← Global Privacy Laws Research Library
Federal Law No. 152-FZ \"On Personal Data\"
Federal Law No. 152-FZ on Personal Data: Russia
Prepared by Shubhank Suman · Last reviewed
CURRENT / AMENDED
- Legal character
- Federal statute
- Region
- Europe
What it covers
Federal Law No. 152-FZ is Russia's principal general personal-data statute.
It regulates:
- personal-data operators
- lawful processing
- purpose limitation
- consent
- special categories
- biometric personal data
- data-subject rights
- security
- localisation
- regulator notification
- cross-border transfers
- destruction/termination
- enforcement.
In short, the law establishes operator obligations, lawful-processing requirements, security, individual rights, cross-border transfers and localisation requirements.
Why it matters
Russian data protection differs from GDPR-style frameworks in several important areas, particularly:
- the concept of the personal-data operator
- data-localisation requirements
- Roskomnadzor notification
- Russian-specific cross-border requirements
- extensive regulatory controls.
Refer to it when
- Processing Russian citizens' personal data
- operating a website/service accessible to Russian users
- analysing localisation
- using biometric data
- transferring Russian personal data abroad
- registering/notifying Roskomnadzor
- assessing security measures.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: Very High
AI
MODERATE/HIGH
152-FZ is not an AI Act.
It becomes highly relevant where AI applications involve:
- biometric data
- profiling
- employee data
- customer analytics
- behavioural prediction
- AI training datasets
- automated personal-data processing.
Cybersecurity
VERY HIGH
Article 19 is central to technical and organisational security.
Applicability
Russian operators and specified foreign organisations processing Russian personal data within the law's territorial scope.
Current validity
CURRENT / AMENDED.
The operative version is the latest consolidated text, not the original 2006 text.
Read first
Articles 5–12 → Article 18.1 → Article 19 → Article 22 → localisation/cross-border provisions.
Provisions / sections covered
Article 5: Principles
Processing should correspond to specified and lawful purposes and should not be excessive in relation to those purposes.
Article 6: Conditions for processing
Contains the legal bases permitting processing.
Article 7: Confidentiality
Establishes confidentiality requirements.
Article 9: Consent
Regulates consent where consent is used as the processing basis.
Article 10: Special categories
Provides the special-category processing framework.
Article 11: Biometric personal data
Important for:
- facial recognition
- fingerprints
- voice/biometric identification
- AI biometric systems.
Article 12: Cross-border transfers
Important for transferring Russian personal data outside Russia.
Article 18.1: Operator obligations
Contains significant organisational/accountability requirements.
Article 19: Security
Requires operators to adopt organisational and technical measures designed to protect personal data against:
- unlawful/accidental access
- destruction
- modification
- blocking
- copying
- provision
- dissemination
- other unlawful actions.
Article 22: Notification
Important for notifying Roskomnadzor regarding personal-data processing.
Subject-matter tags
- Lawful basis
- Consent
- Sensitive data
- Data subject rights
- Profiling
- Security
- Cross-border transfers
- Data localisation
- Data protection officer
- Biometrics
- Employment data
- Enforcement and penalties
- Facial recognition
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.