Amendments to the Personal Data Law[1], which directly prohibit recording, systematization, accumulation, storage, updating and retrieval of RF citizens’ personal data in course of collection thereof using databases located abroad will go into force on July 1, 2025.
There are concerns that the new regulation may be construed as a total ban on any cross-border transfers of personal data of RF citizens because such transfer inevitably results in at least accumulation, storage and retrieval of personal data in foreign databases. However, in our opinion such conclusion is not correct because:
The Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roscomnadzor) in its not public answer to an inquiry of an attorney-at-law of our law firm has confirmed the correctness of our approach. The regulatory institution has pointed out that the introduced amendment does not set any limitations on cross-border transfer of personal data which was earlier collected and processed using databases located within the RF territory. Therefore, cross-border transfer of personal data and subsequent storage and retrieval thereof in foreign databases in volumes not exceeding the volume of personal data processed in Russia is not prohibited by new regulations.
This conclusion is essential for Russian companies which retain international presence. It confirms the possibility of continuation of cross-border flow of RF citizens’ personal data subject to observance of the terms established by the law (including localization of the initial processing and receipt of data subject’s consent).
* * *
We provide all-round legal support in the development and implementation of reliable procedures for personal data processing that ensure compliance with the current requirements of laws.
[1] Amendments have been made to Part 5 of article 18 of the Federal Law dd. July 27, 2006 N 152-ФЗ “On Personal data”.
