Russian Cyber Law

Mon, 06 Jul 2026 00:00:00 +0000

Federal Law No. 152-FZ on Personal Data

Federal Law No. 152-FZ of 27 July 2006 on Personal Data serves as the foundational data protection statute in the Russian Federation. The Law defines personal data as any information relating directly or indirectly to a specific or identifiable individual (Article 3(1)), establishes principles for data processing including lawfulness, fairness, purpose limitation, data minimisation, and accuracy, and grants data subjects rights of access, rectification, erasure, and restriction of processing. The Law requires data controllers to notify Roskomnadzor, the Federal Service for Supervision of Communications, Information Technology and Mass Media, before commencing personal data processing operations (Article 22), with exceptions for processing relating to employment, civil contracts, religious and public organisations, and certain other categories. The Law establishes the Legal Registers of Personal Data and imposes obligations on operators to ensure the confidentiality of personal data and to implement technical and organisational measures to protect it from unauthorised or accidental access, destruction, modification, blocking, copying, and dissemination. Violations of 152-FZ carry administrative penalties under the Code of Administrative Offences, including fines for legal entities of up to 75,000 roubles for processing in violation of the Law, increased to up to 500,000 roubles for failure to comply with the data subject access obligations. Criminal liability under Article 137 of the Criminal Code applies for unlawful collection or dissemination of personal data without consent.

cyber law on ExcellentWiki - Legal Encyclopedia

Russian Cyber Law

Federal Law No. 152-FZ on Personal Data