Duty LXD-1006
Processes personal data, in Russia
Federal Law No. 152-FZ "On Personal Data"since 2 lines
Federal Law No. 152-FZ of "On Personal Data" (as amended) · Read the law's page
- Establish one of the lawful grounds listed in Article 6, part 1 of Federal Law No. 152-FZ, such as consent, performance of a contract, a function or duty the law places on the operator, protection of vital interests, or the legitimate interests of the operator or a third party, before processing personal data of a person in Russia.
- Determine and document whether you are an operator or a processor of personal data, since Russian law now applies the same core duties, including localization, to both.
Federal Law No. 152-FZ, Articles 10-11, Special Categories and the Biometric Data Definitionsince 2 lines
Federal Law No. 152-FZ, Art. 10-11 · Read the law's page
- Obtain written consent before processing biometric personal data of a person in Russia, including an identifier such as a facial image or voice recording that would fall under Article 11's general definition, unless a narrow Article 11(2) statutory exception applies.
- Never make provision of biometric data a condition of service to a person in Russia, except where a separate federal law affirmatively mandates identification.
Federal Law No. 152-FZ, Articles 14 and 17, Data Subject Rightssince 2 lines
Federal Law No. 152-FZ, Art. 14 and 17 · Read the law's page
- Honor a Russian data subject's request for confirmation of processing, correction, deletion, or consent withdrawal, under Federal Law No. 152-FZ.
- Expect a Russian data subject to be able to sue you directly in court for losses and for compensation of moral harm arising from unlawful processing, under Federal Law No. 152-FZ Article 17, in addition to complaining to Roskomnadzor.
Federal Law No. 152-FZ, Article 21 Part 3.1, Breach Notificationsince 1 line
Federal Law No. 152-FZ, Art. 21, part 3.1, added by Federal Law No. 266-FZ (in force ) · Read the law's page
- Notify Roskomnadzor within 24 hours of detecting an unlawful or accidental transfer, provision, distribution, or access to personal data of a person in Russia, and file a full follow-up report within 72 hours.
Federal Law No. 572-FZ, Unified Biometric System for Identification and Authenticationsince 2 lines
Federal Law No. 572-FZ of "On the identification and/or authentication of individuals using biometric personal data" · Read the law's page
- Route biometric identification, matching an unknown person against a database, of a person in Russia only through the state Unified Biometric System; a private accredited system may only perform authentication, using derived mathematical vectors rather than the original template, and may not transmit those vectors to a third party.
- Obtain written consent before processing a person's biometric data in Russia, never condition service on that consent, and retain any biometric sample your organization holds only up to 10 days before deleting it, since the durable copy of record lives in the state system.
Criminal Code Article 272.1, Illegal Collection, Storage, Use, or Transfer of Personal Datasince 1 line
Criminal Code of the Russian Federation, Art. 272.1, added by Federal Law No. 421-FZ, in force · Read the law's page
- Expect criminal liability for an individual involved in illegally collecting, storing, using, or transferring personal data of a person in Russia, rising to up to 8 years for an unauthorized cross-border transfer and up to 10 years for an organized group or grave consequences, under Criminal Code Article 272.1.
Federal Law No. 152-FZ, Article 18(5), Data Localization and Cross-Border Transfer, as Amended by Federal Law No. 23-FZsince 2 lines
Federal Law No. 152-FZ, Art. 12, Art. 18(5), as amended by Federal Law No. 23-FZ of · Read the law's page
- Record, systematize, accumulate, store, update, and retrieve personal data of Russian citizens in a database physically located in Russia, whether you act as operator or processor, under Federal Law No. 152-FZ Article 18(5) as amended by Federal Law No. 23-FZ.
- Before transferring personal data of a person in Russia to a country not on Roskomnadzor's adequacy list, obtain the subject's written consent naming the recipient country or establish another Article 12 basis.