Law: Federal Law of 27 July 2006 No. 152-FZ on Personal Data (as amended 2022) (available in Russian here; an unofficial English version as of 2019 is available here) (the Law on Personal Data)

Regulator: The Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor)

Summary: In 2006, Federal Law of July 27, 2006 No. 152-FZ on Personal Data (available in Russian here; an unofficial English version as of 2019 is available here) (the Law on Personal Data) entered into force, which, alongside several other laws, governs data protection in Russia. The Law on Personal Data follows a similar approach to the EU's Data Protection Directive (Directive 95/46/EC). Other notable laws include Federal Law of July 27, 2006 No. 149-FZ on Information, Information Technologies, and Protection of Information (only available in Russian here) (the Law on Information), Decree of October 20, 2021 No. 1799 on the Accreditation of Organizations that Own Information Systems that Provide Identification and (or) Authentication using Biometric Personal Data of Individuals (only available in Russian here) (Decree No. 1799), Decree of June 29, 2021 No. 1046 on Federal State Control (Supervision) over the Processing of Personal Data (only available in Russian here) (Decree No. 1046).

Since its adoption, the Law on Personal Data has been amended on numerous occasions to include new data localization requirements and to clarify the rules on consent. Most recently, the Federal Law of July 14, 2022 No. 266-FZ on Amending the Federal Law on Personal Data (only available in Russian here) (the Amendment Law) was adopted to impose stricter obligations on domestic and foreign data operators in terms of how they interact with data subjects as well as processors, and demonstrate their compliance generally and specifically in the case of data transfers. The majority of the Amendment Law's provisions entered into effect on September 1, 2022, while others entered into effect on March 1, 2023.

Furthermore, the Roskomnadzor regularly issues orders and imposes sanctions for non-compliance with the legislation.