Applicability of Russia's Federal Law No. 152-FZ "On Personal Data" (Russia PD Law)

Data protection in Russia is governed by federal legislation that establishes the legal framework for personal data processing. The primary role in Russia's data protection is fulfilled by the Federal Law No. 152-FZ "On Personal Data" (Федеральный закон от 27 июля 2006 г. № 152-ФЗ «О персональных данных»), which serves as the foundational legal instrument regulating personal data processing activities.

The Russia PD Law was adopted on July 27, 2006 and became effective on the same date. Since its enactment, the law has undergone multiple amendments to address evolving data protection requirements and technological developments.

The most recent amendments to the act were introduced through Federal Law No. 446-FZ of 28.02.2025, which was adopted on February 28, 2025 and became effective on July 1, 2025. This amending act represents the latest legislative updates to Russia's personal information protection framework.

Material Applicability

The Russian Federal Law on Personal Data (№ 152-FZ) includes several material applicability factors: automated means criterion, prospective filing system inclusion, and specific exemptions for personal/domestic use, state secrets, archival processing, and judicial proceedings.

Automated Processing and Filing Systems

№ 152-FZ Art.1(1):

"This Federal Law regulates activities related to the processing of personal data [...] both automatically, including in data telecommunications networks, and without the use of such means, provided that the data processing is by its nature similar to the actions(operations) of automatic data processing"

The law applies to:

• Processing by automated means, including telecommunications networks
• Non-automated processing that enables systematic data retrieval
• Structured filing systems allowing search and access to personal data

Exemptions

№ 152-FZ Art.1(2)(1):

"The operation of this Federal Law does not apply to activities related to: Personal data processing by private entities exclusively for personal or family needs, provided that such processing does not infringe upon the rights of the data subject"

№ 152-FZ Art.1(2)(2):

"Arrangement of storage, compilation, registration, and use of personal data contained in files kept by the Archival Fund of the Russian Federation and in other archive files"

№ 152-FZ Art.1(2)(4):

"Processing of personal data according to the established procedure for information that contains state secrets"

The law excludes:

• Personal/domestic processing (if not infringing rights)
• Archival processing under specific legislation
• Processing of state secrets
• Judicial proceedings (governed by Federal Law N 262-FZ)

Territorial Applicability

The law's territorial scope is determined by two main factors: citizenship of data subjects and the basis for processing.

№ 152-FZ Art.1(1.1):

"The provisions of this Federal Law shall apply to the processing of personal data of citizens of the Russian Federation carried out by foreign legal entities or foreign individuals on the basis of an contract to which citizens of the Russian Federation are a party, other agreements between foreign legal entities, foreign individuals and citizens of the Russian Federation or on the basis of the consent of a citizen of the Russian Federation"

The law applies to:

• Processing of Russian citizens' data by foreign entities based on:
  • Contracts with Russian citizens
  • Other agreements involving Russian citizens
  • Consent from Russian citizens
• Processing activities regardless of the processor's location