Meet Russia's 152-FZ personal data obligations with less effort

152-FZ is Russia's Federal Law No. 152-FZ "On Personal Data", adopted on 27 July 2006. It is the country's main data protection law and sets the principles and conditions for processing personal data, consent rules, data subject rights, operator obligations and security measures. It is enforced by Roskomnadzor, the federal communications and data protection regulator, and has been amended many times, including rules on localisation, breach notification and cross-border transfers.

Any operator that processes personal data of individuals in Russia must comply with 152-FZ, whether it is a Russian or foreign organisation. An operator is the person or organisation that organises processing and decides its purposes, similar to a controller under the GDPR. Foreign companies that collect personal data of Russian citizens, for example through websites, apps or employment, are generally treated as within scope.

Article 18(5) of 152-FZ requires that, when personal data of Russian citizens is collected, including over the internet, its recording, systematisation, accumulation, storage, updating and retrieval must not use databases located outside Russia, apart from limited exceptions in Article 6. The rule has applied since September 2015 and was tightened in 2025. Data can still be transferred abroad afterwards, subject to the cross-border transfer rules in Article 12.

Under Article 21(3.1) of 152-FZ, an operator must notify Roskomnadzor within 24 hours of identifying an unlawful or accidental transfer of personal data that breaches data subjects' rights. The first notice covers the incident, its likely causes, the expected harm, remedial measures and a contact person. Within 72 hours the operator must report the results of its internal investigation and, where known, the people responsible.

Breaches of 152-FZ are punished mainly through administrative fines under Article 13.11 of Russia's Code of Administrative Offences, and in serious cases through criminal liability. Amendments in force since 30 May 2025 introduced much higher fines for personal data leaks, scaled to the number of people affected, and turnover-based fines for repeat leaks. Roskomnadzor can also restrict access to websites that process data unlawfully.

152-FZ and the GDPR share core ideas: lawful grounds for processing, purpose limitation, consent, data subject rights and appropriate security. 152-FZ differs in requiring data localisation in Russia, prior notification to Roskomnadzor before processing and before cross-border transfers, and stricter written consent formalities in some cases. GDPR controls give a strong starting point, but 152-FZ needs additional, Russia-specific steps.

Complying with 152-FZ usually means mapping where personal data of individuals in Russia is collected and stored, confirming a lawful basis or consent, and localising primary databases in Russia. Operators also notify Roskomnadzor, publish a processing policy, appoint a person responsible for processing, implement Article 19 security measures and set up incident notification. Russian legal counsel should confirm the localisation and notification steps.

Yes. 152-FZ is supported in OneClickComply today. Controls you already run for GDPR, ISO 27001 or SOC 2 can be reused against 152-FZ articles, with evidence collected automatically and policies generated from your environment. OneClickComply does not provide Russian legal advice, so localisation and Roskomnadzor notifications should be confirmed with local counsel.