Law note · Russia
Federal Law No. 152-FZ, Article 21 Part 3.1, Breach Notification
cite Federal Law No. 152-FZ, Art. 21, part 3.1, added by Federal Law No. 266-FZ (in force 1 September 2022)
stage In effect
since 2022-09-01
reviewed 2026-08-24
Article 21, part 3.1, added by Federal Law No. 266-FZ, requires an operator that detects an unlawful or accidental transfer, provision, distribution, or access to personal data violating a subject's rights to notify Roskomnadzor within 24 hours of detection, covering the nature of the incident, suspected cause, likely harm, and remediation already taken, and to file a full report within 72 hours covering the internal investigation's results and the persons responsible.
What it asks of an app
- Notify Roskomnadzor within 24 hours of detecting an unlawful or accidental transfer, provision, distribution, or access to personal data of a person in Russia, and file a full follow-up report within 72 hours.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, processes_biometrics, processes_voice
Primary source: Consultant.ru, codified text of Federal Law No. 152-FZ, Art. 21, part 3.1