New Russian Law Will Require Personal Data of Russian Citizens to be Processed on Servers Located in Russia

In July 2014, Russian Federation President Vladimir Putin signed Federal Law No. 242-FZ (the "Law"), which amends existing Russian data privacy laws to require that personal data of Russian citizens be processed by servers within Russian borders. The localization requirements in the Law were presented as being designed to provide Russian citizens with more control over their personal data and as a security measure in light of the Ukrainian crisis.

Parties subject to the law

The Law applies to "data operators," a term broadly defined to include any entity that solely or jointly organizes or performs the processing of personal data and also determines the purpose and scope of such processing. "Personal data" is also defined broadly to include any information "directly or indirectly related to any identified or potentially identifiable person." The Russian press has reported that the Law applies to foreign companies, even if they have no representative office or branch in Russia.

Localization requirements

Before starting any processing of personal data, data operators are required to notify the Roskomnadzor, the state authority responsible for the Law and Russian telecommunications, of the location of the servers where Russian personal data will be processed. Servers processing Russian personal data must be located within the territory of the Russian Federation. However, the Law does not expressly prohibit cross-border transfer of this information once processed. As a result, there is some ambiguity as to whether the Law will continue to permit the transfer of personal data to support or back-up servers outside Russia. It is expected that this ambiguity will be clarified when the Roskomnadzor publishes its policy for enforcement of the Law to provide data operators with guidance to ensure compliance.

Consequences of non-compliance

Failure to comply with the Law could result in the website or service being blocked or restricted from within Russia by the Roskomnadzor.

Effective date

The Law currently features an effective date of September 1, 2016. However, in September 2014, the Russian Parliament approved an amendment to the Law (the "Amendment") to accelerate the effective date to January 1, 2015. To become law, this Amendment must be approved by the lower and upper chambers of the Russian Parliament and signed by the President.

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.