Material Applicability

The Russian Federal Law on Personal Data (№ 152-FZ) includes several material applicability factors: automated means criterion, prospective filing system inclusion, and specific exemptions for personal/domestic use, state secrets, archival processing, and judicial proceedings.

Automated Processing and Filing Systems

№ 152-FZ Art.1(1):

"This Federal Law regulates activities related to the processing of personal data [...] both automatically, including in data telecommunications networks, and without the use of such means, provided that the data processing is by its nature similar to the actions(operations) of automatic data processing"

The law applies to:

• Processing by automated means, including telecommunications networks
• Non-automated processing that enables systematic data retrieval
• Structured filing systems allowing search and access to personal data

Exemptions

№ 152-FZ Art.1(2)(1):

"The operation of this Federal Law does not apply to activities related to: Personal data processing by private entities exclusively for personal or family needs, provided that such processing does not infringe upon the rights of the data subject"

№ 152-FZ Art.1(2)(2):

"Arrangement of storage, compilation, registration, and use of personal data contained in files kept by the Archival Fund of the Russian Federation and in other archive files"

№ 152-FZ Art.1(2)(4):

"Processing of personal data according to the established procedure for information that contains state secrets"

The law excludes:

• Personal/domestic processing (if not infringing rights)
• Archival processing under specific legislation
• Processing of state secrets
• Judicial proceedings (governed by Federal Law N 262-FZ)

Territorial Applicability

The law's territorial scope is determined by two main factors: citizenship of data subjects and the basis for processing.

№ 152-FZ Art.1(1.1):

"The provisions of this Federal Law shall apply to the processing of personal data of citizens of the Russian Federation carried out by foreign legal entities or foreign individuals on the basis of an contract to which citizens of the Russian Federation are a party, other agreements between foreign legal entities, foreign individuals and citizens of the Russian Federation or on the basis of the consent of a citizen of the Russian Federation"

The law applies to:

• Processing of Russian citizens' data by foreign entities based on:
  • Contracts with Russian citizens
  • Other agreements involving Russian citizens
  • Consent from Russian citizens
• Processing activities regardless of the processor's location