On July 8, 2026, the State Duma adopted in the third reading draft law No. 951518-8 on amendments to Article 12 of the Federal Law "On Personal Data" and certain legislative acts of the Russian Federation.
Key changes
The approach to forming the list of foreign countries that ensure adequate protection of the rights of personal data subjects ("PD") has been changed.
According to the current regulation, the state is included in the list if it meets one of the two criteria:
-
It is a party to the Convention for the Protection of Natural Persons with regard to Automated Processing of Personal Data No. 108 dated 28.01.1981 (the "Convention"), or
-
It is not a party to the Convention, but its legal regulation and protection measures are recognized by Roskomnadzor as complying with the Convention/
Now, the State's mere participation in the Convention no longer confers on it the status of providing adequate protection for PD. The assessment is to be conducted solely on substantive grounds: the legal regulation in the field of PD, as well as the measures actually applied to ensure the confidentiality and security of PD, must comply with the provisions of the Convention.
Practical impact on business entities
Roskomnadzor will be required to conduct a full assessment of each jurisdiction: analyze its legal regulation, the actual application of norms, and compare the level of protection with the Russian one. This entails revising the current list of 89 countries, which creates uncertainty for businesses during the transition period, increases regulatory risks (if a country is excluded, additional grounds for data transfer will be required), and requires updating internal privacy policies, contracts, and inspections of foreign counterparties.
We recommend business entities to monitor updates to the list of States that provide adequate PD protection, and develop internal procedures in advance to obtain written consent from data subjects and assess protection in jurisdictions that might be excluded from the list.