RussiaFederal Law No. 152-FZ, Article 18(5), Data Localization and Cross-Border Transfer, as Amended by Federal Law No. 23-FZ
Federal Law No. 152-FZ, Art. 12, Art. 18(5), as amended by Federal Law No. 23-FZ of
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Record, systematize, accumulate, store, update, and retrieve personal data of Russian citizens in a database physically located in Russia, whether you act as operator or processor, under Federal Law No. 152-FZ Article 18(5) as amended by Federal Law No. 23-FZ.NIST Privacy FrameworkID.IM-P7
- Before transferring personal data of a person in Russia to a country not on Roskomnadzor's adequacy list, obtain the subject's written consent naming the recipient country or establish another Article 12 basis.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P7The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Article 18(5) reach an operator outside Russia that holds "персональных данных граждан Российской Федерации" ("personal data of citizens of the Russian Federation") only because a Russian citizen located abroad supplied it?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 12(5) makes the operator obtain from each foreign recipient, before it files the cross-border transfer notice, the recipient's data protection measures and conditions for ending processing, the foreign data protection law (where the country is not on the adequacy list) and the recipient's identity and contacts. Article 12(6) then requires the operator to hand that information to the data protection authority within ten working days of a request (extendable by up to five), which it can do only from what it has kept. The Article names no log or register, and sets no retention period. Article 18(5), the data localization rule on the same row, adds no record duty. Both Article 18(5) and Article 1(1.1) turn on the data of Russian citizens rather than residents.
- Kind
- Implicit
- As of
- Provision
- Article 12(5) and (6)
- Trigger
- personal_data_processing
What this law does
Article 12 requires, before an international transfer, that the receiving country provide an adequate level of protection, which Roskomnadzor determines by list, Strasbourg Convention parties and a published Roskomnadzor adequacy list qualify automatically; transfers to a non-adequate jurisdiction need the subject's written consent naming the recipient country, an international treaty, a statutory security or constitutional necessity, contract performance, or vital-interest protection.
Separately, Article 18(5) requires operators to record, systematize, accumulate, store, update, and retrieve Russian citizens' personal data using databases physically located in Russia, a hard localization duty added in 2014 and in force since . Localization does not itself prohibit a subsequent cross-border transfer or an offshore copy once the primary Russian database exists.
Federal Law No. 23-FZ of rewrote Article 18(5), extending the localization duty to processors as well as operators and closing a gap that let initial collection route through foreign infrastructure before a Russian copy was made, effective .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .