Federal Law No. 152-FZ "On Personal Data"

Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (as amended)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 27 July 2006.

A comprehensive regime rule binding public and private bodies.

As of 24 August 2026.

What it requires

Establish one of the six Article 6 lawful bases, consent, contract performance, legal obligation, vital interests, legitimate interests, or the journalism/science/literature/art exception, before processing personal data of a person in Russia.
Determine and document whether you are an operator or a processor of personal data, since Russian law now applies the same core duties, including localization, to both.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Federal Law No. 152-FZ "On Personal Data" of 27 July 2006, as amended, most recently by Federal Law No. 23-FZ of 28 February 2025 and Federal Law No. 420-FZ, is Russia's comprehensive private- and public-sector data protection statute. Six lawful bases are recognized under Article 6: consent, contract performance, legal obligation, vital interests, legitimate interests, and a journalism, science, literature, or art exception.

An "operator" (controller) determines the purposes and content of processing, and a "processor" acts on the operator's instructions. As of 1 July 2025, Federal Law No. 23-FZ makes processors subject to the same localization duty as operators.

When LexLint raises it

high_risk_decisions
processes_biometrics
crawls_web
trains_models

Read the law

Consultant.ru, codified text of Federal Law No. 152-FZ

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app