Federal Law No. 152-FZ on Personal Data

Applies to processing by entities in Russia and, as applied by the regulator (Roskomnadzor), to foreign entities whose websites or services are directed at Russian territory (Russian-language interfaces, ruble pricing, .ru domains, Russia-targeted advertising). The defining obligation is data localization: personal data of Russian citizens must be recorded, systematized, accumulated, stored, amended, and retrieved using databases physically located in Russia — a primary-copy requirement, so cross-border transfer is permitted only after the Russian database is populated first. Cross-border transfers additionally require prior notification to Roskomnadzor, which can suspend them. Federal Law No. 420-FZ (signed November 30, 2024, penalties effective from 2025) introduced turnover-based administrative fines for data leaks and criminal liability for the illegal handling of personal data. Sanctions-related restrictions may independently affect whether a foreign business can lawfully operate here at all — a separate question from data-protection compliance.