Law note · Russia
Federal Law No. 152-FZ "On Personal Data"
Federal Law No. 152-FZ "On Personal Data" of 27 July 2006, as amended, most recently by Federal Law No. 23-FZ of 28 February 2025 and Federal Law No. 420-FZ, is Russia's comprehensive private- and public-sector data protection statute. Six lawful bases are recognized under Article 6: consent, contract performance, legal obligation, vital interests, legitimate interests, and a journalism, science, literature, or art exception.
An "operator" (controller) determines the purposes and content of processing, and a "processor" acts on the operator's instructions. As of 1 July 2025, Federal Law No. 23-FZ makes processors subject to the same localization duty as operators.
What it asks of an app
- Establish one of the six Article 6 lawful bases, consent, contract performance, legal obligation, vital interests, legitimate interests, or the journalism/science/literature/art exception, before processing personal data of a person in Russia.
- Determine and document whether you are an operator or a processor of personal data, since Russian law now applies the same core duties, including localization, to both.
When LexLint raises it
Declared activities: high_risk_decisions, processes_biometrics, crawls_web, trains_models
Primary source: Consultant.ru, codified text of Federal Law No. 152-FZ