Send a request

Send us your request for any issue you are interested in and we’ll provide you with a tailored offer as soon as possible!

February 21, 2020

Violation of requirements for Russian citizen personal data localization will lead to significant administrative liability

Since December, 2019 administrative liability for violation of requirements for Russian citizen personal data localization on the territory of Russia was strengthened. According to the law for primary non-fulfillment of such requirements the company may be charged with a penalty in the amount of up to 9 million rubles, and for the second time the penalty will make up to 18 million rubles[1].

What is personal data?

This is any information, relating directly or indirectly to defined or definable natural entity (subject of personal data).

What does localization mean?

The controller shall ensure that Russian citizen personal data will be initially recorded and processed in another way using data base of the Russian Federation.

The controller can be a state or municipal authority, legal or natural entity which independently or together with other persons organize and effect personal data processing as well as define the goals of personal data processing, content of personal data which is subject to processing and operations performed with personal data.

Table of penalties:

 

For citizens

For officers

For legal entities

First time violation

30 000 – 50 000 rubles

100 000 – 200 000 rubles

1 000 000 – 6 000 000 rubles

Second time violation

50 000 - 100 000 rubles

500 000 – 800 000 rubles

6 000 000 – 18 000 000 rubles

In connection with this we recommend for the companies which are under the requirements of localization:

  • To make sure of taken measures sufficiency and to assess legal risks connected with the possible violation of requirement for Russian citizen personal data localization.
  •   In case when the third parties participate in personal data processing (for example, if Contact of providing services is available) to make sure that this will not lead to additional risks of localization requirements violation. If there are agreements concluded with third parties they should be amended according to new requirements.

These recommendations are really important for foreign companies which activity is performed by means of internet without actual presence on the territory of the Russian Federation. If the activity of such companies is connected with the Russian Federation then they have to comply with the above stated requirements. In accordance with the explanation of Ministry of Digital Development, Communications and Mass Media of the Russian Federation internet website connection with Russia may be proved by defining domain name related to the Russian Federation or to the RF subject (ru, рф., su., москва., moscow and etc.) and also by detecting the Russian version of the website.


[1] Federal Law dated 2nd of December, 2019 N 405-FL “On making changes to certain legal acts of the Russian Federation”

If you have any questions feel free to contact us:

Tel.: +7 (812) 416-55-56
e-mail: spb@amondsmith.ru

Office hours:
Mon. – Fri.: 10:00 a.m. – 6:00 p.m. (without breaks)
Sat. – Sun.: closed