Russia enacted its first dedicated AI statute, Federal Law No. 243-FZ 'On Supporting the Development of Artificial Intelligence Technologies in the Russian Federation', signed .
The general framework (definitions, principles, government powers, and support measures for 'sovereign' and 'national' large foundation AI models, defined as at least 1 billion parameters and general multi-task capability) applies from ; the provisions that bind private parties directly, a labeling-capability duty for AI-generated audio and visual content and a set of safety and documentation duties on developers of sovereign or national models, apply from .
Outside this statute, Russia's Presidential Decree No. 490 of (National AI Strategy to 2030, as amended by Decree No. 124 of 2024) and Federal Law No. 258-FZ of (experimental legal regimes for digital innovation, the regulatory sandbox under which Federal Law No. 243-FZ Art. 13(4) permits special AI rules) are government-defined policy and framework instruments rather than found duties binding a private developer or deployer directly, and are not modeled as instruments here, as no primary-source text for either has been located.
No AI-specific criminal prohibition (such as a standalone deepfake or synthetic-CSAM ban) has been located beyond the general computer-misuse and personal-data provisions researched under the scraping and privacy topics respectively.
Not yet in force.from ,in 4 months It starts to bind on .
Binds private bodies.
What this law does
Article 8 of Federal Law No. 243-FZ, signed , takes effect on .
It requires the developer of a 'sovereign' or 'national' large foundation AI model to take organizational and technical measures to secure the model, to define rules for the model's operation including restrictions, conditions of use, updating, and decommissioning, and to maintain technical documentation describing the model's key parameters and limitations to the extent needed to assess the safety of its application.
A 'developer' for these purposes is an individual entrepreneur or a legal entity that designs, trains, or modifies the model.
Per Article 6, a 'sovereign' model must be developed, with its characteristics determined and changed at every lifecycle stage, by a Russian legal entity, with the whole development cycle including training fully technically reproducible by that developer, user-query processing and data storage kept in Russian-located, Russian-owned data centers, and confirmed compliance with Russian legislation and 'traditional Russian spiritual and moral values'.
A 'national' model shares the same developer-control, data-center, and compliance-confirmation requirements, but may incorporate components developed abroad, including other developers' foundation models, provided they are distributed under an open license.
Not yet in force.from ,in 4 months It starts to bind on .
Binds private bodies.
What this law does
Article 9 of Federal Law No. 243-FZ, signed , takes effect on .
It requires that a person applying a large foundation AI model (one with at least 1 billion parameters and general multi-task capability) to create audio or visual informational material be given the ABILITY to place a notice that AI technology was used; the format, content, and placement of that notice are left to agreement between the person applying the model and the person providing access to it, so displaying the notice is not itself mandatory.
Separately, the owner of a Russian-language website, information system, or program letting users distribute information through personal pages, where daily access exceeds 500,000 Russia-based internet users, must give its users the ABILITY to place that same AI-use notice on content they distribute that was created using a large foundation AI model.
Russia's comprehensive private- and public-sector personal data statute is Federal Law No. 152-FZ "On Personal Data" of , as amended most recently by Federal Law No. 23-FZ of , extending a hard data localization duty to processors, and Federal Law No. 420-FZ, which sharply raised administrative fines from .
Biometric identification and authentication carry a separate, materially heavier regime under Federal Law No. 572-FZ, which mandates that identification against a database run only through a state-operated Unified Biometric System, distinguishing Russia from every other jurisdiction. This picture is statutory throughout; no lead enforcement case or court decision is identified for any instrument here.
Federal Law No. 572-FZ establishes the Unified Biometric System (Edinaya biometricheskaya sistema, EBS), a state information system for identifying and authenticating individuals from face and voice biometrics, and it is genuinely distinct from every other biometric regime. "Identification", matching an unknown person against the whole database, may be performed only through the state EBS.
"Authentication", verifying a claimed identity, may use the EBS or a private accredited system, but an accredited authentication system works only with derived mathematical vectors, never the original biometric template, and may not transmit those vectors to a third party.
Organizations that process biometric data for identification or authentication, banks, employers, security operators, call centers, must route identification through the state system; reporting documents that the law obliges banks and state agencies to deposit client face and voice biometrics into the EBS, and that the Central Bank has moved to bar branches from opening accounts or approving loans via mobile app without biometric authentication.
A broader duty for every prior private holder of biometric data to transfer its existing database into the EBS and destroy its own copy is not established; only the narrower duty for banks and state agencies to deposit new biometrics is. Written consent is required under Article 11 of 152-FZ, cross-referenced by 572-FZ, and 572-FZ separately bars denying service to someone who declines biometric processing, except where a separate federal law affirmatively mandates identification.
Accredited organizations may retain a biometric sample only up to 10 days, solely to process a complaint; the durable copy of record lives in the state EBS. Voiceprint and faceprint are both squarely in scope, the statute's subject matter is literally identification and authentication using face and voice biometrics, and there is no carve-out for either.
Whether individual consent is still required before an already-collected biometric record is transferred from a bank into the EBS, as distinct from consent to the original collection, is unresolved.
Article 21, part 3.1, added by Federal Law No. 266-FZ, requires an operator that detects an unlawful or accidental transfer, provision, distribution, or access to personal data violating a subject's rights to notify Roskomnadzor within 24 hours of detection, covering the nature of the incident, suspected cause, likely harm, and remediation already taken, and to file a full report within 72 hours covering the internal investigation's results and the persons responsible.
Federal Law No. 152-FZ "On Personal Data" of , as amended, most recently by Federal Law No. 23-FZ of and Federal Law No. 420-FZ, is Russia's comprehensive private- and public-sector data protection statute.
Article 6, part 1 recognizes twelve numbered lawful grounds for processing, from the data subject's consent in point 1 to personal data subject to publication or mandatory disclosure under a federal law in point 11, among them performance of a contract in point 5, protection of vital interests in point 6, the legitimate interests of the operator or a third party in point 7, and journalism, science, literature or other creative activity in point 8; point 10 was repealed on .
An "operator" (controller) determines the purposes and content of processing, and a "processor" acts on the operator's instructions. As of , Federal Law No. 23-FZ makes processors subject to the same localization duty as operators.
Article 12 requires, before an international transfer, that the receiving country provide an adequate level of protection, which Roskomnadzor determines by list, Strasbourg Convention parties and a published Roskomnadzor adequacy list qualify automatically; transfers to a non-adequate jurisdiction need the subject's written consent naming the recipient country, an international treaty, a statutory security or constitutional necessity, contract performance, or vital-interest protection.
Separately, Article 18(5) requires operators to record, systematize, accumulate, store, update, and retrieve Russian citizens' personal data using databases physically located in Russia, a hard localization duty added in 2014 and in force since . Localization does not itself prohibit a subsequent cross-border transfer or an offshore copy once the primary Russian database exists.
Federal Law No. 23-FZ of rewrote Article 18(5), extending the localization duty to processors as well as operators and closing a gap that let initial collection route through foreign infrastructure before a Russian copy was made, effective .
Article 16 bars a decision that produces legal consequences for a data subject, or otherwise affects their rights and legitimate interests, from being made solely on the basis of automated processing of their personal data. Such a decision may be made only with the data subject's written consent or where a federal law that also protects their rights provides for it.
The operator must explain to the data subject how the decision is made and its possible legal consequences, give them a chance to object, and explain how they can protect their rights. The operator must consider an objection within thirty days of receiving it and tell the data subject the result.
Federal Law No. 152-FZ gives a data subject in Russia the right to confirmation of processing and the categories, legal basis, and retention period involved; correction of inaccurate data; deletion where data was collected unlawfully, its purpose is fulfilled, or consent is withdrawn; and withdrawal of consent at any time. Article 17 gives the subject the right to complain to Roskomnadzor or to sue in court for damages and compensation of moral harm. Rights run against the operator.
Federal Law No. 421-FZ added Article 272.1 to the Criminal Code, criminalizing illegal collection, storage, use, or transfer of personal data: up to 4 years' imprisonment for the base offense, up to 5 years where minors, special categories, or biometric data are involved, up to 8 years for an unauthorized cross-border transfer, and up to 10 years for an organized group or grave consequences, plus fines to 3 million rubles; a personal or family-use exemption applies.
Article 10 of 152-FZ names special categories, race and ethnicity, political opinion, religious or philosophical belief, health, sex life, and criminal record data, requiring written consent or a statutory exception. Article 11 separately defines "biometric personal data" as information characterizing a person's physiological and biological features on the basis of which their identity can be established, used by the operator for that purpose.
The article's own text is entirely general and technology-neutral. It carries no illustrative list of modalities at all, and no mention of facial images, voice recordings, fingerprints, or DNA anywhere in the article. Written consent is required for biometric processing, and provision of biometric data cannot be made mandatory, except where Article 11(2)'s statutory exceptions apply.
On that same general wording, an identifier derived from a photograph, video, or audio recording is not excluded: the definition simply never names any modality, recording-derived or otherwise, so nothing in the text carves one out.
Russia has no scraping-specific statute; open-web collection is governed by the general computer-misuse provisions of the Criminal Code (Arts. 272 to 274.1, unauthorized access, malicious software, and critical-infrastructure interference), the Civil Code's sui generis database maker's right (Part IV, Arts. 1334 to 1336), and the personal-data statute researched separately under the privacy topic.
Article 273's malware offense reaches software built to neutralize a site's technical security tools, which covers a scraping tool built to defeat access controls, though the article names no such use case itself.
Civil Code Art. 1274's free-use exception, the provision that would otherwise carry a text-and-data-mining carve-out, covers only quotation, illustration, and specifically enumerated informational and educational uses; it names no exception for automated bulk reproduction or machine analysis of protected works, so mass scraping for training or indexing purposes falls outside it and back onto the ordinary reproduction right.
Federal Law No. 149-FZ 'On Information, Information Technologies and Information Protection' authorizes Roskomnadzor to order blocking of sites distributing unlawful content (Art. 15.1 and related provisions), a content-blocking regime rather than a scraping-specific one. No reported case construing any of these provisions against a scraping fact pattern has been located.
Article 272 criminalizes unauthorized access to legally protected computer information where the act causes destruction, blocking, modification, or copying of that information, with four escalating penalty tiers keyed to significant damage or mercenary motive, commission by a group or through an official position, and grave consequences.
The article, as currently in force, dates its main structure to Federal Law No. 420-FZ of and was most recently amended by Federal Law No. 421-FZ of , which excepted conduct already covered by the newer Article 272.1 on unlawful handling of personal data.
Article 273 criminalizes creating, using, or distributing computer programs or other computer information known to be intended for unauthorized destruction, blocking, modification, copying of computer information, or for neutralizing computer information security tools, with three escalating tiers for organized or for-profit commission and for grave consequences.
The article separately reaches software known to be intended for neutralizing computer-information security tools, without naming any particular downstream use for that software.
Article 274 criminalizes violating the rules for operating protected computer-information storage, processing, or transmission facilities, telecommunications networks and terminal equipment, or the rules for accessing telecommunications networks, where the violation causes destruction, blocking, modification, or copying of information and significant damage, with a second tier for grave consequences.
Article 274.1, added by Federal Law No. 194-FZ of , criminalizes creating or using malicious software aimed at Russia's critical information infrastructure, unlawful access to protected information held in it, and violating the operating or access rules for systems classified as critical information infrastructure, across five escalating tiers running from forced labor up to five years to imprisonment of five to ten years for grave consequences.
A 2026 amendment added a cooperation-based exemption from liability for a person who actively assists the investigation.
Article 1334 grants the maker of a database that required substantial financial, material, organizational, or other outlay to create an exclusive sui generis right to extract materials from the database and reuse them in any form, and bars anyone from extracting materials and reusing them without the rightholder's permission except as the Code provides; a database is presumed to have required substantial outlay if it contains at least 10,000 independent information elements.
Article 1335 sets the term at 15 years from completion (or publication) of the database, renewed on every update. Article 1336 extends the right to a Russian citizen or legal entity, a foreign rightholder whose home state reciprocally protects a Russian maker's database, or as an international treaty otherwise provides.
"Extraction" is defined as transferring the whole content of a database, or a substantial part of its constituent materials, onto another information medium by any technical means and in any form, which reaches automated bulk copying of a database's contents.
Russia has no enacted market-placement security gate for a general software product or connected device, and no general no-sector-gate reasonable-security statute of the kind New York's SHIELD Act or Massachusetts's 201 CMR 17.00 supply.
Federal Law No. 149-FZ "On Information, Information Technologies and Information Protection" of (as amended, most recently by Federal Law No. 568-FZ of ) comes closest: its Article 16(4) lists technical and organizational measures the possessor of information or the operator of an information system must ensure, preventing unauthorized access, timely detecting an access breach, and maintaining continuous monitoring of the level of information protection among them, but the chapeau binds them to do so only "в случаях, установленных законодательством Российской Федерации" ("in cases established by the legislation of the Russian Federation"), so the duty is triggered by some other statute rather than standing on its own.
Article 16's own concrete requirements, security standards the Federal Security Service and the Federal Service for Technical and Export Control set for information held in a state information system (part 5), and the duty to interact with the state system for detecting, preventing, and eliminating the consequences of computer attacks, including reporting a computer incident to it (part 7, added effective ), bind only a state information system and the state body, state unitary enterprise, or state institution operating it, not a private commercial developer.
The general private-sector duty to secure personal data during processing sits at Federal Law No. 152-FZ "On Personal Data" Article 19, the comprehensive regime's own security-of-processing clause, which stays with the privacy topic under this profile's rule that such a clause belongs to the regime it is embedded in; this jurisdiction's privacy row already records that same statute's Article 21 part 3.1 breach-notification duty to Roskomnadzor, with a 24-hour initial notice and a 72-hour full report.
Federal Law No. 187-FZ "On the Security of Critical Information Infrastructure of the Russian Federation" (, as amended by Federal Law No. 312-FZ of and Federal Law No. 58-FZ of ) is a genuine sector cyber-resilience regime, and the most substantial security-shaped law found for Russia.
It categorizes a "significant object of critical information infrastructure" by severity and enters it in a state register (Arts. 7-8), requires the operator of a significant object to build and run a security system meeting the Federal Service for Technical and Export Control's security requirements (Arts. 10-11), and obliges a "subject of critical information infrastructure" to comply with those requirements and to interact with the state system for detecting, preventing, and eliminating the consequences of computer attacks, including reporting a computer incident to it (Art. 9).
But Article 2(8) defines that bound party, the subject of critical information infrastructure, as a state body, state institution, or Russian legal entity that owns, leases, or otherwise lawfully holds an information system, telecommunications network, or automated control system operating in named critical sectors, healthcare, science, transport, communications, energy, state registration of rights to immovable property, the banking sphere and other financial-market spheres, the fuel-and-energy complex, atomic energy, defense, the rocket-and-space industry, and the mining, metallurgical, and chemical industries, or a Russian legal entity that ensures interaction between such systems.
Its security-system and incident-notification duties on subjects of critical information infrastructure are filed as rows of their own.
Violating the security requirements a critical-information-infrastructure subject owes carries administrative liability under the Code of Administrative Offences, Article 13.12.1; an intruder's unlawful impact on a critical-information-infrastructure object is already this jurisdiction's scraping row (the computer-misuse family, Criminal Code Article 274.1) and is not a security-topic presence on its own.
The Federal Service for Technical and Export Control separately certifies specific categories of information-security tools, cryptographic products, firewalls, and similar software, for use in a state information system, a personal-data information system, or a critical-information-infrastructure object, but that certification duty reaches a narrow product category tied to a government or critical-infrastructure customer, not a general software product placed on the market, so it is named here rather than filed as its own product-requirements instrument.
No other located instrument sets a security requirement, a vulnerability- or incident-reporting duty, or a sector cyber-resilience regime reaching a general software or platform developer. Criminal Code Articles 272 through 274 criminalize unauthorized access to, and interference with, a computer system by an intruder and are already this jurisdiction's scraping row; a computer-misuse offense alone is not a security-topic presence.
Federal Law 187-FZ of on the security of critical information infrastructure entered into force on . Article 10(1) of that Law requires a subject of critical information infrastructure to create a security system for each significant object and to keep it operating. Article 9(2) of that Law requires a subject of critical information infrastructure to inform the authorized federal executive authority of computer attacks and computer incidents without delay.
Law 187-FZ arts. 2, 7, 9, 10 and 14 (Federal Law of on the Security of Critical Information Infrastructure; О безопасности критической информационной инфраструктуры Российской Федерации)Text of Федеральный закон от 26.07.2017 № 187-ФЗ «О безопасности критической информационной инфраструктуры Российской Федерации» (Federal…
In force since .Binds public and private bodies.
What this law does
Article 2(8) defines a subject of critical information infrastructure as a state body, state institution or Russian legal entity that holds an information system, telecommunications network or automated control system operating in healthcare, science, transport, communications, energy, banking and other financial-market spheres, defense and other listed sectors, or a Russian legal entity that ensures interaction between such systems.
Article 7(4) requires subjects to assign one of three significance categories to the critical information infrastructure objects they hold. Article 9(3) additionally requires the holder of a significant object to observe the security requirements set by the federal executive authority for the security of critical information infrastructure, and to carry out that authority's orders to remedy violations.
Article 9(3) also requires that holder to give the authority's officials unhindered access to significant objects. Article 10(1) requires the subject to create a security system for each significant object and to keep it operating. Article 14 provides that a violation of the Law entails liability under Russian legislation. Article 15 sets the Law in force on .
Law 187-FZ art. 9(2) and (3) (Federal Law of on the Security of Critical Information Infrastructure; О безопасности критической информационной инфраструктуры Российской Федерации)Text of Федеральный закон от 26.07.2017 № 187-ФЗ «О безопасности критической информационной инфраструктуры Российской Федерации» (Federal…
In force since .Binds public and private bodies.
What this law does
Article 9(2)(1) requires a subject of critical information infrastructure to inform without delay the federal executive authority authorized for the state system for detecting, preventing and eliminating the consequences of computer attacks, in the order that authority sets, of computer attacks and computer incidents, and where the subject operates in the banking sphere or another financial-market sphere to inform the Central Bank of the Russian Federation as well.
Article 9(2)(2) requires subjects to assist that authority's officials in detecting, preventing and eliminating the consequences of computer attacks and in establishing the causes of computer incidents. Article 9(3)(3) requires the holder of a significant object to respond to computer incidents in the order approved by that authority and to take measures to eliminate the consequences of attacks on significant objects.
Article 9(3)(7) requires the holder of a significant object to interact continuously with the state system for detecting and eliminating the consequences of computer attacks.
Russia's general age-gating regime is Federal Law No. 436-FZ 'On Protecting Children from Information Harmful to Their Health and Development' (, as amended), which classifies all information products into five age tiers (under 6, 6+, 12+, 16+, and prohibited for children) and requires producers and distributors to self-classify and label accordingly; most internet content is exempted from the physical labeling duty, but a website may voluntarily carry a machine-readable age mark, and an 'audiovisual service' (a defined term reaching video-on-demand and similar platforms) must classify itself and must prevent minors from accessing content in the prohibited-for-children category.
The organizer of a live entertainment event that shows information prohibited for children must keep out anyone under 18, and where a visitor's age is in doubt the person selling tickets or controlling entry may demand an identity document or check age data through the state multifunctional information exchange service.
Separately, Federal Law No. 149-FZ Art. 10.6 imposes a content-monitoring duty, rather than an access-restriction duty, on the owner of any social network with more than 500,000 Russia-based daily users, requiring it to monitor for and act on child sexual abuse material, drug-related content, suicide-related content, and material recruiting minors into unlawful or dangerous acts.
Neither statute conditions general website access to adults-only material on age verification at the point of access; no dedicated adult-content age-verification statute or app-store age-verification statute has been located.
Article 6 requires the producer or distributor of an information product to self-classify it, before it enters circulation in Russia, into one of five age categories: for children under 6, for children 6 and older, for children 12 and older, for children 16 and older, or prohibited for children. Article 12 sets the corresponding age marks (0+, 6+, 12+, 16+, 18+) and their minimum display size.
Article 11 requires the age mark on most information products before circulation, but exempts information distributed over telecommunications networks including the Internet other than registered network media and audiovisual services,. Article 11 also requires the organizer of an event that shows information prohibited for children to keep out anyone under 18.
Where the person selling tickets or controlling entry doubts that a visitor is an adult, Article 11 lets that person demand an identity document establishing age, or check age data the visitor presents through the multifunctional information exchange service. Federal Law No. 569-FZ of rewrote that provision, and its changes took effect on .
Article 14 lets an unregistered website voluntarily carry a machine-readable age mark under its own self-classification, but requires an audiovisual service to classify itself and to ensure minors cannot access content in the prohibited-for-children category.
Articles 6, 11, 12 and 14 all came into force on under the Act's own commencement clause in Article 23; Article 14, though set out anew by Federal Law No. 139-FZ of before the Act itself came into force, took effect together with Articles 6, 11 and 12 on that same day.
Article 10.6, added by Federal Law No. 530-FZ of , applies to the owner of a Russian-language (or Russian minority-language) website, information system, or program that lets users distribute information through personal pages, where daily access exceeds 500,000 Russia-based internet users (a 'social network owner').
It requires that owner to monitor the social network for, among other things, child sexual abuse material and advertisements recruiting minors as performers in pornographic events, drug-related content, suicide-related content, and material inducing minors into unlawful acts that endanger their life or health, and to publish an annual report on complaint handling and monitoring results.
Russia has no press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, and no dedicated text-and-data-mining exception for news content; instead it regulates news aggregation through a bespoke registration and content-accountability regime for large news aggregators (Federal Law No. 149-FZ, Art. 10.4) layered on top of the Civil Code's general free-use exception for quotation and informational reproduction of periodical material (Part IV, Art. 1274).
An aggregator that verbatim-reproduces material already published on an official state-body website or by a registered mass medium is shielded from liability for that content under Art. 10.4(2), which functions as Russia's closest analogue to a linking or reproduction safe harbor for aggregators, though it is a content-liability shield rather than a copyright defense.
No hot-news misappropriation doctrine, no reported case construing Art. 10.4 or Art. 1274 against an aggregator, and no compelled-bargaining code have been located.
Article 1274 permits, without the rightholder's consent and without payment but with mandatory attribution of the author and the source, quotation of lawfully published works in the original or in translation for scientific, polemical, critical, informational, or educational purposes, or to reveal the author's creative intent, to the extent justified by the purpose of the quotation, including reproducing excerpts of newspaper and magazine articles in the form of press reviews.
It separately permits reproducing in a periodical print publication, and communicating to the public, lawfully published articles on current economic, political, social, or religious topics broadcast or communicated to the public, unless the author or rightholder has specifically prohibited such use, and permits reproduction and communication, within the bounds justified by an informational purpose, of works seen or heard in the course of covering current events, in reviews of current events.
The article names no exception at all for automated text-and-data-mining or bulk machine reproduction of protected works; its enumerated free uses cover quotation, illustration in educational material, periodical press reproduction, political speeches, reviews of current events, non-profit live performance in institutions, dissertation abstracts, formats for people with print disabilities and parody, so mass scraping of copyrighted content for indexing, aggregation beyond quotation-length excerpts, or model training draws on none of them and falls back to the ordinary reproduction right.
Article 10.4, added by Federal Law No. 208-FZ of , applies to the owner of a Russian-language (or a Russian minority-language) website, information system, or program used to process and distribute news information, where daily access exceeds one million internet users in Russia (a 'news aggregator owner'), and requires it to verify the accuracy of socially significant information before distribution, avoid concealing or falsifying such information, avoid defamatory or discriminatory distribution, publish contact information, retain distributed news information and its source for six months, and give the federal media regulator access to that retained information through its interaction system.
The regulator, not the owner, enters a resource found above the audience threshold in its register of news aggregators and notifies the owner of the entry. A news aggregator owner is not liable for distributing news information that verbatim reproduces material already posted on an official government-body website or already distributed by an identifiable, accountable registered mass medium.
Ownership of a news aggregator is restricted to a Russian citizen without other citizenship or a Russian legal entity that is not more than 50 percent controlled, directly or indirectly, by a foreign state, organization, or citizen. A registered online mass medium (a 'network publication') is excluded from the news-aggregator definition entirely.
No current case law for Russia content moderation law
No current case law for Russia product and AI liability law
No current case law for Russia digital accessibility law
No current case law for Russia age gating law
No current case law for Russia reuse law
Reporting clocks that run here2 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Russia comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Notify Roskomnadzor within 24 hours of detecting an unlawful or accidental transfer, provision, distribution, or access to personal data of a person in Russia, and file a full follow-up report within 72 hours.
Law 187-FZ art. 9(2) and (3) (Federal Law of on the Security of Critical Information Infrastructure; О безопасности критической информационной инфраструктуры Российской Федерации)security law, in force since
The sentence the clocks are read from
Inform the authorized federal executive authority immediately of computer attacks and computer incidents, in the order it sets; if you operate in the banking sphere or another financial-market sphere, inform the Central Bank of the Russian Federation as well, in an order the authority sets in agreement with the Central Bank (Article 9(2)(1)).
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
