In July 2014, Russian Federation President Vladimir Putin signed Federal Law No. 242-FZ (the "Law"), which amends existing Russian data privacy laws to require that personal data of Russian citizens be processed by servers within Russian borders. The localization requirements in the Law were presented as being designed to provide Russian citizens with more control over their personal data and as a security measure in light of the Ukrainian crisis.

Parties subject to the law

The Law applies to "data operators," a term broadly defined to include any entity that solely or jointly organizes or performs the processing of personal data and also determines the purpose and scope of such processing. "Personal data" is also defined broadly to include any information "directly or indirectly related to any identified or potentially identifiable person." The Russian press has reported that the Law applies to foreign companies, even if they have no representative office or branch in Russia.

Localization requirements

Before starting any processing of personal data, data operators are required to notify the Roskomnadzor, the state authority responsible for the Law and Russian telecommunications, of the location of the servers where Russian personal data will be processed. Servers processing Russian personal data must be located within the territory of the Russian Federation. However, the Law does not expressly prohibit cross-border transfer of this information once processed. As a result, there is some ambiguity as to whether the Law will continue to permit the transfer of personal data to support or back-up servers outside Russia. It is expected that this ambiguity will be clarified when the Roskomnadzor publishes its policy for enforcement of the Law to provide data operators with guidance to ensure compliance.

Consequences of non-compliance

Failure to comply with the Law could result in the website or service being blocked or restricted from within Russia by the Roskomnadzor.

Effective date

The Law currently features an effective date of September 1, 2016. However, in September 2014, the Russian Parliament approved an amendment to the Law (the "Amendment") to accelerate the effective date to January 1, 2015. To become law, this Amendment must be approved by the lower and upper chambers of the Russian Parliament and signed by the President.