On 31 December, the Russian President signed into Federal Law No. 526-FZ a proposal to change the effective date of Russia’s Data Localization Law, first passed last summer, from 1 September 2016 to 1 September 2015. This follows our earlier report that the State Duma (the lower chamber of the Russian Parliament) approved the legislation on 17 December, after which it was approved by the Federation Council (the upper chamber) on 25 December.
Under the Data Localization Law, businesses collecting data of Russian citizens, including on the Internet, are obliged to record, systematize, accumulate, store, update, change, and retrieve the personal data of Russian citizens in databases located within the territory of the Russian Federation.
There still have not yet been any official clarifications by Roskomnadzor, the Russian Data Protection Authority, on how it will interpret some of the broader terms of the law, but we will publish any as they come available. For unofficial insights on the Data Localization Law from Roskomnadzor’s November conference on personal data protection please see our previous Data Privacy Alert. And for more information on the law’s requirements, please see our recent webinar and slide deck on the law.
If you have any questions, feel free to reach out to Natalia Gulyaeva (Partner, Moscow), Maria Sedykh (Associate, Moscow) or Bret Cohen (Associate, Washington).