RussiaFederal Law No. 152-FZ "On Personal Data"
Federal Law No. 152-FZ of "On Personal Data" (as amended)
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator, Self
- Where the report goes
- Produced on request
What it requires
- Establish one of the lawful grounds listed in Article 6, part 1 of Federal Law No. 152-FZ, such as consent, performance of a contract, a function or duty the law places on the operator, protection of vital interests, or the legitimate interests of the operator or a third party, before processing personal data of a person in Russia.
- Determine and document whether you are an operator or a processor of personal data, since Russian law now applies the same core duties, including localization, to both.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.BE-P1The organization’s role(s) in the data processing ecosystem are identified and communicated.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What test decides that processing necessary for the rights and legitimate interests of the operator or a third party respects the proviso in Article 6(1)(7), "при условии, что при этом не нарушаются права и свободы субъекта персональных данных" ("provided that the rights and freedoms of the personal data subject are not violated")?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Access record
Logging duty
Article 19(2)(8) lists, among the ways an operator secures personal data in an information system, setting access rules and "ensuring the registration and logging of all actions performed with personal data in the information system" (обеспечением регистрации и учета всех действий, совершаемых с персональными данными в информационной системе персональных данных). Article 18.1(1)(4) adds internal control and/or audit of the operator's own compliance, with no interval stated, and Article 18.1(4) requires the operator to produce its policy documents and local acts, or otherwise confirm the measures taken, when the data protection authority (Roskomnadzor) asks. Article 9(3) separately puts the burden of proving consent on the operator. The Act names no retention period for the log. Article 1(1.1) extends the Act to foreign operators processing the data of Russian citizens under a contract or consent, a citizenship test, not a territorial one.
- Kind
- Explicit
- As of
- Provision
- Article 19(2)(8); Article 18.1(1)(4) and (4)
- Trigger
- personal_data_processing
What this law does
Federal Law No. 152-FZ "On Personal Data" of , as amended, most recently by Federal Law No. 23-FZ of and Federal Law No. 420-FZ, is Russia's comprehensive private- and public-sector data protection statute.
Article 6, part 1 recognizes twelve numbered lawful grounds for processing, from the data subject's consent in point 1 to personal data subject to publication or mandatory disclosure under a federal law in point 11, among them performance of a contract in point 5, protection of vital interests in point 6, the legitimate interests of the operator or a third party in point 7, and journalism, science, literature or other creative activity in point 8; point 10 was repealed on .
An "operator" (controller) determines the purposes and content of processing, and a "processor" acts on the operator's instructions. As of , Federal Law No. 23-FZ makes processors subject to the same localization duty as operators.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .