Criminal Code Article 272.1, Illegal Collection, Storage, Use, or Transfer of Personal Data

Criminal Code of the Russian Federation, Art. 272.1, added by Federal Law No. 421-FZ, in force 11 December 2024

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 11 December 2024.

An enforcement supervision rule binding public and private bodies.

As of 24 August 2026.

What it requires

Expect criminal liability for an individual involved in illegally collecting, storing, using, or transferring personal data of a person in Russia, rising to up to 8 years for an unauthorized cross-border transfer and up to 10 years for an organized group or grave consequences, under Criminal Code Article 272.1.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Federal Law No. 421-FZ added Article 272.1 to the Criminal Code, criminalizing illegal collection, storage, use, or transfer of personal data: up to 4 years' imprisonment for the base offense, up to 5 years where minors, special categories, or biometric data are involved, up to 8 years for an unauthorized cross-border transfer, and up to 10 years for an organized group or grave consequences, plus fines to 3 million rubles; a personal or family-use exemption applies.

When LexLint raises it

processes_biometrics
crawls_web
trains_models

Read the law

Consultant.ru
codified text of the Criminal Code of the Russian Federation, Art. 272.1, verified directly (title metadata matches the cited article) penalty figures are secondary-sourced (recordinglaw.com, credos.ru), not independently read from the article's own body text

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app