Russian Federal Law 152-FZ on Personal Data: Key Requirements

Who 152-FZ applies to

Federal Law No. 152-FZ "On Personal Data" governs everything you do with information about people: collecting, recording, storing, using, transferring and deleting it. Personal data is not only passport details. A name and phone number in a website lead form, an email address or an IP address linked to an account all count.

The law is not limited to Russian legal entities. If your site or service targets a Russian audience (Russian language, prices in rubles, a .ru domain, advertising in Russia) and collects data of Russian citizens, Roskomnadzor, the regulator, considers the requirements to apply to you.

For a studio or contractor based in Uzbekistan, two roles matter:

• operator — you decide why and how data is processed, for example when collecting leads on your own website;
• processor on instruction — you handle a client's data, for example by building or supporting their CRM. You then need a data processing instruction agreement listing the permitted actions and security requirements, while the client remains responsible to the individuals.

This is not legal advice; the law changes often, so check the current version.

Notifying Roskomnadzor

An operator must file a notification with Roskomnadzor before processing starts. Since 2022 the list of exemptions has been cut sharply, so almost anyone collecting customer or user data now needs to file. It can be done online through the personal data portal. When details change, such as new purposes, data categories or storage location, the notification must be updated.

Cross-border transfer is handled separately: you must notify Roskomnadzor in advance of any plan to transfer data abroad, for example to a foreign cloud service.

Consent to processing

Consent must be specific, informed, conscious and unambiguous. For a website form this means:

• a checkbox that is not pre-ticked;
• a link to the consent text: who the operator is, which data, purposes, actions, retention period and how to withdraw;
• consent presented separately from terms of service, offers and the privacy policy — an explicit legal requirement since 1 September 2025;
• a separate consent for newsletters and marketing calls, distinct from consent to process the enquiry.

Signed written consent is required in special cases, such as special categories of data and biometrics. Data that a person allows to be made public (a published review with a photo, an open directory listing) needs its own consent form.

Localization of Russian citizens' data

Article 18(5) requires that recording, systematization, accumulation, storage, updating and retrieval of Russian citizens' data be carried out using databases located in Russia. 2025 amendments made the ban on initial collection through foreign databases explicit.

In technical terms:

• a website lead lands first in a database on a server in Russia and only then may be copied elsewhere, following cross-border transfer rules;
• forms on foreign site builders, foreign CRMs and spreadsheets do not work as primary storage;
• a Telegram bot that accepts requests must also save them to a database located in Russia.

Required documents and measures

An operator's minimum set:

Breaches and fines

After a breach, the operator must notify Roskomnadzor within 24 hours of the incident and within 72 hours of the results of its internal investigation.

Penalties are set mainly by Article 13.11 of the Russian Code of Administrative Offences. Amounts depend on the type of violation and on who committed it: an individual, an official or a company. Since 2025 there are separate, higher fines for data leaks: the amount depends on how many people and records are affected, and repeat leaks can trigger turnover-based fines. For companies, several offences carry fines in the millions of rubles. Violating localization can also put a site on the regulator's register of violators and lead to access restrictions, and illegal use or transfer of personal data now carries criminal liability.

Short checklist

1. Define your role: operator or processor on instruction.
2. File a notification with Roskomnadzor, plus a separate one for cross-border transfers.
3. Move primary storage of Russians' data to a server in Russia.
4. Publish a policy and place a separate consent next to every form.
5. Appoint a responsible person and prepare internal documents.
6. Rehearse a breach scenario with the 24 and 72-hour deadlines.