The factor "Data Processing Based on Contract or Consent by Data Subject in Jurisdiction" means that the law is applicable to the processing of personal data by foreign entities or individuals when such processing is based on contractual relationships, agreements, or consent involving citizens of the jurisdiction in question. This factor extends the territorial scope of data protection laws to include foreign entities engaged in data processing activities involving the jurisdiction's citizens, regardless of the physical location of the processing. Let's examine how this factor is applied in different jurisdictions:

Russia - Federal Law No. 152-FZ on Personal Data

Article 1(1.1) states: "The provisions of this Federal Law shall apply to the processing of personal data of citizens of the Russian Federation carried out by foreign legal entities or foreign individuals on the basis of an contract to which citizens of the Russian Federation are a party, other agreements between foreign legal entities, foreign individuals and citizens of the Russian Federation or on the basis of the consent of a citizen of the Russian Federation to the processing of his/her personal data."

Key points:

• Applies to processing of Russian citizens' data by foreign entities or individuals
• Covers processing based on contracts with Russian citizens
• Includes other agreements between foreign entities/individuals and Russian citizens
• Extends to processing based on consent from Russian citizens
• Broadens the law's reach to foreign entities handling Russian personal data