On 30 September 2026, a draft Federal Law “On Amendments to the Federal Law ‘On Communications’ and Certain Legislative Acts of the Russian Federation” (ID 171465) (hereinafter – the “Draft Law”) was published.
The Draft Law provides for the third package of measures to combat offences committed using information and communication technologies (“Antifraud 3.0”), and consistently continues the two previous ones.
-
The first package (“Antifraud”, Federal Law No. 41-FZ dated 1 April 2025) was devoted to the creation of the “Antifraud” state information system for the exchange of information between banks, telecommunications operators and government authorities, as well as to strengthening banks’ control over suspicious transactions.
-
The second package (“Antifraud 2.0”, Federal Law No. 210-FZ dated 26 June 2026) developed this system and provided for new measures to counter cyber fraud. “Antifraud 2.0” took effect on the day of its official publication, but a number of provisions will be phased in until 1 January 2028, including the self-ban on incoming international calls and the ability to report fraud via Gosuslugi.
-
The third package retains this direction, but goes beyond the telecommunications and financial industries and, in addition to them, affects the procedure for processing personal data (hereinafter – “PD”).
Amendments to the PD Law
The proposed amendments to Federal Law “On Personal Data” No. 152-FZ dated 27 July 2006 (hereinafter – the “PD Law”) alter the entire system for collecting consents to PD processing.
Industry-specific lists of PD
The Draft Law provides that, in agreement with Roskomnadzor, industry ministries in their respective fields, as well as government authorities of the constituent entities of the Russian Federation, municipal authorities and the Bank of Russia, will adopt regulatory acts defining, for each purpose of processing:
-
the composition of personal data and
-
the permitted actions with such data
This refers to cases of processing based on consent, a contract and the operator’s legitimate interest (clauses 1, 5 and 7 of Part 1 of Article 6 of the PD Law). Consequently, operators will have to collect and process only the PD that are expressly provided for by these acts.
This innovation should make it easier for operators to determine the legal grounds for processing and the categories of PD permissible for it.
Prohibition on requiring consent where unnecessary
Roskomnadzor has repeatedly taken the position that the collection of consents should be minimised and that other grounds for PD processing should be applied first and foremost.
To implement this position of the regulator, Part 2.1 is to be added to Article 18 of the PD Law, under which an operator will not be entitled to require consent to the processing of PD if obtaining it is not provided for by an international treaty, a federal law or the industry-specific lists of PD adopted in accordance with the new provisions of the law.
Thus, a statutory priority of other grounds for PD processing over consent is established.
Consent via Gosuslugi
The Draft Law provides that consent and its withdrawal may be submitted either directly to the operator or via the Gosuslugi portal. At the same time, information on consents obtained directly by the operator will, in certain cases, still be transmitted by such operator to the Gosuslugi portal. The specifics of such collection and transmission of consents, including the composition of PD, the cases and the procedure, are to be established by the Government of the Russian Federation.
Standard consent forms for Gosuslugi are to be approved by Roskomnadzor and the Ministry of Digital Development. For the financial market, additional approval by the Bank of Russia is required.
This concerns simple consent: at present, the innovations do not affect cases of collecting consent in written form; however, we do not rule out that such specifics may be additionally set out in industry-specific acts or clarified during further consideration of the Draft Law.
The data subject will be able to obtain on Gosuslugi information confirming the fact that their data is processed on the basis of consent, as well as to withdraw their consent. If the data subject considers the processing unlawful, they will be able to appeal the operator’s actions to Roskomnadzor via the same portal. According to the clarification of the Ministry of Digital Development, a unified consent platform is to be created on this basis on Gosuslugi[1].
Consent to dissemination
Such consent may be given only directly to the operator; the channel through Roskomnadzor’s information system will be abolished (current clause 2 of Part 6 and Part 7 of Article 10.1 of the PD Law).
Conclusions and current status of the Draft Law
At present, the Draft Law is going through the public discussion procedure, and its provisions may change during further consideration. At the same time, the direction of regulation is already clear: the priority of other grounds for PD processing over consent, the establishment of the composition of PD and the permitted actions with such data in industry-specific lists, as well as the transfer of part of the consent-related processes to the Gosuslugi portal. If these approaches are retained, operators will need to:
-
analyse the grounds for PD processing that they apply and determine in which cases consent does not need to be requested
-
after the industry-specific lists are approved, check the composition of the PD collected and the actions performed with such data against them
-
prepare processes for obtaining, withdrawing and transmitting information on consents via the Gosuslugi portal, including with regard to standard consent forms, once they are approved
According to the text of the Draft Law, the expected date of entry into force of the new provisions is 1 March 2028. Nevertheless, we recommend that PD be processed already now primarily on the basis of statutory requirements, and that consent be used only in cases where the amount of data processed exceeds that permitted by law.