Federal Law No. 152-FZ on Personal Data — incident notification to Roskomnadzor

Russia runs a two-stage clock that is materially tighter than the GDPR's at the front end: an initial notification to Roskomnadzor within 24 hours of detecting an incident involving unlawful or accidental transfer of personal data, stating the suspected cause, the likely harm, and the measures taken; then, within 72 hours, the results of the operator's internal investigation, including information about the persons whose actions caused the incident. Note this sits on top of Russia's separate data-localisation requirement (Art. 18(5)), which is usually the harder constraint for a foreign business. Marked 'check': the deadlines are consistently reported across independent legal-reference sources but the primary text is Russian-language only and the enforcement practice around what counts as 'detection' was not verified against a primary source.