On Tuesday, February 18, the State Duma passed in the second and third reading a bill explicitly prohibiting the collection of personal data of Russians using foreign databases. The document comes into force on 1 July 2025, provided it is approved by the Federation Council (upper chamber of the parliament) and then signed by the President.
The law now explicitly prohibits to use databases located abroad to process (including, e.g., recording, systematization, accumulation, storage, adjustment (update, alteration), retrieval) personal data of Russian citizens. The only exceptions are made to processing abroad which is:
Obviously, none of the above exceptions applies to ordinary commercial activity. The rule can also be interpreted as a hard prohibition of cross-border data transfers of Russian citizens’ data. It remains to be seen how the new law would be interpreted by Roskomnadzor and courts, although, the most conservative approach is likely to be expected.
It should be noted that Mr. Sergei Boyarsky, the head of the State Duma's committee on information policy, told Forbes that “The meaning of the amendment is that the databases with the personal data of our citizens should be located exclusively in our country and have no copies outside its territory, except for the data of diplomatic workers and employees of Russian media who work abroad.”
The law now explicitly prohibits to use databases located abroad to process (including, e.g., recording, systematization, accumulation, storage, adjustment (update, alteration), retrieval) personal data of Russian citizens. The only exceptions are made to processing abroad which is:
- Pursuant to an international agreement to which Russia is a party (e.g., airlines and their agents) or law;
- Necessary to fulfill the functions, authorities, and responsibilities of the controller imposed by law;
- To render justice;
- To perform functions of the Russian federal government or a Russian municipal government; or
- To pursue professional journalism, lawful mass media activity, lawful scientific activity, lawful literary activity, or other lawful creative activity, unless doing so infringes on the rights and lawful interests of the individual concerned.
Obviously, none of the above exceptions applies to ordinary commercial activity. The rule can also be interpreted as a hard prohibition of cross-border data transfers of Russian citizens’ data. It remains to be seen how the new law would be interpreted by Roskomnadzor and courts, although, the most conservative approach is likely to be expected.
It should be noted that Mr. Sergei Boyarsky, the head of the State Duma's committee on information policy, told Forbes that “The meaning of the amendment is that the databases with the personal data of our citizens should be located exclusively in our country and have no copies outside its territory, except for the data of diplomatic workers and employees of Russian media who work abroad.”