In early July, the lower chamber of the Russian Parliament adopted a set of amendments (source document in Russian) to the Federal Law "On Information, Information Technologies and Protection of Information" ("Information Law") and to the Federal Law "On Personal Data" ("Personal Data Law"). The draft legislation requires further approvals as well as a signature by the Russian President. The legislative changes could be in effect in September 2016. The amendments to the Information Law provide that "databases which are used for gathering, recording, systemizing, accumulation, storage, updating and uploading of personal data of the Russian citizens" must be located in Russia. Furthermore, the Personal Data Law is amended to provide that "an operator gathering personal data, including by Internet, must ensure recording, systemizing, accumulation, storage, updating and uploading of personal data of the Russian citizens with the databases located on the territory of the Russian Federation." No specific liability is introduced for failure to comply with such requirements, hence the moderate administrative fines that already exist in Russian law may be applied by the Russian regulator against noncompliant data operators. The Amendments were signed into law by President Putin on July 22, 2014. A more detailed summary of the Amendments is available in a Jones Day Alert, "Russia Adopts Restrictive Changes to its Data Privacy Law," July 2014.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.