internet, an Operator shall be obliged to ensure the recording, systematization, capture, storage, refinement (updating, amendment) and retrieval of personal data of Russian citizens takes place using databases located in the territory of the Russian Federation, except in the cases specified in clauses 2,3,4 and 8 of part 1 of Article 6 of Federal Law No.152-FZ."
|
"When personal data is collected, including via the Internet, the recording, systematization, capture, storage, refinement (updating, amendment) and retrieval of personal data of Russian citizens using databases located outside the territory of the Russian Federation shall not be permitted, except in the cases specified in clauses 2,3,4 and 8 of part 1 of Article 6 of Federal Law No. 152-FZ."
|
Summary of the difference in Personal Data (PD) localization requirements
|
|
|
Emphasis on the Operator’s obligation when Personal Data is collected to ensure the specified actions to process personal data using Russian databases.
|
Emphasis on the explicit prohibition when Personal Data is collected on specified processing actions using databases of data located outside the Russian Federation. The Operator is removed as a subject of a previously positive obligation.
|
|
Indicated actions on processing of Personal Data are allowed outside the Russian Federation after initial collection of personal data using the database in the territory of the Russian Federation (for example, through cross-border transfer of Personal Data subject to notification of the Roskomnadzor “RKN”).
|
The list of specified actions for processing of Personal Data and the condition "When personal data is collected, including via the Internet " -remain unchanged compared to the current version, but the new version prohibits their implementation using foreign databases.
|
|
Important: requirements apply not only to the Operators, but also to the persons processing Personal Data on behalf of the Operator (“Processors”) by virtue of the requirements of part 3 of Article 6 of Federal Law No. 152-FZ. At the same time, there is no special administrative liability for violation of this requirement by Processors - part 8 of Article 13.11 of the Code of Administrative Offenses of the Russian Federation has not undergone a number of recent amendments the Code of Administrative Offenses of the Russian Federation in terms of liability for offences related to processing of Personal Data. The maximum fine for violation of the localization requirements for the Operator is up to RUB 6 million for a primary violation and up to RUB 18 million for a repeated violation.
|
|
How will the new ban affect the possibility of cross-border transfer of PD?
The requirement to prohibit the above list of actions related to the processing of Personal Data of citizens of the Russian Federation using foreign databases first of all concerns cases of primary collection of Personal Data in databases located outside the territory of the Russian Federation, the new requirement does not directly prohibit the cross-border transfer of Personal Data, as the transfer (provision, distribution, access) is a separate operation related to the processing of Personal Data that is not named in the list of part 5 of Article 18 of Federal Law No.152-FZ, which formally does not exclude the possibility of transferring personal data to the territory of other countries after the completion of the purposeful processing of Personal Data, taking into account the above prohibitions. However, the mass media have previously expressed a different position of the State Duma representatives, implying that the amendments should be interpreted as a complete ban on the cross-border transfer of Personal Data of citizens of the Russian Federation. Additional clarifications by the authorized bodies of the new version of the norm, as well as clarification of the interpretation of operations involving the processing of Personal Data (i.e. collection of Personal Data) will help in the formation of a uniform practice of application of the requirements of the new version of Federal Law. In this regard, we will closely monitor the development of law enforcement practice and the regulator's position.
To prepare for the new changes, we recommend:
-
Identify the processes of processing of Personal Data, which are accompanied by cross-border transfer of Personal Data, involvement of third parties in processing of personal under the assignment model, data as well as initial collection of Personal Data in databases located in foreign countries;
-
Determine the ways of localization, as well as updating, replenishment, change of databases located in the territory of the Russian Federation, as well as the ways of transferring the specified databases to the territory of the Russian Federation/access of foreign persons to these databases;
-
Verify notification of cross-border transfer of Personal Data, existence of relevant legal grounds and purposes of processing;
-
Check contracts with third parties involved in processing of Personal Data under the assignment model for compliance with legal requirements;
-
Identify and assess the risks of the company's decisions and positions on processing of Personal Data, as well as opportunities to change them in order to comply with the new version of Federal Law.
We are ready to help you analyze the relevant business processes and IT solutions, check the necessary local regulations on the procedure for processing of Personal Data, as well as the Notifications to the RKN. Lidings experts are ready to provide risks assessment and ways to minimize them in order to comply the procedure for processing of Personal Data with the new requirements on localization of Personal Data of citizens of the Russian Federation.