Law note · Russia
Federal Law No. 152-FZ, Article 18(5), Data Localization and Cross-Border Transfer, as Amended by Federal Law No. 23-FZ
Article 12 requires, before an international transfer, that the receiving country provide an adequate level of protection, which Roskomnadzor determines by list, Strasbourg Convention parties and a published Roskomnadzor adequacy list qualify automatically; transfers to a non-adequate jurisdiction need the subject's written consent naming the recipient country, an international treaty, a statutory security or constitutional necessity, contract performance, or vital-interest protection.
Separately, Article 18(5) requires operators to record, systematize, accumulate, store, update, and retrieve Russian citizens' personal data using databases physically located in Russia, a hard localization duty added in 2014 and in force since 1 September 2015. Localization does not itself prohibit a subsequent cross-border transfer or an offshore copy once the primary Russian database exists.
Federal Law No. 23-FZ of 28 February 2025 rewrote Article 18(5), extending the localization duty to processors as well as operators and closing a gap that let initial collection route through foreign infrastructure before a Russian copy was made, effective 1 July 2025.
What it asks of an app
- Record, systematize, accumulate, store, update, and retrieve personal data of Russian citizens in a database physically located in Russia, whether you act as operator or processor, under Federal Law No. 152-FZ Article 18(5) as amended by Federal Law No. 23-FZ.
- Before transferring personal data of a person in Russia to a country not on Roskomnadzor's adequacy list, obtain the subject's written consent naming the recipient country or establish another Article 12 basis.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot
Primary source: Consultant.ru, codified text of Federal Law No. 152-FZ, Art. 12, 18(5)