This browser is not actively supported anymore. For the best passle experience, we strongly recommend you upgrade your browser.

Freshfields TQ

Technology quotient - the ability of an individual, team or organization to harness the power of technology

| 1 minute read

Regulation of foreign tech companies that are not represented in Russia: prohibition on personal data processing and transfer

Further to our earlier publications on the new law regulating foreign tech companies’ activities on the Russian internet (the Law), in this post we continue describing sanctions that may apply to foreign tech companies which fail to comply with the new regulations.

If a foreign tech company breaches the Law, the Russian personal data and tech regulator (Roskomnadzor) may prohibit (i) collection of Russian citizens’ personal data by such foreign company; and (ii) cross-border transfer of personal data to such foreign company by other personal data operators. If the sanction is applied, it will apply to (i) and (ii) simultaneously.

A foreign tech company will be prohibited from data collection and cross-border data transfers from the date of the sanction (as recorded in the register of foreign tech companies maintained by Roskomnadzor) until this information is deleted from the register. At the moment, the Law does not provide for any notification of companies on imposition of this sanction. This implies that, at least for now, foreign companies and Russian personal data operators must check the register of foreign tech companies for the absence of this sanction prior to collecting/transferring personal data.

Please be reminded that foreign companies are already required to ensure that, upon collection of Russian citizens’ personal data, such data is recorded, systemised, accumulated, stored, adjusted (updated, altered) and extracted using databases located in Russia (the so-called ‘localisation requirement’). Failure to comply with the localisation requirement can trigger administrative fines and a ban on access to the website of the company in breach of the Law. The Law provides that any of the sanctions listed in the Law may apply to tech companies breaching the localisation requirement.

You may read more on this topic here:


regulatory, europe, us, tech media and telecoms, data