On September 1, 2015, Russia’s new law requiring data localization, Russian Federal Law No. 242-FZ (“Russia’s Data Localization Law”) became effective. Although Russia’s Data Localization Law makes multiple changes to existing laws, a single sentence contains the core of the new obligation that parties operating in Russia have:

When collecting personal data, including by means of the information and telecommunication network “Internet” the operator must provide the recording, systematization, accumulation, storage, adjustment (update, alteration), retrieval of personal data of citizens of the Russian Federation with the use of databases located in the territory of the Russian Federation, except for the cases specified in paragraphs 2, 3, 4, 8 of Article 6(1) of [Federal Law No. 152-FZ “On Personal Data”].