PD in advocates' practice

What the first call reveals

• Full name
• phone
• passport
• address
• health

• criminal record
• private life

Often special categories of PD. On top: advocate secrecy (Art. 8 of Law 63-FZ) and third parties' protected secrets that arrive with the case

Typical error

Secrecy does not remove operator status

no notification, policy or HR coverage: compliance is incomplete

Two regimes

Both must be observed

under Law 152-FZ an advocate is an operator, duties intact

Art. 8 of Law 63-FZ: secrecy covers all legal-aid information, including the client's PD

secrecy sets a higher protection standard and few recipients but does not replace processing grounds or notification

Irony: a phone notebook entry reading "Witness in the Petrov case, do not pick up after 22:00" is already PD processing. A risky one

Advocate's briefcase

secrecy regimes operate in parallel with the PD law, not within it, so one case file follows several sets of rules at once

Personal data

client, opponents, witnesses and third parties

Advocate secrecy

everything learned in connection with providing legal aid

Inherited secrets

banking, medical, commercial, tax, sometimes state

Irony: an advocate lawfully keeps a dossier at home that would get anyone else prosecuted. The only question is where "home" is and whether it syncs to a foreign cloud

2011

Supreme Court

No notification required

ruling of 05.08.2011 No. 20-AD11-3 treated advocates as exempt; proceedings under Art. 19.7 of the CAO were discontinued

2012

Roskomnadzor

Advocate is an operator

the position was published by a regional RKN office

Today

152-FZ

No special status

the law does not single out advocates, and professional processing of others' data makes one an operator

01.07.2025

FPA Council

Position of the bar

the guidance covers RKN notification, individuals' consent and advocate secrecy, and applies to advocate offices too

Clients

their data and that of other proceedings participants is processed by law, without consent

Security

protection of client data is governed by the advocate secrecy legislation

Employees

advocate processes this data as employer (Art. 86 Labour Code); outside legal aid, per FPA, with consent

Notification

filed as a general rule; may be skipped only for non-automated processing

Irony: for twenty years advocates debated whether they are operators. Meanwhile fines were introduced for failing to notify of PD processing: up to ₽10,000 for an advocate, ₽50,000 for a chamber or bureau head

23-FZ

Art. 18(5) of Law 152-FZ

From 01.07.2025 a ban, not a condition

recording, organising, storing, updating and retrieving PD of Russian citizens in databases abroad is banned, with narrow exceptions

the rule is framed as an impersonal ban, not a duty of one operator

check contracts signed before 01.07.2025 for a localisation clause

Practical question

Where do your cloud servers physically sit?

• iCloud
• Google Drive
• Notion
• Gmail
• Outlook

phone notes

primary recording abroad with later replication to Russia is banned from 01.07.2025

parallel collection into Russian and foreign databases is banned too

Irony: "I keep everything in the cloud, meaning I don't know where, but it's convenient" is not an answer to where the data is stored

vs

Convenient

What advocates use

Gmail and Outlook on foreign servers

chats in foreign messengers

phone notes and flash drives

personal laptop without encryption

Required

What the law requires

sending data abroad is CBT under Art. 12 of Law 152-FZ

since 01.03.2023 RKN is notified separately

assessing PD protection in the recipient country

primary collection only into Russian databases, Art. 18(5)

RKN, letters of 24.03.2025 and 10.04.2025

Art. 18(5) as amended by 23-FZ bans collection using foreign databases but does not restrict CBT of data already collected in Russian databases: Art. 12 and the notice of intent apply to it

Irony: advocate secrecy sent via a messenger with servers on another continent is protected by end-to-end encryption (it is not). But the stickers are nice

CAO, Art. 13.11

Advocate liable as an individual

turnover fines of 1-3% of revenue, up to ₽500m, do not apply (420-FZ from 30.05.2025)

leak: up to ₽400k for individuals (Parts 12-14), disputed for advocates; for chambers and bureaus (non-profits) officials pay up to ₽600k

non-localisation (Parts 8, 9): up to ₽50k, up to ₽100k if repeated

Crim. Code, Art. 272.1

Illegal trade in PD

illegal collection, storage, use or transfer of computer data with PD

in force from 11.12.2024 (421-FZ)

up to imprisonment

63-FZ, Code of Ethics

Disciplinary liability

for breaching advocate secrecy (Art. 8, Law 63-FZ; Art. 6, Code of Professional Ethics)

what money cannot fix

Good news: the ₽500m fine was not designed for advocates. Bad news: under Art. 272.1 of the Criminal Code you can swap roles with your client, from defender to defendant

1

Where the data is

establish where client data is physically stored and weigh foreign infrastructure against domestic

2

Hardware

find weak spots: unencrypted laptop, shared personal/work account, flash drives

3

Incident

check the PD processing policy, consent forms and response times: notify RKN of a leak within 24 and 72 hours

4

Notices

weigh the risks of filing vs not filing the processing notification given the 2025 FPA guidance, and CBT risks

5

Regime in writing

record the information handling regime to evidence reasonable measures

Next: leak notification is covered in Section 28 "Incidents"; the checklist of core PD processing and protection controls is in the resources section