Press Center: Legal updates

Since the beginning of 2025, Russian courts have issued several landmark rulings in the field of personal data processing. These cases affect the interests of banks, marketplaces, solid waste management operators, employers, and online platforms. Some positions confirm long-standing approaches (withdrawal of consent does not terminate processing where a contract or legal obligation exists), while others establish new guidelines for businesses (processing of a beneficiary's data without consent, inadmissibility of contacting a previous employer without the candidate's permission).

Our review covers seven recent cases with conclusions that will help DPOs, legal teams, and information security departments minimize risks and establish compliant processes.

The Federal Service for Technical and Export Control (hereinafter referred to as the "FSTEC") has prepared a draft methodological document "Activities and measures to protect information contained in Information Systems" (hereinafter referred to as the "Draft Methodological Document").

We suggest to review the changes in the legislation on the safety of Critical Information Infrastructure (CII), which entered into force in 2025, as well as new initiatives that are planned to be considered and/or come into force in 2026.

On 14 July 2025, the Council of the State Duma began reviewing Draft Law No. 951518-8 “On Amendments to Article 12 of the Federal Law ‘On Personal Data’” (hereinafter referred to as the “Draft Law”).

Overview of changes in the sphere of information security and personal data (hereinafter referred to as the “PD”) that will affect the activities of organizations involved in the wholesale and retail trade of medicinal products. We remind you that starting from September 1, 2025, consents for PD processing must be stand-alone documents, separate from website Privacy Policies

On September 1, 2025, Federal Law No. 150-FZ dated June 7, 2025, 'On Amendments to Certain Legislative Acts of the Russian Federation' (hereinafter referred to as 'Federal Law No. 150'), will come into force, introducing a number of changes affecting the regulation of dietary supplements.

On 23 July 2025, a part of the Good Clinical Practice Guideline, GCP E6 (R3), promulgated by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) comes into force. The development of new technologies, the rapidly evolving clinical trial (CT) ecosystem, and the need to respond quickly to deviations in CT processes have prompted the revision of the current version of GCP ICH E6(R2), which is valid until 22 July 2025.

From 01.07.2025 the Federal Law No. 23-FZ dated 28 February 2025 “Concerning Personal Data and Certain Legislative Acts of the Russian Federation" will enter into force, containing a new version of part 5 of Article 18 of Federal Law No. 152-FZ

On 10 February 2025, President Trump signed an executive order, "Pausing Foreign Corrupt Practices Act Enforcement to Further American Economic and National Security" ("EO"): Is anti-corruption compliance on pause?

The EO establishes a moratorium on new investigations and enforcement actions under the FCPA for 180 days (with the possibility of a 180-day extension) and directs the Attorney General to review current investigations and enforcement actions within the specified timeframe, along with a revision of the guidelines governing FCPA investigations.

On 26.12.2024, Federal Law No. 479-FZ was signed, which provides for the obligation for advertising distributors and advertising system operators who distribute advertising in the Internet, aimed at attracting the attention of advertising consumers located in the territory of the Russian Federation, mandatory contributions to the federal budget in the amount of 3% of the amount of income received during the quarter from the sale of services for the distribution of advertising on the ‘Internet’. Quarters are counted from the beginning of the calendar year.