On 14 July 2025, the Council of the State Duma began reviewing Draft Law No. 951518-8 “On Amendments to Article 12 of the Federal Law ‘On Personal Data’” (hereinafter referred to as the “Draft Law”).
Amendments
The Draft Law introduces changes to the rules for determining countries that provide “adequate” protection of personal data (hereinafter referred to as “PD”). Under the current regulations, a foreign state qualifies for this status if:
-
It is a party to the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data (hereinafter referred to as the “Council of Europe Convention” or the “Convention”);
-
It is not a party to the Convention, but its applicable legal norms, as well as measures implemented to ensure the confidentiality and security of PD during processing, comply with the provisions of the Council of Europe Convention in the opinion of Roskomnadzor (hereinafter referred to as “RKN”).
The current list of such countries is set forth in Roskomnadzor Order No. 128 dated 5 August 2022 “On Approval of the List of Foreign States Ensuring Adequate Protection of the Rights of Personal Data Subjects” (hereinafter referred to as the “List”).
If the Draft Law is adopted, the first criterion (participation in the Convention) will lose its legal significance. The List will be formed based on an alternative approach, incorporating an assessment of the measures applied by foreign states to uphold fundamental data protection principles, confidentiality, and security of PD during processing.
What issues might businesses face due to the proposed changes?
Question No. 1: How will the proposed changes affect previously submitted notifications to RKN regarding cross-border transfers of PD (hereinafter referred to as “Notifications”)?
The Draft Law does not provide a direct answer to this question. However, the following scenarios can be expected after the initiative is approved and the new List is adopted:
-
The need for Operators to resubmit/update their Notifications if they intend to continue cross-border transfers of PD to countries excluded from the List;
-
The need to submit a Notification only in the case of establishing a new cross-border PD transfer flow (to a country excluded by RKN from the List) in addition to those previously indicated.
Question No. 2: Could restrictions or prohibitions on cross-border PD transfers be imposed?
The explanatory note to the Draft Law states that the amendments are necessary to ensure the inviolability of private life for citizens of the Russian Federation. Since this right is prescribe in the Constitution of the Russian Federation, we suppose that in cases where a country is excluded from the List, RKN may still decide to prohibit or restrict the transfer of PD to such jurisdictions when analyzing the information submitted by the Operator in the Notification.
We note that the new amendments do not affect the general procedure for cross-border transfers of PD, which is currently divided into:
-
A notification-based procedure (for planned transfers to countries providing an “adequate” level of protection);
-
A permission-based procedure (for planned transfers to countries not providing an “adequate” level of protection).
Further Consideration of the Draft Law
The first reading of the Draft Law by the State Duma is scheduled for the autumn session of 2025.