The framework
Russia's framework rests on Federal Law No. 152-FZ on Personal Data, adopted in 2006, with Roskomnadzor as the supervisory authority.
That puts Russia in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Federal Law 242-FZ (localization amendment)
Requires initial recording, systematization, storage and updating of Russian citizens' personal data using databases located in Russia.
2025 liability amendments
Introduced turnover-based administrative fines for personal data leaks (up to 3% of annual revenue within set floors and caps), higher fixed fines, and criminal liability for trading in stolen personal data.
Federal Law 265-FZ
Ends the automatic adequacy status of Convention 108 parties for cross-border transfers; only countries on Roskomnadzor's list now qualify, which leaves the regulator free to narrow the list.
Marketing and advertising
Written or clearly demonstrable consent is the default basis, and since 1 September 2025 it must be obtained as a separate document; separate consent for dissemination; strict formalities. That single sentence decides most channel plans here.
Cross-border transfers
Prior notification to Roskomnadzor for cross-border transfers; since 26 July 2026 only countries on Roskomnadzor's list count as adequate, and Convention 108 membership no longer qualifies on its own. Since 1 July 2025, Russian citizens' data may not be processed in databases located abroad.
Enforcement and penalties
From May 30, 2025, leak-related fines reach turnover-based levels up to 3%, plus large fixed fines and criminal liability for illegal data trafficking.