Digest of key PD developments and initiatives

• The law was passed as an amendment extending the validity of weapons permits in the new regions (draft law No. 974777-8), but by the second reading it was supplemented with a new version of Art. 15 of the Federal Law "On the Federal Security Service" (through an amendment to Art. 2(7) of Law 239-FZ of 23.07.2025).
• FSB bodies may obtain free of charge copies of databases (parts of databases) owned by organisations regardless of ownership form and containing information needed to perform the duties assigned to the FSB. No court decision is required: the basis is a directive of the FSB Director, his deputies or the head of an FSB territorial body.
• Copies must be destroyed once the purposes of obtaining them are achieved. The FSB Director determines the requirements for the form and content of the directive, the list of authorised officials, and the procedure for obtaining and destroying copies. FSB bodies and their officials are liable for unlawful use of the copies.
• The rule does not apply to databases accessed through SORM equipment and software, and obtaining copies must not restrict organisations' economic activity that is not prohibited by law. Separately, the FSB's right to receive information systems and databases from state bodies and state extra-budgetary funds, including by remote access, is established (from 01.01.2026).
• For privacy, transferring database copies under an FSB directive becomes a separate case of PD processing without data subjects' consent, based on the operator's legal obligation (Art. 6(1)(2) of Law 152-FZ). It is advisable to reflect this in the PD processing policy and the record of PD transfers; the operator remains responsible for protecting PD until the copy is handed over.

Under Art. 1(12)(b) of the Law, cases of violations of Art. 13.11 of the CAO will no longer be heard by arbitrazh court judges, as they have been since 30.05.2025 under Law 420-FZ.

• The law creates a list of individuals who have opted out of gambling, maintained by the single gambling regulator. Gambling organisers and certain other persons must check whether an individual is on the list and refuse them participation in gambling and access to a personal account on the organiser's website, or take other actions specified in the law. Among other things, gambling organisers and persons acting on their instruction are prohibited from sending advertising to persons on the list. To be added to or removed from the list, a person must submit an application with a consent to personal data processing (CPD) attached. The CPD forms submitted with such applications must be developed by the FTS in agreement with RKN by 29.03.2026.

P.S. In connection with the adoption of the law, a new item 105 "information on participation (refusal to participate) in gambling" has been added to the PD Catalogue.

The law provides for mandatory state genomic registration of certain categories of citizens, including contract servicemen, citizens serving in volunteer formations and internal affairs officers. The document states that citizens' data will be stored until they reach the age of 100.

• Articles 2 and 3 of the Law of the Russian Federation "On the Right of Citizens of the Russian Federation to Freedom of Movement and Freedom to Choose a Place of Stay and Residence within the Russian Federation" have been amended. The document establishes a new mechanism for individuals and legal entities to search for citizens through MVD bodies.
• Before the law was adopted, internal affairs bodies refused the vast majority of requests for citizens' contact details because of strict PD protection requirements prohibiting disclosure without the data subject's consent.
• A procedure for notifying the person sought is introduced, in which the MVD acts as an intermediary without disclosing PD to the applicant:

1. 1The applicant sends a request to a territorial MVD body (including via Gosuslugi), stating their contact details and the reason for the request.
2. 2The MVD body establishes the address of stay/residence of the person sought and sends them a postal notice with the initiator's contacts.
3. 3The person sought decides independently whether to get in touch. The citizen's right to privacy is preserved in full.

• The law officially defines and specifies the concepts "address and reference information" and "address and reference work".

• The President of the Russian Federation signed a law improving electoral legislation, which among other things prohibits the use of AI-generated images of people in campaign materials.
• The amendments were made to the laws "On Basic Guarantees of Electoral Rights and the Right to Participate in a Referendum of Citizens of the Russian Federation" and "On the Election of Deputies of the State Duma of the Federal Assembly of the Russian Federation".
• The law bans the use in campaign materials of images and voices of people, including fictitious and deceased persons, created with AI. Neural-network generation of images and voice is allowed only for candidates and persons who have consented to the use of their images.
• Photographs and voices of Russian citizens over 18 may be used in election campaigning with their written consent. Previously only photographs of the candidates themselves could be used, including among an indefinite number of people. Images or voices of persons affiliated with a foreign agent may be used in campaigning only with an appropriate indication.

• Transfer of Russians' genetic data abroad is restricted to ensure its safety and protection. The law on state regulation of genetic engineering activities is extended to the handling of human genetic data.
• Transfer of genetic data abroad is permitted only to provide medical care to Russian citizens, to develop medicines and biomedical products for them, and within international cooperation in healthcare and biological safety. Genetic information may be provided in both physical and digital form.
• The procedure and conditions for transferring genetic data outside Russia will be set by the Government, the draft law states. It will also set requirements for individuals and organisations making such transfers. Transferring the results of population genetic and immunological studies to foreign individuals and legal entities is also prohibited. The definition covers any action that makes the information accessible to foreigners, both in Russia and abroad. In particular, sending genetic data, disseminating it, posting it on the internet and granting access to it will all count as transfer.

• From 01.07.2026, banks must provide information on accounts and deposits of minors aged 14 to 18 to their legal representatives - parents, adoptive parents and trustees. The exception is where full legal capacity is acquired before 18 through marriage or emancipation.
• The authority of a legal representative is confirmed by data from the GIS "Unified Centralised Digital Platform in the Social Sphere" received through interagency electronic interaction and, if unavailable, by a birth certificate, an adoption certificate or an act of the guardianship and trusteeship authority appointing a trustee.

• The CAO has been supplemented with Art. 13.55 "Failure to perform the obligation to authorise internet users when providing access to information": the owner of a website, website page, information system or program is liable if access is provided to authorised users and Russians are authorised other than by one of the methods permitted by Art. 8(10) of Law 149-FZ (subscriber number, ESIA, UBS, authorisation service of a Russian owner). In some cases the fine reaches ₽700k.
• The new Art. 13.56 of the CAO introduces fines for using recommendation technologies without informing users, and for failing to publish the rules for applying such technologies, an e-mail address for legally significant messages and information on the resource owner. In some cases the fine reaches ₽2.8m.
• The relevant draft law (see section 4) was passed by the State Duma on 09.06.2026 and signed by the President on 26.06.2026.

• Limit on bank cards: no more than 20 per person; before issuing a new card the bank checks compliance with the limit.
• Victims of fraudsters gain the right to compensation of stolen funds from banks and telecom operators if they failed to prevent the fraudsters' actions; to obtain compensation, the victim must report to the police and the bank.
• A subscriber may require the operator to block incoming international calls; the restriction can be lifted only through a multifunctional centre (MFC).
• A register of unique mobile device identifiers is created: IMEI data is reported to the operator and entered in the telecom services contract.
• A contract with a telecom operator can be terminated only 90 days after it is concluded, which is aimed against revolving SIM card replacement.
• A button for reporting fraud on Gosuslugi is introduced, together with the option to notify the operator that a SIM card is being given to a child, with subsequent restrictions on children's SIM cards (see the draft rules in section 5).
• Dropped from the final version were confirmation of actions via Max, regulation of SIM boxes, linking an account to the taxpayer ID (INN), restrictions on restoring access to Gosuslugi, and registration on significant resources only with a Russian e-mail address. The package does not change the authorisation procedure on Russian internet resources.

• For the first time, a federal law sets out basic definitions: artificial intelligence, large foundation model, dataset, training, developer. The requirements are addressed to large foundation models; narrowly specialised solutions and computer vision remain outside the scope.
• Categories of sovereign and national models are introduced: a Russian legal entity as developer, localisation of data processing in data centres in Russia, and confirmation of compliance with legislation. The Government of the Russian Federation may set cases where only such models must be used, in the banking sector - in agreement with the Bank of Russia.
• Labelling of materials created with large foundation models has changed from mandatory to voluntary, and developers' obligations and liability are formulated by cross-reference.
• Use of copyright and related-rights objects for training is excluded from infringement, but only for sovereign and national models and only where the copy was lawfully obtained or the work is openly accessible without technical restrictions. The question of compensation for rights holders is left open.
• For privacy, the most significant point is developers' access to datasets from state information systems: the text does not link it to the requirements of Law 152-FZ and the PDIS regime, which leaves open the question of the lawfulness of processing PD in training datasets.
• A transitional period for existing AI systems runs until 01.09.2032. A significant part of the substantive requirements is delegated to secondary legislation.

• A foreign state's formal participation in the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) ceases to be a standalone guarantee of adequate PD protection: all references to parties to the Convention have been removed from Art. 12(5), (10) and (11) of Law 152-FZ.
• The only legally significant benchmark for the operator becomes the list of states ensuring adequate protection approved by RKN. Inclusion in the list takes account not only of legal regulation but also of the measures the state actually applies to observe the fundamental principles of PD protection, confidentiality and security.
• RKN's powers under Art. 12(5)(2) are expanded: it can now prohibit or restrict CBT to protect the foundations of the constitutional order, morality, health, citizens' rights, defence and security in respect of any state, not only one that is not a party to the Convention.
• Countries recognised as adequate by virtue of Convention membership will keep that status only through an updated RKN list (see the draft in section 6), so transfer routes relying on Convention 108 should be inventoried in advance.

• The commission's main task is to coordinate the actions of federal and regional authorities, the Bank of Russia and other interested state bodies to create, develop and introduce AI technologies. In addition:

1. 1developing a strategy for introducing AI;
2. 2developing approaches to adapting economic sectors, the social sphere and public administration to active use of AI;
3. 3coordinating the introduction of AI into the educational process "to form a harmoniously developed personality";
4. 4training teachers and AI specialists;
5. 5preparing proposals for developing international cooperation in AI, and others.

• The commission also includes Minister of Defence Andrey Belousov, Moscow Region Governor Andrey Vorobyov, Sberbank head German Gref, the President's Special Representative for Digital and Technological Development Dmitry Peskov and Minister of Digital Development Maksut Shadaev.

1. 1If a Russian passport (or other basic identity documents) is unavailable, Russian citizens may check in on presenting a Russian national driving licence. The driving licence is officially established as an alternative physical medium for verifying identity in the hotel sector.
2. 2A legal basis is introduced for using digital ways of confirming identity at check-in:

• UBS: Identification and/or authentication may be carried out using the Unified Biometric System.
• Gosuslugi: The mobile app of the FGIS "Unified Portal of State and Municipal Services" may be used.

1. 3Conditions for checking in minors are regulated, requiring attention to collecting consents of legal representatives:

• Children under 14: Check-in is possible only with parents or accompanying persons. Accompanying persons must provide the consent of the parents (legal representatives).
• Minors aged 14 and over: May check in independently with an identity document and the consent of parents (legal representatives).
• When checking in with accompanying persons (not parents), the consent of legal representatives is also required.
• For minors, identification via UBS or Gosuslugi is also possible (where the relevant consents and technical capabilities exist).

1. 4Procedures for transferring data to the registration authorities (MVD) remain tied to the current Rules for registering Russian citizens (Government Resolution No. 713) and for migration registration of foreigners (Government Resolution No. 9). The new rules only clarify the ways of collecting initial data for these processes.

The membership of the subcommission on the development and introduction of artificial intelligence technologies, including autonomous AI systems, of the Government commission on digital development and the use of information technology to improve quality of life and business conditions has been approved.

• The Government of the Russian Federation is instructed to ensure centralised collection, processing and provision of scientific and technical information for training sovereign and/or national large foundation AI models, amending regulations if necessary (sub-para. "b" of para. 2).
• It is separately instructed to devise a mechanism for researchers' access to software based on Russian AI technologies (sub-para. "c" of para. 2) and to consider an ELR in the "Sirius" territory for developing AI technologies, reporting by 01.05.2027 (para. 5).
• The instruction concerns scientific and technical information but continues the line of Law 243-FZ on developers of sovereign and national models getting access to state data sets (see section 1 and the ELR initiative in section 8), where the question of PD in training datasets remains open.

Telecom operators determine the criteria for mass calls themselves; neither the Government of the Russian Federation nor the Ministry of Digital Development has such powers. Consent to mass calls must be obtained before the call itself, must unambiguously identify the subscriber and establish their will, and no special requirements for such consent are provided. A telecom operator may block mass calls made in breach of legal requirements. A subscriber cannot selectively opt out of mass calls, i.e. cannot choose a category and/or initiator of calls. An agreement on making mass calls and a telephone services agreement are different documents. A telecom operator in whose network a call from a company or sole proprietor originates is not yet liable for breaching the labelling requirements for such calls.

• The total number of operators to receive preventive visits is 1156 organisations/sole proprietors, including both large companies and numerous state institutions, schools and medical centres. For example, in Moscow and the Moscow Region 65 operators should prepare for a preventive visit.
• OCR text version of the plan.

• The document approves methodological recommendations that define how exactly the Ministry of Digital Development should prepare and send operators requests (demands) to provide depersonalised personal data to the GIS "Unified Information Platform of the National Data Management System" (EIP NSUD).
• Under the order, to prepare a demand for depersonalised data the Ministry may send requests to users of the data sets it is interested in; it may also engage a subordinate institution that maintains the depersonalised data processing subsystem (DDPS) of the EIP NSUD.
• This order was adopted to implement new statutory provisions (Art. 13.1 of Law 152-FZ), under which the state forms centralised sets (datasets) of depersonalised personal data for later use (for example, for developing AI technologies and for research), and businesses must provide such data at the Ministry's request.

• This standard is a guide to creating transparent and trustworthy systems. It is a modified version of the international standard ISO/IEC 42005:2025, adapted to Russian realities and technologies.

🔍What is inside?

• Impact assessment (AI system impact assessment) is now defined as a documented process of identifying and assessing the impact of AI on people and social groups.
• The standard sets out how and when to carry out such assessments at different stages of the system's life, from design to deployment.
• The process must be seamlessly embedded in the overall AI management system (GOST R ISO/IEC 42001) and the organisation's risk management.
• Special attention is paid to "high-risk" (sensitive use) and "limited" use of systems that may significantly affect human rights or financial position.

🛠The standard requires detailed documentation of:

• Data quality (including checks for undesirable bias).
• Algorithm and model parameters.
• The deployment environment, including geographic and cultural context.
• Taxonomies of harm and benefit: from transparency and explainability to environmental sustainability.

🚀The standard is relevant to any organisation that develops or uses AI, regardless of size. Implementing it helps not only to meet requirements but also to manage stakeholder expectations.

• The Ministry of Digital Development has updated requirements for owners of communication networks that must support operational-search systems (SORM). The order was signed on 16.12.2025, registered with the Ministry of Justice on 22.05.2026 (registration No. 86587) and published the next day; it expands the list of data that must be available for search and transfer on requests from authorised bodies.
• SORM now covers, in particular, subscribers' address and passport details, taxpayer IDs (INN), bank details, IP addresses, domains, logins, geocoordinates and information on organisations. The document also specifies technical methods of data exchange, including GraphQL, WebSocket and HTTP interfaces.

• From 01.09.2026 the circle of persons entitled to receive certificates and medical reports is widened: they can be obtained not only by patients but also by close relatives, including full and half siblings; the concept of close relatives is introduced and the option of handing documents to other persons is added.
• Medical reports may be issued in free form unless legislation provides otherwise.
• The provision requiring the person's consent to issue a certificate in electronic form is removed.
• The basis for issuing becomes the presence of the relevant information in the patient's medical records.

• Government Directives No. 2240-r and No. 2241-r of 19.08.2025 on pre-installing Russian software do not oblige citizens to install MAX, register in it or use it.
• MAX LLC is the operator of PD processed to register users and provide the service's core functionality, and processes data from the GIS in the cases provided for by its privacy policy. An organisation receiving data at the user's initiative and the developer of a separate app are independent PD operators with regard to the data they receive, so the platform's policy does not replace their own operator obligations. In general, the operator is determined by the specific functionality, data set, purposes and legal bases of processing.
• Liability for a leak or account takeover is determined case by case, taking into account the circumstances, fault and causation. The operator is liable if it failed to perform its obligations, including on protection measures (Arts. 18.1 and 19 of Law 152-FZ) and on notifying RKN of an incident (Art. 21(3.1) of Law 152-FZ).
• The user agreement applies insofar as it does not contradict mandatory legal requirements and cannot limit the user's rights to PD protection, compensation of losses and compensation for non-pecuniary damage. Anyone relying on limitation-of-liability clauses in offers should take this into account.
• The Ministry acknowledges that protection measures reduce risks but do not exclude all failures and unlawful acts, including social engineering, malware, unlawful SIM card reissue and fraudsters obtaining confirmation codes. Contacting support is not a prerequisite for applying to RKN, the MVD or a court.
• Technical inability to use a particular service is not in itself a ground to restrict the right to education, and the ways of interacting with students and their legal representatives are determined by educational organisations, their founders and education management bodies.

• The methodological recommendations for teaching staff of general education organisations proceed from the premise that AI in school plays an auxiliary role and does not replace the teacher's professional role; the final decision and responsibility for using AI results always rest with the teacher.
• Teachers are advised not to upload to publicly available AI services the PD of pupils and parents, restricted-access information, pupils' grades and work, or the school's internal documents. Teachers must check materials created with AI for scientific accuracy, age-appropriateness and compliance with the Federal State Educational Standards (FGOS).
• AI services are not used in interim and final assessment or in tasks requiring personal demonstration of learning outcomes. In primary school pupils do not use AI independently; in basic school they may use it to find information and explain complex concepts, and in upper school also in project and research work.
• A teacher must inform parents about the use of AI in the educational process and may not pass off AI-generated text as their own authored work in competitions, publications and certification papers without stating that AI was used and that they reworked the content themselves.

• The order was registered by the Ministry of Justice on 16.10.2026 (No. 88779), approves the list afresh and repeals RKN Order No. 128 of 05.08.2022.
• The order was adopted in the draft's wording (see section 6). Instead of the two sections of the previous list (parties to Convention 108 and states that are not parties), there is now a single continuous alphabetical list, with one substantive change: Ukraine has been removed from the list.
• The order does not state an effective date, so the general rule applies: it enters into force ten days after official publication.
• For privacy: after the amendments to Art. 12 of Law 152-FZ, membership of Convention 108 does not by itself confirm adequacy, so this list remains the operator's only benchmark. CBT routes to Ukraine should be reviewed as transfers to a state that does not ensure adequate protection, and the validity of CBT notifications to RKN should be checked.

It is proposed to define persistent harassment (stalking) as actions that cause mental suffering and fear for one's safety (even after a request to stop). Such actions would include systematic surveillance, attempts to establish contact (calls, SMS, gifts) and use of personal data to order goods or services.

• Article 5 of the draft law amends Law 152-FZ "On Personal Data":
• A targeted amendment to Art. 10 (on special categories of PD): the wording of part 3 is clarified to refer directly to "processing of special categories".
• A new part 3¹ is added to Art. 10: processing of special categories of PD on Russian citizens' participation in the special military operation (SMO) and/or counter-terrorism operations (CTO) and on membership of their families is permitted for state/municipal bodies within their powers and for other persons in cases and under the procedure determined by federal laws.
• Article 4 of the draft law amends Law 149-FZ "On Information, Information Technologies and Information Protection":
• A provision is added that the Government of the Russian Federation may set cases where, for authorisation by e-mail address, the address must be created using domain names belonging to the groups of domain names that make up the Russian national domain zone.
• A requirement is introduced to confirm "significant actions" on the internet (the list is approved by the Government): confirmation is by an SMS code plus a code/message via MAX, sent by the resource owner (a Russian legal entity or Russian citizen operating in Russia). For banks and the financial market, the list is additionally agreed with the Bank of Russia.
• A ban on disseminating "misleading" information: presented as reliable messages, creating a threat of property damage and/or unlawful access to the user's PD or other information (introduced as a separate category).
• Article 8 of the draft law amends Law 572-FZ (on identification/authentication with biometrics, the UBS, etc.):
• Parts 18-19 are added to Art. 4: if access to an ESIA account is restricted (including due to detected unauthorised access), access can be restored by one of the listed methods: the UBS; a bank's website/mobile app; an enhanced qualified e-signature; MAX; an MFC; bodies/organisations entitled to issue simple e-signature keys for state/municipal services.

09.02.2026: the Ministry of Digital Development proposed softening the ban on incoming international calls

🔄The draft law was revised after discussions: (1) a mechanism for returning stolen money is added - if a bank or telecom operator failed to follow the procedure for detecting fraudsters, the client is compensated the transfer amount; (2) a limit of no more than 20 bank cards per person is introduced; (3) subscribers will be able to voluntarily block incoming calls from other countries, and foreign calls will be mandatorily labelled; (4) a telecom contract can be terminated only 90 days after signing (against schemes involving frequent SIM card changes); (5) the final version drops mandatory registration on large platforms only via a Russian e-mail, a rigid link between opening an account and the INN, and confirmation of actions via "Max" instead of SMS.

🔄The law was passed by the State Duma on 09.06.2026, approved by the Federation Council on 17.06.2026 and signed by the President on 26.06.2026 (Law 210-FZ, see section 1). The package does not change the authorisation procedure on Russian internet resources: there is no obligation to use a Russian e-mail.

It is proposed to amend the Civil Procedure Code of the Russian Federation. In cases to establish the boundaries of land plots, to correct errors in the Unified State Register of Real Estate and in other similar disputes, information on the plot's owner would be provided at the court's request by the Pension and Social Insurance Fund, the tax or internal affairs authorities, and the public law company Roskadastr.

It is proposed to create tougher and more detailed legal instruments to combat violations of PD security requirements and of privacy. "Articles 137 and 138 of the Criminal Code are supplemented with aggravating features of the offence. The articles on violating the inviolability of private life and the secrecy of correspondence and telephone conversations are supplemented with offenders who acted out of mercenary motives or as a group of persons by prior conspiracy or an organised group. Previously it concerned only persons who committed the offence by abusing their official position," said Vladimir Gruzdev, Chairman of the Board of the Association of Lawyers of Russia (ALR). He said the Criminal Code will also gain a new offence - violation by a person subjected to administrative punishment of the requirements for providing mobile radiotelephone services to a foreign national or stateless person.

It is proposed to supplement Art. 44.1-1 of Law 126-FZ of 07.07.2003 "On Communications" with a rule requiring customers of mass calls or telecom operators to inform subscribers of the nature of mass and/or automated calls at the very start of the conversation. This covers mass calls using synthesised speech, automated recording, a voice robot or other automated means without human involvement. In the explanatory note the deputies said that citizens' trust in telephone communications is currently declining because there is no such mandatory notification. This situation creates risks of unfair use of subscribers' data and hampers informed interaction.

• The Ministry of Justice has developed a draft law that would allow processing of biometric data of suspects, accused and convicted persons without their consent; the document has been posted on the portal of draft regulatory legal acts.
• "Processing of biometric personal data of suspects and accused persons. Processing of information characterising the physiological and biological features of suspects and accused persons in places of detention may be carried out by the administration of the place of detention to establish their identity without the consent of the personal data subject," the draft law says.
• The processing of biometrics of these categories of persons is expected to be applied to ensure security at facilities of the bodies and institutions of the penal enforcement system.

Update On 30.09.2026 the Government of the Russian Federation submitted the draft law to the State Duma (No. 460-9, developer: Ministry of Justice). Bodies and institutions of the penal enforcement system, including pre-trial detention centres, correctional colonies and correctional centres, will be able to process PD, including biometric PD, of suspects, accused and convicted persons without their consent for identification and authentication. The amendments are made to the laws on penal enforcement institutions and bodies and on detention, and to the Penal Enforcement Code, and the aim is to centralise the processing of data that is now collected and stored in more than 450 institutions. Unlike the January version, the submitted text does not mention monitoring of released persons, and retention periods and the fate of the data of acquitted and released persons are not disclosed, while the Ministry of Justice has stated that data will be destroyed or depersonalised once the purposes of processing are achieved. According to the Biometric Technologies Centre, the draft law is not connected with the UBS.

• The Ministry of Digital Development proposed to simplify the use of biometrics at checkpoints of state bodies, the Bank of Russia, state corporations and enterprises of the defence, nuclear and fuel and energy sectors. An organisation would be able to keep employees' digital vectors in its internal information system and match the data of people wishing to enter its premises against them, without querying the state Unified Biometric System (UBS) each time. Strict requirements remain only for identification (establishing identity), which still goes only through the UBS. For authentication (confirming identity at the entrance), relaxations are introduced.
• Currently every pass of an employee costs money (a request to the UBS). The draft law allows accredited organisations (state bodies, the Bank of Russia, state corporations) to use UBS vectors (mathematical templates) in their local systems.

• Under Art. 272.1 of the Criminal Code, liability currently arises for unlawful use or transfer (dissemination, provision, access), collection or storage of computer information containing personal data if it was obtained through hacking or other unlawful access.
• A group of deputies of the Just Russia faction led by its leader Sergey Mironov proposed adding the concept of "automated processing" to Art. 272.1(1) of the Criminal Code as a criminal act, so that people could be held liable for the very fact of unlawful algorithmic processing of other people's personal data, even if it was not subsequently disseminated or stored.
• The authors of the initiative noted that the term "automated processing" is well established in legislation and consistent with the terminology of the Law "On Personal Data", which guarantees a uniform legal space and correct application of the criminal law provision.

• The authors propose a separate federal law "On Countering Persistent Harassment". The draft law introduces the concepts "persistent harassment", "protection order", "stalker" and "person subjected to persistent harassment".
• Persistent harassment is defined as systematic surveillance, attempts to make contact, sending gifts, and using the victim's personal data to place orders and send correspondence.
• The CAO currently has no separate article on persistent harassment, and the existing provisions do not cover all forms of stalking and allow a ban on approaching only within criminal proceedings. It is proposed to introduce protection orders, which would bar a stalker from approaching the victim, contacting them, etc. A stalker could be held criminally liable for continuing to stalk.

• High and critical risk-level artificial intelligence (AI) systems will need a certificate of compliance with the security requirements of the Federal Service for Technical and Export Control (FSTEC) and the Federal Security Service (FSB). This follows from the Government's draft law "On the Use of Artificial Intelligence Systems by Bodies Within the Unified System of Public Authority and Amendments to Certain Legislative Acts".
• AI systems will be tested for compliance with these requirements at a special test range created by the Ministry of Digital Development. If testing is successful, systems will be admitted for use at critical information infrastructure facilities (which include the communication networks and information systems of state bodies and of energy, transport, financial, telecommunications and certain other companies).
• The new draft law introduces four criticality levels of AI systems:

1. 1minimal, where systems have no significant impact on rights and security (for example, recommendation systems);
2. 2limited, where systems must tell users that they are interacting with a neural network;
3. 3high, where systems are used at critical information infrastructure facilities;
4. 4critical, where systems threaten human life or health or state security, as well as developments capable of making decisions without human intervention.

• The criticality level of a given system will be determined by a new body, the National Centre for Artificial Intelligence in Public Administration under the Government. The centre will also maintain a register of systems admitted to critical information infrastructure. The requirements for obtaining the mandatory FSB and FSTEC certificate for critical and high-level AI systems will be set later in a separate document. One of them will be the AI system's inclusion in the register of Russian or Eurasian software.

• The transfer of Russians' genetic data abroad is planned to be restricted to ensure its safety and protection. The Government Commission on Legislative Activity has approved this initiative of the Ministry of Science and Higher Education. The draft law proposes extending the law on state regulation of genetic engineering activities to the handling of human genetic data.
• If adopted, the initiative will enter into force on 01.09.2026. The draft law states that transfer of genetic data abroad is permitted only to provide medical care to Russian citizens, to develop medicines and biomedical products for them, and within international cooperation in healthcare and biological safety. Genetic information may be provided in both physical and digital form.
• The procedure and conditions for transferring genetic data outside Russia will be set by the Government, the text of the draft law says. It will also set requirements for individuals and organisations making such transfers. The Ministry of Science and Higher Education also provided for a ban on transferring the results of population genetic and immunological studies to foreign individuals and legal entities. The definition covers any action that makes the information accessible to foreigners, both in Russia and abroad. In particular, sending genetic data, disseminating it, posting it on the internet and granting access to it will all count as transfer.

🔑For the first time, a federal law defines the concepts of AI model, AI system, AI service, large foundation models, trusted models and also "exploitation of human vulnerabilities". A clear chain of actors is built: developer, operator, service owner, user. Each has its own obligations and its own measure of liability.

🛡One of the distinguishing features is the concept of "sovereign" and "national" large foundation models. Development, training and operation take place in Russia, by Russian citizens and legal entities, on Russian data. The state undertakes to create favourable conditions for their development.

✅A register of trusted AI models is introduced for state systems and critical infrastructure. A model can enter it upon confirming security and quality requirements. In essence, a perimeter of "admission" of AI to sensitive areas is being formed.

👤The law sets out several important guarantees:

• notification that a decision is made by AI rather than a human
• the right to refuse to interact with AI and receive the service "in a human way"
• out-of-court appeal against decisions made with the help of AI
• the right to compensation for harm

🫆In Article 4 (general principles), personal data and the inviolability of private life are mentioned as part of the principle of the primacy of human rights. Article 5 also states that AI regulation takes into account the "category of processed information" - publicly available or restricted-access. The text has no separate article on protecting personal data when training models, on rules for processing the data of AI service users, on the right to have data removed from datasets or on limits to profiling.

🏷Synthesised content (audio, visual, other) must carry a warning, in both human-readable and machine-readable form. Platforms with an audience of 100K+ must check for labelling and remove unlabelled AI content. A contract with the user may waive "visible" labelling, but machine-readable labelling remains.

⚖️Each actor is liable in proportion to its degree of fault. The developer, operator and service owner may be released from liability if they prove they took all possible measures. The user is liable for deliberate use of AI for unlawful purposes. The operator also has a recourse claim against the developer.

💡Results created with the help of AI are protected under the Civil Code if they meet the criteria for protectability. It is separately stated that extracting information from protected objects to create datasets and train AI is not an infringement of copyright and patent rights (where the material is lawfully accessed).

⚡️For data centres on a special list: priority connection to power grids, reduced tariffs, tax benefits, long-term energy contracts and infrastructure support. In effect, a "green corridor" regime for AI computing infrastructure.

🌐Separate articles deal with international cooperation: forming a "single space of trusted technologies", promoting Russian approaches to AI assessment, technology exports, joint research and educational programmes.

📅The law enters into force on 01.09.2027, and many specific requirements will be defined by Government secondary legislation.

➡️In essence, the law sets the architecture: who is responsible for what, where the limits of the permissible lie, and how the state intends to support AI development.

On 27.04.2026 the draft law was updated: (1) requirements for datasets used to train models were removed; (2) requirements for sovereign and national AI models to be developed and trained exclusively by Russian citizens were dropped - it is now enough for the developer to be a Russian legal entity; (3) the requirement for a service with more than 500,000 users to register as an information dissemination organiser (IDO) was lifted

🔄On 25.06.2026 the Government submitted to the State Duma draft law No. 1271570-8 "On Supporting the Development of Artificial Intelligence Technologies in the Russian Federation", a revised and markedly softened version of the Ministry of Digital Development's earlier draft. It drops the ban on cross-border AI, the concept of trusted models and the strict obligations of operators and users, and labelling of AI content became voluntary. The law was passed by the State Duma on 08.07.2026 and signed on 26.07.2026 (Law 243-FZ, see section 1).

• The draft law would give the Ministry of Defence access to data from the Unified ZAGS register and provides that the Ministry will be able to obtain electronically information on servicemen, civilian personnel, persons discharged from military service and members of their families.
• As the authors explain, this will simplify the provision of social guarantees and compensation and improve military registration.

• Deputies of the LDPR drafted a bill proposing to enshrine citizens' right to access the internet, freedom of expression online, choice of means of communication and personal data protection. The initiative was prepared in response to appeals from citizens concerned about restrictions on internet and communications.
• "The LDPR has prepared the draft law 'On Guarantees of the Digital Rights of Russian Citizens', which includes provisions on access to information: the right of everyone to access the internet; freedom of expression on the internet; freedom to choose the means of communication on the internet; confidentiality and data protection, and others. In the near future, together with professional communities and experts, we will refine this initiative," said party leader Leonid Slutsky.
• He noted that the first discussions of the draft law will take place in the State Duma. Relevant communities, experts and business representatives will be invited to participate. "Our deputies will hold discussions on the basis of regional legislative assemblies," the parliamentarian concluded.

🔄On 22.07.2026 the draft law "On State Guarantees of the Digital Rights of Citizens of the Russian Federation" was resubmitted to the State Duma by a group of deputies from the CPRF faction. The authors count among digital rights the right to access the internet, freedom of expression in the digital environment, PD protection and the right to anonymity under certain conditions. The previous version was submitted in April and returned to the authors in May for lack of an opinion from the Government; the new version contains minor amendments, and no Government opinion has been provided either.

• In mid-March Senator Vladimir Kozhin sent to the Government's staff a draft law introducing fines and criminal liability for creating deepfakes. The draft proposes amendments to the law "On Information, Information Technologies and Information Protection" that restrict the creation and use of false images, video and voice recordings of citizens, that is, deepfakes. Without the citizen's involvement, creating deepfakes, storing and disseminating them or organising access to them would be prohibited, with a number of exceptions.
• It is proposed to fine from ₽500k for forging photo, video or audio materials with neural networks, and to punish the same deepfakes involving government officials, ministers or governors with imprisonment for three to seven years.

• A group of deputies of the CPRF faction in the Duma submitted to the State Duma a draft law proposing to ban a telecom operator from giving a phone number to a new owner within a year after terminating the contract with its previous owner.
• The amendments are proposed to the federal law "On Communications". Currently the period before a phone number is allocated to a new owner is governed only by the operator's internal rules.
• "If a mobile radiotelephone services contract is terminated, the telecom operator has the right to allocate a subscriber number that was previously in use to other persons no earlier than 1 year after termination of the contract," says the text of the draft law.
• According to the authors, the current resale of subscriber numbers by telecom operators after termination of contracts with previous owners creates risks of possible leaks of former number owners' personal data, fraud using old numbers, dissatisfaction among new subscribers who receive numbers with a negative history, and difficulties in identifying a person when using state services.

• There is currently a conflict between two federal laws:

1. 1Under the Law "On Personal Data", consent to the processing of PD after a citizen's death may be given only by their heirs (unless otherwise specified during their lifetime).
2. 2The Law "On Burial and Funeral Affairs" allows the duties of burial to be assumed not only by relatives but also by other persons who have actually taken on this responsibility.
3. 3As a result, funeral services often refuse such persons the paperwork they need, since without heir status they have no legal right to consent to the processing of the deceased's data.

• It is proposed to allow consent to PD processing to be given by persons who have assumed the duty of burial (even if they are not heirs). It is proposed to grant such powers solely for actions related to organising the funeral, to avoid abuse.
• The Government of the Russian Federation, having reviewed the document, called the proposed changes excessive: the list of persons in the draft law does not fully coincide with the list of persons to whom state guarantees are already provided under the burial law (spouses, relatives, legal representatives and other persons).

• Creation of a Unified Register of Pets, which will merge the existing regional databases and remove the need to re-register a pet when moving to another region of Russia.
• A requirement for mandatory identification (marking) and registration of animals in a state information system.
• Giving the Government the right to determine the list of animal species subject to registration and to set the procedure, deadlines and content of information entered in the register.
• For privacy: the register will contain information identifying animal owners, which will heighten the risks of uncontrolled exchange of PD and will require working out a model for the register operators' interaction with individuals.

• Art. 13.55 "Failure to perform the obligation to authorise users when providing access to information" is added to the CAO: fines are introduced for the information resource owner's failure to perform this obligation, which in some cases can reach ₽700k.
• If access to a website's content is provided to authorised users, internet resource owners must authorise Russians using a mobile phone number, ESIA or UBS, or an authorisation service owned by a Russian citizen with no other citizenship (a requirement of Law 149-FZ "On Information").
• Art. 13.56 of the CAO is also introduced, with fines for using recommendation technologies without informing users and for a website owner's failure to publish the rules for applying these technologies, an e-mail address for legally significant messages, and its initials and name. In some cases they can reach ₽2.8m.

🔄The law was approved by the Federation Council on 17.06.2026 and signed by the President on 26.06.2026 (Law 199-FZ, see section 1); the CAO amendments entered into force on 07.07.2026.

• It is proposed to supplement the closed list of aggravating circumstances with a new item "kh" on the use, in committing an offence, of video, audio, images (including electronic) or other audiovisual materials created with AI technologies or other technical means of information processing that reproduce or imitate statements and actions of a person that they did not actually make, or that show a person whose identity is generated.
• The authors point out that the high realism of deepfakes makes it possible to mislead, commit fraud, spread defamation and commit other offences. The amendment could reportedly take effect from September.
• The draft law was submitted by a group of State Duma deputies and senators; the Government of the Russian Federation and the Supreme Court have been reserved about the initiative.

• The draft was prepared pursuant to an instruction of D.Yu. Grigorenko of 27.04.2026 and was sent for approval to state bodies and the Bank of Russia by a Ministry of Digital Development letter of 01.07.2026; the approval deadline expired on 13.07.2026. Entry into force was planned from 01.03.2028.
• The link to a Russian legal entity or citizen is removed from Art. 8(10) of Law 149-FZ: any internet resource owner, including foreign persons, must authorise users located in Russia by the subscriber number of a Russian operator. For foreign platforms working for the Russian audience, this ends the previous exemption.
• The new Art. 8(10.1) of Law 149-FZ keeps for Russian owners a menu of four authorisation methods (subscriber number, ESIA, UBS under Arts. 9 and 10 of Law 572-FZ, another information system), and for another system a requirement is added to comply with the information protection rules under Art. 16 of Law 149-FZ. The concept of a Russian legal entity is clarified.
• Virtual PBXs will be able to serve only clients with Russian IP addresses, and hosting providers may provide them capacity only on Russian IPs and must hand over the addresses they hold to the register.
• SMS mailings are proposed to be barred from stating PD of the recipient and their close relatives, and the list of data that telecom operators store for three years is supplemented with the IP addresses and ports of the subscriber used when concluding the contract, with the exact time.
• The GIS "Antifraud" gets the right to store registration and authorisation data on persons involved in unlawful acts, including data obtained unlawfully (new version of Art. 1(5) of Law 41-FZ).
• 19.08.2026: the new version of the package no longer includes the obligation of owners of websites, information systems and apps to keep for three years information on registration, its cancellation and authorisations, the block on transmitting consent to PD processing and its withdrawal via Gosuslugi, and the requirement for internet platforms to verify the accuracy of phone number data of foreigners working on them.

Update On 30.09.2026 the Ministry of Digital Development put the package out for public consultation. The published version brings back a consent platform based on ESIA and Gosuslugi, where citizens can see consents to PD processing, online and offline data, find out who processes their PD, how and why, withdraw consent and report violations to the competent authorities. The obligation is also back for all owners of information resources to keep for three years information on registration, authorisations and termination of users' registration and to provide it to the competent authorities, and foreign owners will have to authorise Russian users only by subscriber number. Sectoral acts are proposed to determine the set of PD and actions for processing based on consent, contract and legitimate interest, and the operator may not require consent beyond the law and such acts (Art. 18(2.1) of Law 152-FZ). The GIS "Antifraud" is planned to hold a database of persons who provide their subscriber numbers and accounts to fraudsters, and SMS mailings will be allowed only for telecom operators. Entry into force is still planned for 01.03.2028.

• The Investigative Committee of Russia has prepared a draft law tightening criminal liability for using information and communication technologies, artificial intelligence, VPN services and proxy servers in committing crimes.
• According to the head of the agency, legislation already regulates the use of software to access blocked resources, but has no universal provision strengthening liability for any use of ICT and AI for criminal purposes and providing a preventive effect.

• According to the First Deputy Head of the Directorate for Combating Cybercrime of the MVD of Russia, the MVD, together with the Ministry of Justice and other interested bodies, is taking part in drafting federal laws amending the Criminal Code and the CAO that tighten liability for offences involving AI.
• It is proposed to supplement a number of articles of the Special Part of the Criminal Code with a qualifying feature of committing the crime using AI, primarily Arts. 128.1 (defamation), 272 (unlawful access to computer information) and 273 (creation, use and dissemination of malware).
• The initiative continues the line of the draft law recognising deepfakes as an aggravating circumstance and the Investigative Committee's draft law (see above), but proposes not a general aggravating circumstance but a qualifying feature of individual offences.

• On 14.10.2026 the State Duma passed the draft law in the second and third readings at once. Financial organisations will be able to hand restricted-access information, including clients' PD and information constituting bank secrecy, to third-party contractors for processing.
• Credit institutions will be able to engage only accredited IT companies and universal-licence banks more than 50% owned by the state, a constituent entity of the Russian Federation, a municipality or a Russian citizen with no other citizenship. The contractor's information systems must be located in Russia.
• A financial organisation notifies the Bank of Russia in advance of engaging a contractor and attaches an operational audit opinion on the contractor from an organisation licensed by FSTEC of Russia and/or the FSB of Russia. Transfer is possible 60 days after notification if the regulator has not prohibited it, and for violations the Bank of Russia may prohibit processing in the contractor's systems for up to six months.
• The contractor undergoes an operational audit every year, reports incidents to the customer within two hours and maintains a staff of IS specialists.
• For privacy: the client's consent to transferring PD to the contractor is not required, but the contract with the contractor must comply with PD legislation, i.e. in effect be drawn up as a processing instruction (Art. 6(3) of Law 152-FZ). The law will enter into force one year after official publication, and existing outsourcing contracts will have to be brought into compliance within 180 days after that.

• On 22.10.2026 the State Duma passed in the first reading a draft law from a group of deputies headed by Andrey Lugovoy, chair of the Committee on Security and Anti-Corruption. The amendments are made to Art. 11 of the Federal Law "On Navigation Activities".
• It is proposed to oblige providers of services in navigation activities to store and process navigation information from vehicles travelling on public roads exclusively in Russia. In the authors' view, data on routes, cargo and passenger flows is of strategic importance, while carriers continue to use foreign services through VPNs and intermediaries.
• The Government of the Russian Federation supported the draft law subject to revision so that the requirement covers all navigation data on vehicles registered in Russia.
• For privacy: vehicle location data linked to a driver or owner is generally PD, and a localisation requirement already applies to it on collection (Art. 18(5) of Law 152-FZ). The draft law introduces sectoral localisation more broadly, covering storage and all processing, including information that is not PD.

• A simplified way of identifying and authenticating passengers is to be tested on domestic Russian routes. The Ministry of Digital Development has prepared a draft for conducting the relevant experiment.
• This concerns the possibility of using biometric personal data for check-in, and also for admitting passengers to the transportation sector of the airport's transport security zone and for boarding a civil aircraft.
• Participants in the experiment will include, in particular, the international airports Pulkovo in St Petersburg and Sheremetyevo in Moscow. Other air carriers and airports may join the experiment voluntarily. Testing will run from 01.06.2026 to 01.12.2027. On its results, proposals will be prepared for developing and scaling the use of passenger identification and authentication technology based on biometrics.

• The Ministry of Digital Development proposed giving mobile operators the right to confirm Russians' biometrics and Gosuslugi accounts in their retail outlets. This follows from the Ministry's draft resolution. Currently an account and data in the Unified Biometric System can be confirmed online in partner banks or in person at an MFC or bank branches.
• The aim of the changes is "to improve the availability of services for individuals based on biometric personal data, develop digital identification infrastructure and create additional service points for individuals within biometric services," the explanatory note says.
• Confirming biometrics and a Gosuslugi account is needed to access broader functionality, the Ministry explained. Without confirmed biometrics one will be able, for example, to pay for purchases at a till or for the metro, but not to open a bank account remotely.

• The Ministry of Digital Development has prepared a draft resolution under which personal data whose depersonalisation consists in preparing statistical indicators from it may be transferred to the GIS for processing depersonalised data without special software and without the SMEV interagency interaction system.
• In such cases the PD operator may use its own software but must inform the Ministry of Digital Development of the "parameters applied" for depersonalisation.
• Grouping of depersonalised PD "by a certain feature" is provided for: depersonalised PD may be tied, for example, to the place of collection, provided that subsequent processing does not allow the data subject to be identified.

⚡Business has objected: in its response, the Big Data Association (ABD - Yandex, VK, Sber, MTS, Rostelecom, VTB, Avito, HeadHunter and others) states that the draft "in effect places on business an obligation" to depersonalise exclusively with its own software, which not all companies have. ABD proposes postponing entry into force of the requirements until 01.03 or 01.09.2027 and draws attention to the risks of re-identification when datasets are enriched with statistical indicators: combining depersonalised data with other data sets increases re-identification risks, and those risks are assessed by the very body that forms the data sets.

• A draft resolution has been published for public consultation that expands the possibilities for using biometric PD held in the Unified Biometric System (UBS) in providing financial and online services and in issuing qualified certificates.
• Biometric PD may be used for: interim and final assessment under higher education programmes (bachelor's, specialist and master's); paying for travel using Moscow information systems; concluding telecom service contracts online; authentication on Gosuslugi, etc.
• Remote identification of individuals for issuing electronic signature verification key certificates has been added to the list of cases, including signatures of a legal entity or sole proprietor.

• The new version of the Rules bans SMS mailings to children's SIM cards. This covers SMS messages for registering and logging in to internet resources as well; the only exception is mailings from state information systems, for example from Gosuslugi.
• The second anti-fraud package gave the Government of the Russian Federation the power to determine rules for providing communication services to minors: a subscriber may notify the operator that a SIM card is being given to a child, after which additional protection is introduced. The draft defines the ways of notification and the set of restrictions.
• The current wording implies a ban on all SMS messages to children, including identification and authentication messages from Russian messengers that comply with legislation.

The document was prepared under Art. 19(5) of Federal Law 152-FZ of 27.07.2006 "On Personal Data" to determine the PD security threats relevant to processing PD in Rosselkhoznadzor's PD information systems operated in carrying out the relevant activities, taking into account the content of the PD and the nature and methods of its processing.

The document applies to state bodies, state institutions and organisations that are CII subjects, as well as other organisations falling under these requirements (for example, under Decree No. 250). Requirements for protecting ordinary PDIS are de facto being raised to the level of significant CII facilities. Operators will have to rebuild processes (especially DevSecOps) and buy specialised security tools (sandboxes, WAF, container scanners).

• The Ministry of Digital Development considers that the current scenario for registering biometric data in the Unified Biometric System (UBS) does not take into account people with congenital or acquired facial features (for example, due to injuries or surgery) and speech impairments (including diction disorders, muteness or the effects of a stroke).
• In this connection it is proposed to set in the order on the procedure for processing biometric personal data requirements for the biometric samples of people with congenital or acquired deformities, developmental anomalies and consequences of facial injuries. It is also proposed to shorten the voice recording time from 30 to 10 seconds. Such samples will get a special mark on biometrics registration.
• In addition, the draft order lets citizens place in the UBS any biometric data, including photographs and voice recordings, or individual types of it. This will be allowed regardless of how the biometrics were collected in the system.

• The Ministry of Justice proposed changing the procedure for medical support of persons in custody or serving prison sentences. The draft order provides for transferring information on prisoners' mental condition to civilian medical institutions after release or a change of preventive measure.
• This concerns patients under dispensary observation because of mental disorders and behavioural disorders related to psychoactive substance use. Medical organisations of the penal enforcement system will have to send the discharge summary and other information on the patient's health to the relevant institutions at the place of residence/stay, building a mechanism of continuity between prison and civilian medicine.
• Transfer deadlines: within 5 working days in case of a change of preventive measure, early release on parole or replacement of the sentence; at the end of the sentence, no less than 30 days before release.

• The Ministry of Digital Development, together with other agencies, presented a draft doctrine defining the priorities, goals, objectives and main directions of countering offences committed using ICT. The technological basis is to be prepared by 2030, when phased introduction of the mechanisms will also begin, and their development is planned until 2035.
• The doctrine provides for reducing the circulation of PD through the development and introduction of fundamentally new approaches to PD processing by operators and to identifying citizens in the digital environment.
• A consent platform is expected to be created on the basis of ESIA, ensuring the issue, storage and withdrawal of all consents to citizens' PD processing, together with the creation of legal conditions to reduce the cases in which operators may process PD on the basis of consent.
• It is planned to work out methods and introduce mechanisms for organisations to identify citizens without receiving their PD in cases determined by the Government of the Russian Federation.
• To ensure the reliability of data in the UBS, it is proposed to develop a mechanism preventing a third party from substituting biometric data during biometric registration and data updates, both in remote channels and in organisations authorised to collect biometrics.

Update According to media reports, implementation of the doctrine is divided into three stages: 2027-2028 (regulatory framework and technology testing), 2029-2030 (creation and introduction of the main mechanisms) and 2031-2035 (development of the system). The GIS "Antifraud", through which threat signals will go straight to banks, telecom operators and state bodies, is named as a key element. The doctrine also introduces the concept of a digital token, i.e. a person's unique fingerprint formed by cryptographic transformation of data fragments from banks, telecom operators and state bodies and containing no PD in clear form. In Alexey Muntyan's assessment, the provision on consents was dropped from the "Antifraud-3" package but the direction has remained in the doctrine (in the 30.09.2026 version of the package the consent platform has returned, see section 4); at the same time, abandoning a single repository does not remove the risk, because the danger comes from the very connectedness of data, the legal status of the token is undefined, and voluntary participation is not specified.

• The draft repeals RKN Order No. 128 of 05.08.2022 in full and approves the list afresh. The draft has no provision on its effective date, unlike Order No. 128, which expressly stated 01.03.2023; by the general rule it is ten days after official publication.
• The structure has changed: instead of two sections (55 states parties to Convention 108 and 34 states that are not parties but comply with its provisions), a single continuous alphabetical list of 88 entries is introduced.
• There is exactly one substantive change: Ukraine has been removed from the list.

Update The order was approved on 16.09.2026 as No. 253, registered by the Ministry of Justice of Russia on 16.10.2026 and published on 19.10.2026 in the wording of the draft, with Ukraine removed from the list (see section 3).

• The draft amends the checklist form from RKN Order No. 253 of 24.12.2021. The checklist has been changed once, by Order No. 1 of 10.01.2023, and since then Law 152-FZ has been rewritten by four laws: 266-FZ, 233-FZ, 23-FZ and 156-FZ. The table currently has 75 rows; after the amendment it will have 77.
• Five questions are added: destruction or depersonalisation of PD once the purposes of processing are achieved (Art. 5(7)); whether consent meets the criteria of specificity, definiteness, informedness, awareness and unambiguity, plus being drawn up separately from other documents and information (Art. 9(1)); the content of consent to dissemination under RKN requirements (Art. 9(9)); disclosure in the processing notification, for each purpose, of the categories of PD, categories of data subjects, legal basis, list of actions and methods of processing (Art. 22(3.1)); depersonalisation in line with RKN requirements and methods (Art. 23(12)).
• Three questions are removed: row 14 on the content of consent to dissemination, row 20(1) on the content of the CBT notification (Art. 12(4)) and row 33 on organisational PD protection measures (Art. 19(1)). Removing row 14 corrects an error: it referred to Art. 10.1(1), which contains no requirements for the content of such consent, and to RKN Order No. 18 of 24.02.2021, valid until 01.09.2027, whereas the new row 10(1) refers to Art. 9(9) and to the requirements of the authorised body generally.
• The checklist loses its only direct question on organisational PD protection measures, even though the operator's obligation under Art. 19(1) of Law 152-FZ remains.

• The Ministry of Defence is expanding the list of information that public authorities and organisations, including private companies, must provide free of charge on request. According to media reports citing the explanatory note, the draft was prepared by the 12th Main Directorate of the Ministry of Defence and relates to the selection of servicemen, candidates for contract service and cadets for certain posts.
• The list covers financial information (income per the 3-NDFL return, bank accounts and deposits, loans and credits, debts above ₽300k, bankruptcy, business activity), information on place of work, registration, vehicles, foreign passports, marriage, road accidents, criminal prosecution, criminal record and wanted status, as well as medical data, including HIV, mental disorders, psychoactive substance use, tuberculosis and viral hepatitis. Also listed separately are membership of public associations pursuing political goals, inclusion in the register of foreign agents and receipt of money or property from foreign sources.
• The information is requested not only about persons liable for military service but also about their family members (spouses, children, parents, siblings and the spouses' relatives).
• From a privacy standpoint: for organisations this is a new mass case of providing PD on request of a state body, including special categories of PD (health data) and PD of persons who have no relationship with the Ministry of Defence themselves. The procedure for verifying the requester's authority and the recording of such PD transfers should be set out in internal regulations in advance.

💡Question: Is the processing of PD by pharmaceutical companies as part of pharmacovigilance lawful, in the cases and in the manner provided for by paras. 382-406 of the Rules of Good Pharmacovigilance Practice of the Eurasian Economic Union of 03.11.2016 No. 87, provided that the requirements of Law 152-FZ "On PD" and Law 61-FZ "On the Circulation of Medicines" are met?

🏛️Roskomnadzor: Processing of PD by pharmaceutical companies in performance of federal laws, by-laws and the EAEU Rules of Good Pharmacovigilance Practice of 03.11.2016 No. 87 falls under the legal basis in Art. 6(1)(2) of Law 152-FZ "On PD" and does not require the data subject's written consent. Where pharmaceutical companies collect, record, process, analyse and store reports of adverse reactions using third parties (call centres, IT system providers), this activity must be formalised in accordance with Art. 6(3) of Law 152-FZ "On PD".

• The authorities reported successful use of Art. 272.1 of the Criminal Code against bot administrators: early in the year the large bot "Eye of God" shut down, and in November Igor Morozkin, owner of the Userbox service, was arrested.
• Liability under Art. 272.1 has begun to be applied not only to bot owners. For example, in March 2025 in the Kirov Region a mobile phone shop employee was detained for passing dozens of records containing personal data via a messenger. That same month in Kirovsk a 20-year-old mobile phone shop employee was charged with passing on the personal data of the singer Shaman (Yaroslav Dronov) and other subscribers. In November, under the same article, a 38-year-old man was detained in Bashkiria for activating thousands of SIM cards using special equipment, and a court placed under house arrest the head of a bailiffs' department in one of the districts of Perm, Nadezhda Shabunina.

An individual entrepreneur applied to court to challenge the refusal of the RKN Office for the Central Federal District to open an administrative case against LLC "WebSiteSoft". The applicant claimed that a review containing his personal data and defamatory statements had been posted on Otzovik.com, administered by LLC "WebSiteSoft". The court found that the full name in the disputed publication was partly masked with symbols (asterisks), which makes it impossible to identify a specific individual. The court also established that the address given in the review belongs to warehouse premises in Moscow, whereas the applicant is registered in Tula, so the address is not his personal data. It was further noted that the applicant had not provided evidence of his connection to the company "Robotop" discussed in the review. LLC "WebSiteSoft" acts as an information intermediary (i.e. it is not a media outlet or a social network with an audience of over 500k per day - see Art. 10.6 of Law 149-FZ) and is not liable for information posted by third parties without knowing it to be unlawful (see Constitutional Court Resolution No. 18-P of 09.07.2013). An intermediary becomes liable only when it learned or should have learned of the violation (received a claim or an RKN request) and did nothing. The court concluded that RKN lawfully refused to open a case because there was no event or elements of an administrative offence under Art. 13.11 of the CAO. The individual entrepreneur's claims were dismissed in full.

Khamovniki District Court of Moscow partly granted the claim of actor Sergey Bezrukov against an individual entrepreneur from Belgorod who sold carnival and fabric masks with the actor's face on the Wildberries and Ozon marketplaces. The court ordered her to remove Mr Bezrukov's personal data (name, surname and image) from the sale listings and awarded ₽200,000 from the entrepreneur as compensation for non-pecuniary harm. "Having found his data in the listings and on the fabric masks, the claimant Bezrukov experienced moral and physical suffering, in particular indignation, outrage and other negative emotions from the unauthorised use of his personal data, including his image, in publicly available sources on the Internet", the court's decision states.

• The Fourth Cassation Court of General Jurisdiction dismissed the appeal of PJSC "Bank Uralsib", which had challenged the recovery of ₽46m in damage caused to a client, the court's press service reports. The credit institution must answer for the actions of a former employee who passed the data of a depositor, a Krasnodar resident, to fraudsters. The criminals then withdrew the funds from the account at a bank office in Moscow using a forged passport.
• The injured depositor asked Uralsib to compensate his losses but was refused, so he sued. The Prikubansky District Court of Krasnodar and the Krasnodar Regional Court sided with the depositor, pointing to gross violations of banking secrecy law by the bank. The courts found that the bank's staff had allowed the client's PD to leak and then acted negligently when paying out a large sum, failing to notice a forged passport. Uralsib was ordered to pay the full deposit of ₽27.5m, interest for unlawful retention of funds, compensation for non-pecuniary harm and a fine, over ₽46m in total.
• The cassation court, having considered the bank's appeal, found no grounds to set the decisions aside. The court stressed that it is the bank, as employer, that bears full responsibility for the actions of its employees, the cassation ruling says.

The number of recorded cases of compromised PD databases in Russia fell to 118 in 2025, with more than 52 million records leaked online. In 2024 the agency recorded 135 database leaks containing over 710 million records on Russians.

📂In July 2025 LLC TD "ASK" suffered a DDoS attack. The attackers extracted and published on Telegram and other resources the personal data of employees (full names, passports, addresses, phone numbers, etc.). The data of 2 employees was affected. The company notified Roskomnadzor of the incident itself, yet the regulator still drew up a report under Art. 13.11(1) of the CAO (fine for legal entities of ₽150,000 to ₽300,000).

🏛Roskomnadzor insisted on a fine, arguing that the rules on replacing a penalty with a warning (Art. 4.1.1 of the CAO) did not apply, since the violation was found not during planned state control but during an administrative investigation.

⚖️The court sided with the company and replaced the fine with a warning:

• SME status: the company is a small enterprise and is on the SME register.
• No actual harm: harm to life, health or property damage to citizens was not proven.
• Good faith: the company admitted guilt, cooperated with the investigation and committed the offence for the first time.

⚠️Important precedent on Art. 3.4(3) and Art. 4.1.1 of the CAO: the court rejected RKN's argument that an administrative warning is possible only for certain types of inspections. The judge held that "state control" must be interpreted broadly. Otherwise the principle of equality before the law would be breached.

📌Takeaway for business: even where the leak is proven, a prompt response (notifying RKN), SME status and the absence of serious consequences give a real chance of avoiding a monetary penalty.

• The Supreme Court has settled the dispute over whether a customer is liable for a leak that occurred on the contractor's side.

📂The case: the Ministry of Labour was fined ₽100k under Art. 13.11(1) of the CAO. The incident dated back to November 2023, when data of Ministry employees and their relatives leaked online.

🛡Defence position: the Ministry tried to prove its innocence, arguing that the leak resulted from a hack of the infrastructure of a contractor that had not ensured proper protection.

📄The court upheld the fine and rejected the Ministry's arguments:

• PD operator status obliges it to take organisational and technical protection measures. Handing processing or infrastructure over to a contractor does not relieve the customer of liability.
• The Ministry did not notify Roskomnadzor of the incident on its own. It confirmed the leak only after a request from the supervisory authority. This was an aggravating circumstance showing inaction.
• The court noted that the case file contains no evidence that the Ministry carried out internal control or an audit of compliance of PD processing with the law (Arts. 18.1, 19, 22.1 of Law 152-FZ).

• The Supreme Court of Russia has found it unlawful to use images of people generated by neural networks in political campaigning. That is, not specific citizens but certain images created by artificial intelligence. The benchmark for practice should be a case from the Chelyabinsk Region, where Communists used leaflets drawn by artificial intelligence during an election campaign. The leaflet showed a happy family.
• The court of first instance then backed the Communists. However, the Second Court of Appeal of General Jurisdiction, on the contrary, agreed with the election commission.
• "Civil legislation contains no concept of a 'natural person'. However, from the provisions of Articles 17, 19 and 21 of the Civil Code of the Russian Federation it can be concluded that this means any person acting as a subject of civil legal relations and endowed with rights and duties, possessing legal capacity and capacity to act", states the appeal ruling of the Judicial Panel for Administrative Cases of the Second Court of Appeal of General Jurisdiction.
• The appeal court also relied on legal positions of the Constitutional Court, which in one of its rulings stated that the special regulation of pre-election campaigning is aimed above all at preventing voters from forming a distorted view of a candidate, and at ensuring equal rights of candidates and protecting the rights and interests of citizens who are not candidates.
• Put simply, an attempt was made to evoke genuine emotions with lifeless pictures. "One of the requirements for AI-generated images of people in the campaign material was to create positive images meant to evoke voters' sympathy (for example, the image of a factory worker should convey strength and reliability, the image of a young entrepreneur - a positive attitude and business sense, the image of a teacher - kindness and professionalism)", the case file says. The Second Court of Appeal found this unlawful. The Supreme Court of Russia agreed with this legal position.

📂The organisation arranged for minors to study in the United Kingdom. In June 2025, in performance of a contract, the operator sent the personal data of 9 children to the receiving party (a British training centre).

• A prosecutor's inspection established that the operator had not sent RKN a notification of its intention to carry out cross-border transfer before starting such activity, as required by Art. 12(3)-(4) of Law 152-FZ "On Personal Data".

👨‍⚖️The Arbitrazh Court of the Republic of Bashkortostan (decision of 08.09.2025 in case No. A07-27941/2025) found the director guilty of an administrative offence under Art. 13.11(10) of the CAO. However, taking into account that it was a first offence and there were no aggravating circumstances, the court applied Art. 4.1.1 of the CAO and replaced the administrative fine with a warning.

🔎The problem of legal classification: the director was charged under Art. 13.11(10) of the CAO ("Failure to perform the duty ... to notify the authorised body ... of the intention to process personal data"). From a legal standpoint, however, there is a conflict here:

• Failure to file a notification of cross-border transfer (Art. 12 of Law 152-FZ), which the law separates from the notification of the start of processing (Art. 22 of Law 152-FZ).
• Formally, failure to provide information to a state body falls under Art. 19.7 of the CAO. The sanctions under that article are much lower and the limitation period shorter.

⚠️Nevertheless, practice is moving towards an expansive interpretation: supervisory bodies equate a breach of the cross-border transfer notification procedure with a breach of the general procedure for notifying of processing, applying the stricter Art. 13.11 of the CAO.

• The Moscow Arbitrazh Court fined the Portuguese games and apps developer Bad Kitty`s Dad ₽6m for repeated violation of Russian law on localisation of databases with personal data of Russian citizens. The report was drawn up in August 2025 by the RKN Office for the Central Federal District.
• The case concerns the online service Ome.TV (a video chat with random interlocutors), which requires users to provide an e-mail address, name, age, photo and information from social network profiles when registering. In breach of the law, the database of collected data is stored in the territory of the European Union (EU).

🧑‍⚖️The Ninth Arbitrazh Court of Appeal set aside the fine imposed on JSC Russian Railways (RZD) for a leak of 17m rows of data.

📂The case: Roskomnadzor found in Telegram channels (including pro-Ukrainian hacker groups) a database of RZD employees - over 17m rows (full names, positions, e-mails). The court of first instance fined the company ₽150k under Art. 13.11(1) of the CAO, considering that the operator had not ensured data protection.

🛡Defence line: RZD disagreed with the fine. Its key argument: the leak resulted not from negligence but from a targeted cyberattack. The company applied to the Ministry of Internal Affairs and the FSB, which led to a criminal case under Art. 272.1(1) of the Criminal Code (unlawful use and/or transfer, collection and/or storage of computer information containing personal data).

🏛Key finding of the court: the appeal broke the regulator's usual logic by relying on Art. 2.1(2) of the CAO (the concept of a legal entity's guilt).

1. 1The leak itself ≠ the company's guilt. The court held that administrative liability arises only where there is fault. A company cannot be fined merely because an incident occurred (strict liability). RKN must prove which measures the company could have taken but did not.
2. 2The subjective side of the offence. The court stressed: there is no evidence in the case that RZD was inactive. On the contrary, third parties (hackers) obtained access to the data through a crime (Art. 272.1 of the Criminal Code). If the company's will was directed at protection and the harm was caused by criminals, the operator is not at fault in the administrative sense.
3. 3Presumption of innocence. The court called RKN's conclusion that RZD alone was at fault premature while the criminal investigation into the hack was not complete.

🌍Context matters: the court formally took into account the tense geopolitical situation around Russia and the rise of hacker attacks from unfriendly states as a matter of common knowledge that reduces the degree of fault of the attacked business.

The justice of the peace of Court Division No. 422 of the Tagansky District of Moscow found the US online collaboration platform Realtimeboard Inc. dba Miro and the Ukrainian domain registration company NIC. UA LLC guilty of violating the requirements to localise databases with personal data of Russians (Art. 18(5) of Law 152-FZ).

• "Realtimeboard Inc. dba Miro was given an administrative fine of ₽2m, NIC. UA LLC - ₽6m", the court said.
• The US company was found guilty of violating the requirement to localise Russian users' data in Russia (Art. 13.11(8) of the CAO). The Ukrainian organisation was found guilty of a repeat violation of that requirement (Art. 13.11(9) of the CAO).

• A user sued LLC "KEH eCommerce" (Avito) over the blocking of an account he had used without problems for 10 years. The platform closed access over "suspicious activity" and demanded a check: recording a video with a head turn, and later added a demand for a photo of a passport or driving licence. The user flatly refused to disclose his biometric data.

⚖️The court ordered Avito to restore access to the profile without providing a video image or photos of personal documents.

• The court's main argument rested on Art. 13(13) of Law 572-FZ: an individual's refusal of biometric identification cannot be grounds for refusing him services.
• The court also referred to Law 152-FZ "On Personal Data", recalling that consent to processing must be freely given and the data collected must not be excessive in relation to the purposes of processing.

📌Key insights from the case:

1. 1The case was heard on a consumer protection claim. This confirms that Avito has the status of an "aggregator owner", to which the strict requirements of the Consumer Protection Law fully apply, not just internal user agreements.
2. 2The court did not mention the specific Art. 11 of Law 152-FZ (which is the one regulating biometrics), yet Law 572-FZ on the unified biometric system became an important argument for the court.
3. 3Courts may interpret a "trustworthiness check" as a procedure for establishing identity. Particularly when it is repeated because of doubts about the results of earlier (including non-biometric) checks.
4. 4The matter is not closed - 2 appeals have already been filed against this decision.

📂LLC "Degustatorstroy" challenged in court a demand of Interdistrict Inspectorate of the Federal Tax Service No. 2 for the Volgograd Region to pay late-payment interest of ₽926k. The taxpayer pointed to the absence of a calculation of the disputed interest in the case file. The tax authority, instead of simply disclosing the formula, took an uncompromising stance. The inspectorate's representative stated that the Tax Code does not provide for any obligation to provide a calculation of interest amounts at all.

👨‍⚖️The appeal court recalled that any charges are subject to verification and making them comprehensible is a direct duty of the tax authority. The court formulated a number of precedent-setting theses on the use of automated systems, including AI:

1. 1Using AI to calculate charges is not a ground to presume the calculations correct and does not relieve the tax authority of responsibility for the result.
2. 2The court acknowledges that the introduction of AI is an accomplished and irreversible fact, but holds that its use cannot be a reason to lower guarantees for citizens or worsen their position in any way.
3. 3Any charges that cannot be understood, verified and assessed by the court are unlawful a priori.
4. 4There are neither legal nor factual grounds for a presumption that calculations made with software are correct.
5. 5AI is not a subject but a tool, which cannot displace a human and must be used under the control of a responsible person.
6. 6Introducing AI into the work of tax authorities and omitting interest amounts from their acts does not relieve the tax authority of the procedural duty to prove that the charges are correct.

🔖In the end, at the court's demand, the FTS did manage to export and provide a clear calculation. And it turned out to be mathematically correct. However, the conceptual dispute is not closed. The company did not accept the decision, and a cassation court hearing is set for 17.03.2026.

• On 3 March 2026 the justice of the peace of Court Division No. 422 of the Tagansky District of Moscow found Battlestate Games Limited guilty of an administrative offence under Art. 13.11(8) of the CAO (failure by an operator, when collecting personal data, to perform the duty under Russian law to ensure the recording, systematisation, accumulation, storage and updating of personal data of Russian citizens) and imposed an administrative fine of ₽2m.
• Battlestate Games Limited is a Russian independent company, a developer and publisher of computer games. Its legal entity is registered in London and its office is in Saint Petersburg. The company develops software for computer games, creates and updates it, supports the software, and does graphic and website design. The company created the game Escape from Tarkov - a first-person stealth shooter in a post-USSR visual style.

• A court in Ufa sided with a passenger of a Russian air carrier who began receiving advertising mailings without consent.
• The woman received advertising from a Russian airline by e-mail and concluded that her personal data had been processed without free and voluntary consent. She therefore brought a consumer protection claim, since "by these actions the defendant intruded into her private space".
• The airline's response to the claim states that the claimant, as a customer, had given consent to receive messages at her e-mail when making the booking, and can opt out of mailings at any time. However, the court established that the claimant had not freely consented to the processing of her personal data either for booking (purchasing) tickets or for sending advertising over telecommunications networks.
• As a result, the airline was ordered to pay the claimant ₽5,000 in compensation for non-pecuniary harm and ₽6,000 in legal costs. The company was also fined ₽2,500 for failing to satisfy the consumer's demand voluntarily, and a state duty of ₽3,000 was recovered for the budget.

• In view of the measures taken by Roskomnadzor to restrict access to the social platforms Instagram and Facebook, the video hosting service YouTube, VPN services, and the messengers Telegram and WhatsApp, FAS Russia sees in placing advertising on these resources signs of a violation of Art. 5(10.7) of the Federal Law "On Advertising".
• Under Art. 38 of that law, both the advertiser and the advertising distributor are liable for violating this provision of the Federal Law "On Advertising".

• The justice of the peace of Court Division No. 422 of the Tagansky District of Moscow found the German company SSI International GmbH guilty of violating Russian personal data law and imposed an administrative fine of ₽6m. The court reported this.
• The company was found guilty under Art. 13.11(9) of the CAO (repeat violation of the requirement to localise Russian users' data in Russia).
• SSI International GmbH is an international organisation specialising in diving, freediving, swimming and snorkelling instruction.

🧑‍⚖️The Arbitrazh Court of the City of Saint Petersburg and the Leningrad Region heard a case on a personal data leak caused by a hacker attack. The decision shows how courts of first instance approach the assessment of operators' fault and is of interest for comparison with the recent Russian Railways precedent.

📂In autumn 2025 the company suffered a cyberattack, as a result of which the database of the company's internet resource - 70,000 data subjects (representatives and employees of legal entities) - ended up in the public domain (in a Telegram channel). The data comprised full name, position, work e-mail address and work phone number. The company promptly sent RKN initial and follow-up notifications of the incident.

🏛At the hearing the operator moved to suspend the proceedings, citing a law enforcement inspection file (KUSP crime report register No. 18075 of 15.08.2025). The court rejected the motion, finding no grounds why the administrative case could not be heard. The court found the company guilty under Art. 13.11(13) of the CAO. However, since it was a first offence, the court applied Art. 4.1.1 of the CAO and replaced the administrative fine with a warning.

📌Key takeaways:

1. 1Even with proven guilt and a large volume of compromised data (70k data subjects), replacing a fine with a warning (Art. 4.1.1 of the CAO) works effectively for a first offence.
2. 2Simply filing a police report (pre-investigation check) and obtaining an extract from the KUSP does not carry the same legal weight in a court defence as a decision to open a criminal case, which helped Russian Railways.
3. 3Despite the positive appeal precedent in the Russian Railways case, courts of first instance continue to apply strict liability, requiring the operator to prove that it took all possible protection measures.

🧑‍⚖️On 05.03.2026 the Sixth Cassation Court of General Jurisdiction heard a labour dispute in case No. 88-3939/2026 and upheld the lawfulness of punishing an employee for the very fact of creating an information security threat (keeping passwords in plain view), even though no adverse consequences (hack, leak) occurred.

📂An employee of PJSC ANK Bashneft was subjected to disciplinary action in the form of a reprimand. The basis was a fact identified by the security service: the employee kept passwords for corporate information resources (including the electronic document management system and SPARK-Interfax) in an open text file on the desktop of his computer.

🛡The employee tried to challenge the employer's order, citing the following circumstances:

1. 1The office has a strict access control regime, and only three people have access to it.
2. 2Login to the work computer itself is protected by two-factor authentication.
3. 3No leak of confidential information occurred and passwords were not passed to third parties.
4. 4The employer had not informed him of a specialised secure password storage program.

🏛️The courts of all instances found the employer's actions lawful and dismissed the employee's claim:

1. 1The company's internal regulations, including the Internal Labour Rules and IS policies, expressly prohibit saving passwords in clear form, including as text on the desktop.
2. 2The employee had been familiarised with the job description and the requirements of the internal regulations against signature.
3. 3The fact that the employer did not offer a storage program does not excuse the employee: if he had difficulty remembering passwords, he should have asked the employer himself for information on legitimate secure ways to store them.
4. 4The absence of an actual data leak or unauthorised access does not negate the disciplinary offence (breach of security rules).

• The Belokurikha Inter-District Investigation Department of the Investigative Directorate of the Investigative Committee of the Russian Federation for the Altai Territory has completed the investigation of a criminal case against a 52-year-old resident of the Soloneshensky District, accused of an offence under Art. 30(3) and Art. 137(1) of the Criminal Code (attempted unlawful collection of information about a person's private life constituting his personal secret, without his consent).
• According to the investigation, the accused had for a long time felt personal hostility towards a work colleague, believing that he performed his duties improperly and spent much time on personal affairs. To prove to management the colleague's dishonesty, in October 2025 she secretly entered his office and placed a switched-on voice recorder on top of a cabinet. She failed to carry out her intent to collect information on private life for reasons beyond her control - the recorder was found by an employee of the organisation.

• Under Art. 5(10.7) of the Federal Law "On Advertising", advertising may not be distributed on information resources access to which is restricted under Russian law. The information sent by Roskomnadzor is under review at FAS.
• Regarding advertising on Telegram and Youtube, FAS analyses the content of the advertising, the date of the contract, the date restrictions on the platform were introduced, the date the advertising was published, and the grounds for placing it, including contracts and payment orders.
• Clearly, businesses need time to adapt to the new rules and switch to other advertising channels. A transitional period until the end of 2026 is therefore needed for advertising on Telegram and Youtube, during which no liability measures will be applied for distributing advertising on such resources.
• At the same time, oversight of compliance with advertising law for advertising on platforms restricted earlier (Instagram*, Facebook**) and on VPN services will continue, with appropriate liability measures. Placing advertising on such resources is not permitted.

• The justice of the peace of Court Division No. 422 of the Tagansky District of Moscow held the petition platform Change.org Pbc administratively liable under Art. 13.11(8) of the CAO (failure by an operator, when collecting personal data, to ensure their accumulation, storage and updating using Russian databases). The platform was fined ₽1m.
• The court also fined for breach of the personal data law the developer of a scuba diving app, Padi Americas Inc. (an organisation designated undesirable in Russia), imposing a fine of ₽6m. The first administrative fine was imposed on Padi Americas Inc. on 11 July 2023. The judge fined the company ₽1.5m under Art. 13.11(8) of the CAO.

• On 26 March 2026 the justice of the peace of Court Division No. 422 of the Tagansky District of Moscow found the language-learning platform "Duolingo, Inc." guilty of an administrative offence under Art. 13.11(8) of the CAO. An administrative fine of ₽2m was imposed.
• Under a similar article, eNom LLC., which handles domain name registration and web hosting, was also fined ₽2m, the court said.

• A resource-supplying company applied to an inter-municipal department of the Ministry of Internal Affairs with a request for personal data of residents of a number of buildings in the Orenburg Region, including full name, date and place of birth, and passport details. In the organisation's view, this information was needed to correctly calculate utility charges. The department refused, saying that transferring such information is impossible without citizens' consent and contradicts the Law "On the Police".
• The court of first instance backed the Ministry's position, noting that the required information could be obtained from other sources, for example through the housing and utilities GIS or the Unified State Register of Real Estate (EGRN). The appeal and cassation courts, however, took the opposite position, finding that the company may request and process personal data without citizens' consent.
• Representatives of the Ministry disagreed with this approach and applied to the Supreme Court of Russia, arguing that granting the claims in this case would lead to an unjustified expansion of the powers of the company as a resource-supplying organisation that are not provided for by housing legislation, namely access to the police's operational resources.
• The Judicial Panel for Economic Disputes, having considered the cassation appeal, found the applicant's arguments worthy of attention and upheld the court of first instance's decision refusing the company the residents' personal data.

• On 11.03.2026 the Ryazan Regional Court set aside the first-instance decision that obliged Avito to restore a user's access to his profile without a video check and photos of documents (case No. 33-342/2026).
• To recall: in December 2025 the Moskovsky District Court of Ryazan sided with the user, citing Art. 13(13) of Law 572-FZ and the provisions of Law 152-FZ on PD.

⚖️The appeal panel reached the opposite conclusions:

1. 1A video trustworthiness check (liveness check) is not processing of biometric PD, as it is not used to establish the user's identity. Its purpose is to confirm that the account is controlled by a live person.
2. 2The defendant does not store users' video images, which technically rules out biometric identification.
3. 3The absence of biometric data processing was directly confirmed by the Ministry of Digital Development, Roskomnadzor and the defendant's partner, PJSC MTS.
4. 4Law 572-FZ does not apply to Avito checks - it regulates identification through the state UBS. Its inapplicability was confirmed by the Ministry of Digital Development's opinion.
5. 5The user himself violated Avito's rules (used two profiles in one category), which gave the platform grounds to run a check under section 7 of the Terms of Use.
6. 6The priority of freedom of contract (Art. 421 of the Civil Code) was confirmed: the Terms accepted at registration bind the user, and exempting a violator from the check would mean individual privileges.

🖤The claimant died on 24.01.2026. The panel considered the appeals on the merits, guided by Supreme Court clarifications.

🤔The appeal position is not beyond dispute:

🔻The argument that a video check is not biometric collection because the platform "does not establish identity" relies largely on the platform's own declarations - how the classifieds service processes and stores the video recording was not examined.

🔻The lack of alternative verification methods (login via Gosuslugi, confirmation by e-mail/phone) creates a situation in which the user is in effect deprived of choice.

🏛️Roskomnadzor, which used its own monitoring system (AS MPD), insisted that DLBI acts as an intermediary giving users access to illegal databases (including from the Darknet) without a legal basis (Art. 13.11(1) of the CAO). The agency relied on the results of its own monitoring, which recorded a leak search function.

🛡️DLBI pointed to the error of conflating two different processes: processing of website visitors' data (where DLBI is a lawful operator) and the work of the search algorithm: DLBI does not store or process PD in the open form (phone numbers or e-mails). Instead it uses hashes (encrypted fingerprints), which do not allow the original information to be restored. In addition, the checking function itself is provided not directly via the website but through partners (for example, the "Zashchitnik" system from MTS).

👨‍⚖️The Moscow Arbitrazh Court, in its decision of 10.12.2025 in case A40-201075/25, rejected Roskomnadzor's claim and stated that:

• The service processes not PD but all data in which it looks for signs of users' PD, and Roskomnadzor failed to prove that the information analysed by the service constitutes "personal data" protected by law.
• DLBI's activity complies with global practice and is aimed at warning of leaks, whereas RKN's system is focused on checking operators' formal compliance with the law.

📄The Ninth Arbitrazh Court of Appeal upheld the decision of the Moscow Arbitrazh Court of 10.12.2025 and dismissed Roskomnadzor's appeal.

🏛️The Arbitrazh Court of the Kemerovo Region (case No. A27-23786/2025) held the telecom operator LLC "Comline" liable under Art. 13.11(12) of the CAO. In June 2025 an attack by the BO_Team_UA group compromised the data of 4,225 subscribers (full names, passport details, addresses, phone numbers), which was published on a Telegram channel on 29.07.2025.

🧨The case features a BI.ZONE report commissioned by "Orion Telecom" itself as part of an internal investigation and sent by the operator to Roskomnadzor as part of the notification on the results of the investigation. The document recorded systemic information security failures:

• an active account of an employee dismissed in 2022;
• passwords not changed since 2019;
• software with critical vulnerabilities;
• access to the infrastructure was obtained on 30.05.2025, but the leak was discovered only on 12.06.2025.

⚙️Key findings of the court:

1. 1Opening a criminal case under Art. 272.1 of the Criminal Code against the hackers does not release the operator from administrative liability - the provisions delimit the liability of the offender and of the operator.
2. 2Belonging to critical information infrastructure (CII) category 3 gives no right to a leak - no regulatory act contains such a relaxation.
3. 3The court treated the references to delay of the proceedings (motions for an expert examination after 5 months) as abuse of rights.
4. 4Despite a sanction of ₽3-5m, the fine was replaced with a warning under Art. 4.1.1 of the CAO - the operator is an SME and the offence was a first.

💡Practice on PD leaks has not yet settled: in the Russian Railways case the criminal case against the hackers served as a shield, in the "Comline" and "PKR Analytics" cases it did not. The decisive factors are the quality of evidence of the operator's fault, the state of IS systems and SME status.

• The deputy head of the administration of the Abinsky District in the Krasnodar Territory was fined ₽100k under Art. 13.11(8) of the CAO for violating the requirements to localise databases of personal data of Russian citizens.
• The administration of the Abinsky District is the PD operator of an internet resource whose page source code uses a platform owned by a foreign company from the USA.
• The person held liable was specifically the supervisor of the area - the deputy head of the district administration (as an official). The case clearly shows the broadening practice of personal liability of officials of operators for localisation violations, including in respect of using foreign analytics and other tools in website source code.

⚖️A series of cases on the cyberattack by the BO Team group on a Siberian provider (June 2025, leak of subscribers' PD). For all legal entities of the group the courts imposed warnings instead of multi-million fines:

• Irkutsk Region Arbitrazh Court (case No. A19-25808/2025, LLC "Orion Telecom", Art. 13.11(13) of the CAO, 36,544 data subjects). Reasoning (decision of 12.05.2026): the date of the offence = the date the database was published (29.07.2025), not the date of the intrusion; victim status in the criminal case (Arts. 272, 273, 272.1 of the Criminal Code) does not release from administrative liability; expert examination of the degree of fault refused (a question of law); the BI.ZONE report worked against the operator (active account of an employee dismissed in 2022, root password vulnerable to a dictionary attack, intrusion on 30.05.2025 - discovery only on 12.06.2025). Fine replaced with a warning under Art. 4.1.1 of the CAO - SME status and first offence.
• Krasnoyarsk Territory Arbitrazh Court (15.05.2026, six cases: LLC "Orion Telecom", "KrisTelecom", "45 KA") - closed hearings, all companies found guilty, penalty "other" (warning). The company's press release on being "found not guilty of disseminating PD" substitutes concepts: the subject was failure to ensure security leading to a leak, not intentional dissemination.
• Khakassia Arbitrazh Court (21.05.2026, case No. A74-10378/2025) - reclassification from Art. 13.11(13) to Art. 13.11(1) of the CAO and a warning. The Third Arbitrazh Court of Appeal rejected an attempt to transfer the case to a justice of the peace (Law 508-FZ): a case accepted in compliance with jurisdiction is heard on the merits by the arbitrazh court whatever the legislative changes.
• Earlier - Kemerovo Region Arbitrazh Court (LLC "Comline", Art. 13.11(12), warning).

📌Interim result: the aggregate sanction range for the group is tens of millions of roubles, in practice - ₽0. Enforcement of turnover-based fines for PD leaks remains nominal, but the protective effect of SME status is one-off - on a repeat offence, replacement with a warning is no longer possible.

🔄By resolution of the Fourth Arbitrazh Court of Appeal of 11.08.2026, the appeal of LLC "Orion Telecom" was rejected and the decision of the Irkutsk Region Arbitrazh Court was left unchanged. The argument on the operation of the law in time was rejected: the offence is a material one, completed on dissemination of PD on 29.07.2025, and intrusion into the infrastructure was merely preparatory; other regions' courts reclassifying the group's cases to Art. 13.11(1) of the CAO are not binding on the court. The return of Art. 13.11 cases to courts of general jurisdiction from 01.01.2026 does not change jurisdiction, as RKN's application was accepted on 27.10.2025 (Art. 39(1) of the Arbitrazh Procedure Code).

• Key point: RKN stated that the sanction of Art. 13.11(13) of the CAO does not provide for a warning at all, and asked to replace it with a ₽5-10m fine. The appeal court agreed in substance (a leak of PD of 36,544 data subjects in itself materially violates citizens' rights, the conditions of Arts. 3.4 and 4.1.1 of the CAO are not all met, micro-enterprise status does not justify replacement - para. 33 of Supreme Court Review No. 3 (2025)), but could not change the penalty: the one-year limitation period expired on 29.07.2026 during the appeal proceedings.

🎮Since the start of 2026 Roskomnadzor has filed at least 7 claims against foreign gaming companies for refusing to store Russian players' personal data on servers in Russia. Those involved include the publishers of Sims, Battlefield, GTA and Red Dead Redemption.

⚖️In April the court found Electronic Arts, Take-Two Interactive, Battlestate Games and NetEase guilty - each was fined ₽2m under Art. 13.11(8) of the CAO. Hearings in three cases - Epic Games, Digital Extremes and Embracer Group - are set for the first half of May.

⚙️Under Art. 18(5) of Law 152-FZ, data (IP, e-mail, payment details) collected when a user from Russia registers must be stored and updated exclusively in Russia.

⚠️The main risk is not fines but blocking: foreign companies generally do not pay fines, and RKN's next step is a demand to remedy the violation and blocking of domains. There is already a precedent: this is exactly what happened with Roblox.

⚡At the same time, RKN clarified that blocking of Battlefield, FIFA and other popular foreign video games is not currently planned.

• The Dutch Data Protection Authority (AP), together with its Norwegian and Finnish counterparts, imposed a €100m fine on MLU BV, the Dutch legal entity of the Yandex group that operates the Yango taxi-ordering app in Europe.
• According to the regulator, MLU BV transferred personal data of Yango users from Norway and Finland to Russia without proper security measures. The transferred data included scans of driving licences, home addresses, exact trip routes, chat content, social security numbers and other sensitive information of drivers and customers.
• The investigation had been running since late 2023. The regulator stated that in Russia personal data is not as well protected as in the EU and there is no independent PD protection authority, which creates a risk of access by Russian authorities to EU citizens' data.
• The fine was calculated on the basis of the parent group's annual turnover - in 2024 Yandex's revenue exceeded €12bn. Besides the fine, MLU was ordered to stop transferring European users' data to Russia immediately.
• MLU BV intends to appeal the decision, stating that it observed all necessary protection measures and stored data on EU servers in encrypted form. The company also noted that Yango has not operated in Norway and Finland since 2025.

🧑‍⚖️The Moscow District Arbitrazh Court (resolution of 09.06.2026 in case No. A40-263206/2025) left unchanged the resolution of the Ninth Arbitrazh Court of Appeal of 16.02.2026, which had set aside the fine on JSC RZD under Art. 13.11(1) of the CAO. Roskomnadzor's cassation appeal was dismissed.

📂Earlier, after a database of RZD employees (17m+ rows) was found on Telegram, the company was fined by the first instance; the appeal set the fine aside, noting that the leak was the result of a targeted cyberattack (criminal case under Art. 272.1(1) of the Criminal Code) and RKN had not proved which specific protection measures the operator could have taken but did not.

⚙️From the cassation reasoning (10.06.2026): (1) the subjective side is absent - fault, not the event, was not proven, and the elements of an offence under Art. 13.11 of the CAO are missing; (2) dissemination of PD is a consequence of a hacker attack, no culpable actions by employees were identified; (3) the attack itself does not prove that measures were insufficient; (4) irremovable doubts are resolved in favour of the person (Art. 1.5(4) of the CAO), so the case is discontinued.

⭐The position against strict liability for leaks held up in three instances - it is a stable legal position. Contrast with the Orion group cases, where fault was documented by the company's own BI.ZONE report. RKN still has the theoretical possibility of appealing to the Supreme Court.

• The justice of the peace of Court Division No. 422 of the Tagansky District of Moscow and arbitrazh courts continue to fine foreign companies under Art. 13.11 of the CAO for breaching the requirement to localise PD of Russian citizens (Art. 18(5) of Law 152-FZ):
• "AIDA International" and "International Training" - ₽6m each under Art. 13.11(9) of the CAO (repeat violation);
• Embracer Group AB (Swedish gaming holding, owner of rights to The Lord of the Rings, Tomb Raider, Metro and others) - ₽1m under Art. 13.11(8) (continuation of the "gaming" block together with EA, Take-Two, NetEase, Battlestate Games);
• Italki HK Limited (Hong Kong, language-learning platform) - ₽1m under Art. 13.11(8); the data of Russians (name, e-mail, phone, address, payment information, IP, cookies) was stored on servers in the USA;
• Pro New World (Hong Kong) Limited (operator of the Poizon marketplace / "DEWU", site thepoizon.ru) - ₽1m under Art. 13.11(8).

📊Practice confirms: defendants generally do not appear at hearings and do not reply to RKN requests; the regulator's next step is a demand to remedy the violation and potential blocking.

• Russian courts increasingly fine banks and MFOs for messaging clients via WhatsApp. Since March 2025 at least 21 cases have been registered under Art. 13.11.2 of the CAO (unlawful use of foreign information systems in processing PD).
• The trigger is messages about debts: in WhatsApp correspondence, financial organisations stated details of debts, clients' full names and other identifying data. The administrative reports are drawn up by Roskomnadzor.
• Fine amounts in published decisions range from ₽100k to ₽200k, while the article provides for up to ₽700k for legal entities.

⚖️Case No. A07-5689/2025 (No. 309-ES26-2103), JSC "Melon Fashion Group" v. Bashkortostan regional FAS office. Through a "Wheel of Fortune" on sela.ru a visitor could win a discount by entering an e-mail address and ticking a consent box, without which the wheel would not spin. The FAS office and three court instances saw forced consent and a breach of Art. 18(1) of Law 38-FZ "On Advertising".

• The Supreme Court's Judicial Panel for Economic Disputes set aside all four acts: consent to advertising in exchange for a discount is not prohibited by law and serves the interests of both parties; the seller is not obliged to give a discount to someone who has not met the condition, because this is a targeted offer, not a public offer, and the goods remain available at the usual price; there is no coercion, so Arts. 178 and 179 of the Civil Code do not apply.
• The court took into account that the consent wording was on the same banner, stood out on a separate line and was not hidden in the text of the privacy policy and the consent to PD processing, that the user took an active step before the advertising was sent and could unsubscribe from the first e-mail.
• One tick box covered both PD processing and the subscription to the advertising mailing, and this construction was held correct. Art. 18 of Law 38-FZ and Art. 15 of Law 152-FZ are parallel in design: both require prior consent, proceed from the presumption that it is absent until the operator proves otherwise, and oblige the operator to stop communications immediately on request.

• From December 2024 to August 2025 an inspector of the traffic police unit for enforcement of administrative legislation photographed vehicle registration cards from an official information database and passed the images to an acquaintance for payment. The data of more than 350 people was sold, earning ₽220k.
• The Chkalovsky District Court heard the case in special procedure under a pre-trial agreement and found her guilty of dissemination of PD (Art. 272.1(3)(a), (c), (d) of the Criminal Code), taking a bribe (Art. 290(5)(c) of the Criminal Code) and exceeding official powers (Art. 286(3)(f) of the Criminal Code).
• She was sentenced to 4 years' imprisonment in a general-regime penal colony, a fine of ₽250k, deprivation of her special rank and a 2-year ban on working in state bodies. The sentence has not entered into legal force.

• In January-June 2026, 54 databases with 2026 relevance, totalling 24.3m rows, were found in open access. In the same period of 2025 four times as many databases were identified, and their volume was 22 times larger.
• At the same time, activity on shadow resources is growing: the number of messages about the distribution of databases on specialised forums and in shadow channels rose from 23.8k to 38.1k, i.e. by almost 60%.
• According to another cyber intelligence team, 88 new cases of leak publication were found in the first half-year against 162 a year earlier, with a total volume of new publications of 114m rows, 43% less. What ended up in the public domain was mainly full names, residential addresses, passwords, dates of birth, passport details, mobile phone numbers and e-mail addresses.

• On 20.07.2026 the Savyolovsky Court began a fresh hearing on the merits of the case of former vice presidents of JSC Sirena-Travel, developer of the Leonardo booking system. According to the investigation, in autumn 2023 they failed to ensure the protection of computer information, as a result of which hackers gained access to passengers' PD; the classification changed from Art. 274.1(5) to Art. 274(2) of the Criminal Code.
• The company itself, not the passengers, was recognised as the victim. The defendants paid it ₽1.5m and concluded a settlement, and in October 2025 the first trial ended with the case discontinued on reconciliation of the parties. The prosecutor's office insisted that compensation to the operator and apologies neither reduce the public danger nor redress harm to society and the state, and in April 2026 the Second Cassation Court sent the case back for retrial.
• The defence relies on the unproven fact of the leak of passengers' PD itself, on those data not relating to CII subjects and on the server being located in Moscow. The case is telling for the dispute over who the injured party is: material harm was calculated for the company, while the data subjects do not in practice take part.

• The sales director of a Moscow engineering company was dismissed for disclosing a trade secret and sued to have the order cancelled, agreeing to termination by mutual consent with a payment of ₽5m.
• The employer stated that the employee forwarded work documents by corporate e-mail, putting her personal address in blind copy, and uploaded a number of documents from an internal protected resource to the DeepSeek neural network, which created a risk of the information being intercepted.
• The court saw no business need to extract information from the employer's local protected media, send it to an external uncontrolled e-mail address and place it on a third-party service's resource, found this a gross breach of job duties and dismissed the claim.

• The Oktyabrsky District Court of Rostov-on-Don sentenced a local resident with a previous conviction who, through a special Telegram bot, searched for and passed to third parties, for payment, information about citizens, including servicemen.
• He was sentenced to 1 year's imprisonment in a strict-regime penal colony and a fine of ₽100k. The sentence has not entered into legal force. The case was reported by the press service of the FSB Directorate for the Rostov Region.

• In the first six months of 2026, 504 violations were identified, of which 490 under Art. 13.11 of the CAO and 14 under Art. 13.11.2 of the CAO; no violations were identified under Art. 13.11.3 of the CAO (biometrics). Under Art. 13.11 of the CAO, 430 violations were recorded in 2023, 618 in 2024 and 705 in 2025.
• Inspections have practically disappeared from supervisory practice. One unscheduled inspection was carried out in the half-year, whereas in 2021 there were 595 scheduled and 14 unscheduled. Preventive visits became the main format: 728 were carried out, resulting in 89 orders to remedy.
• RKN recorded 12 PD leaks in the first half of 2026, against 118 for the whole of 2025 and 100 for 2024.

• By sentence of 08.09.2026 in case No. 1-81/2026, the Pribaikalsky District Court of the Republic of Buryatia fined a senior traffic police inspector ₽100k, banned her for two years from holding state service posts involving access to legally protected secrets, and ordered her phone confiscated.
• At the request of her mother, who was looking for the owner of a car by registration number, the inspector logged into the FIS GIBDD-M information system under her own account and dictated the full name and age of the owner and of the driver permitted to drive, as well as the driver's phone number. Access was found unlawful because the request was unrelated to her official duties, and oral transfer by phone was classified as unlawful provision of computer information containing PD.
• The qualifying feature was use of official position; no mercenary motive was alleged, and the court found no grounds to deem the act of minor significance. The exception in Art. 272.1 of the Criminal Code for processing PD solely for personal and family needs was not separately analysed in the sentence, so no universal conclusion can be drawn about its limits.
• By comparison, on 06.03.2026 the Khasavyurt City Court in case No. 1-72/2026 reclassified the sale of passport scans from Art. 272.1 to Art. 137 of the Criminal Code, since clients had voluntarily handed over the documents for photocopying, while on 25.03.2026 the Lomonosovsky District Court of Arkhangelsk in case No. 1-193/2026 applied the use of official position to a sales assistant at a mobile phone shop of an operator's dealer.
• For PD operators this is a reason to check the purposes of queries to the PDIS, identify access with no work task, and go through with employees the consequences of passing PD on at the request of acquaintances and relatives.

• Answering a question on the Onlineinspektsiya.RF portal, Rostrud said that such actions by an employer are unlawful under labour law, and recommended contacting RKN for clarification on the breach of PD legislation.
• Wages are paid to the credit institution named in the employee's application, and the employee may change it by notifying the employer in writing no later than 15 calendar days before payment (Art. 136(3) of the Labour Code).
• An employer may not disclose an employee's PD to a third party without his written consent, except where there is a threat to the employee's life and health and in other cases provided for by the Labour Code or federal laws, nor disclose PD for commercial purposes without written consent (Art. 88 of the Labour Code).

• The Tagilstroevsky District Court of Nizhny Tagil fined a former traffic police inspector ₽1.1m for the unlawful transfer of car owners' PD from the GIBDD database and for taking a bribe.
• From January to April the inspector passed to a customer from Yekaterinburg photographs of more than 40 vehicle registration cards and other PD, receiving ₽500 per card (₽16k in total). To access the databases he used the accounts of colleagues, who did not know about his actions. The buyer of the information had previously been convicted by the Kirovsky District Court of Yekaterinburg.
• The court issued a separate ruling addressed to the head of the Nizhny Tagil Interdistrict Department of the Ministry of Internal Affairs in connection with violations that led to the dissemination of PD.
• For PD operators this is an example of how working under other people's accounts bypasses access control. Personal accounts with no password sharing and logging of queries to the PDIS, with review of access with no work task, close exactly this risk.

• Some large MFOs that hold the status of microfinance company plan to redirect part of the clients applying to them for online loans to subsidiaries - microcredit companies. Another route is to change status from microfinance company to microcredit company, but it has a number of limits. These steps are linked to the fact that from 1 March 2026 all microfinance companies issuing online loans will have to identify borrowers by biometrics from the Unified Biometric System (UBS), while for microcredit companies this duty will appear only on 1 March 2027.
• At the end of 2025 the Bank of Russia and the Ministry of Digital Development held a working meeting with MFO representatives, which discussed, among other things, ways to popularise the use of biometrics and fill the database with new data, as there is currently little of it, Denis Sidorov, executive director of Webbankir, told Vedomosti.
• Up to 50m Russians can now use services based on biometrics from the UBS, a Ministry of Digital Development representative told Vedomosti. He also confirmed the ministry's meeting with the Bank of Russia and MFOs: it was routine, and discussed preparation for implementing the requirements of the new federal law. The Ministry representative noted that microfinance companies show high technical readiness to introduce client identification by biometrics. At the same time, the use of biometrics is voluntary, the ministry representative reminded: the option of taking a loan from an MFO without it remains - by visiting the organisation's office.

• The BDA (which unites Yandex, VK, Sber, Gazprombank, T-Bank, Rosselkhozbank, MegaFon, Rostelecom, Beeline, MTS and others) sent a letter with proposals for improving AI regulation to Digital Development Minister Maksut Shadaev on 19 January.
• The BDA's proposals were made in execution of an instruction from Deputy Prime Minister Dmitry Grigorenko, who asked "interested organisations" to submit their ideas on AI regulation to the Ministry of Digital Development by 20 January 2025. The regulator, together with the government's analytical centre, will analyse them by the end of February and submit them to the government by 13 March.
• Among the effects the BDA wants to achieve are greater availability of data for AI training while respecting citizens' privacy rights, faster adoption of privacy-enhancing technologies for processing sensitive data, safe distribution of data among a wider circle of economic agents, larger volumes and diversity of data available for training AI models, and the emergence of new kinds of innovative data-based products, services and offerings.
• In particular, the procedure for classifying information as personal data and as information constituting legally protected secrets (including banking secrecy) needs to be specified where privacy-enhancing technologies are used. The BDA also believes datasets must be brought into civil circulation. "To date there is no legal regime for datasets, no market turnover for them, nor approaches to valuing them as an object of property rights, and their potential as a valuable asset has not been realised", the BDA states. For this, rules must be introduced into the Civil Code and accounting standards on including datasets among protected results of intellectual activity, and a legal regime for their civil circulation and for protecting the rights of their holders must be formed. For business this would expand the property base and grow assets and capital, for the state - tax revenues.
• Another overdue change, in the association's view, is the introduction of a model for charging for access to government data. Free access or reimbursement of marginal costs of providing access to data must be provided "to reduce the costs of access to information, promote innovation and maximise public welfare". This is exactly the global practice on access to public sector data, the BDA states. The report of the government's analytical centre "Access to public sector data: competition issues" points the same way.

• Bank top managers responsible for information security may be dismissed and barred for 10 years from holding a similar position at another bank in the event of systemic failures to protect clients from fraudsters. For top managers of non-credit financial organisations the period will be five years. This was reported by Bank of Russia Deputy Governor German Zubarev.
• "If measures have been repeatedly applied to a bank within a year for such violations, the relevant top manager will have to leave the post and will be unable to hold a similar position at another bank for ten years. A top manager of a non-credit financial organisation - for five years", Zubarev said.
• The deputy head of the regulator explained that the Bank of Russia is working out qualification requirements for top managers of financial organisations in information security. For the second reading a bill is being prepared that adds another criterion to the qualification requirements - violation of requirements on countering cyber fraud.

• Restrictions on disseminating in the media information about injured children with details of the incident need to be introduced in Russia. The exception is information from official bodies. This view was expressed at a press conference at TASS by Anna Mityanina, Children's Rights Commissioner in Saint Petersburg.
• According to the children's ombudsman, she has approached the Legislative Assembly of Saint Petersburg to develop initiatives to improve legislation on information security. "Our task is not to restrict society and people in receiving information, not to introduce censorship, as some media representatives believe, but to protect children from the planting of false information, fakes and comments spread by unscrupulous people", Mityanina stressed.

• Russia may enshrine in law a rule that a human retains the decisive role when artificial intelligence (AI) is used in socially significant areas: healthcare, justice, education and public safety. This follows from government materials collecting proposals for the bill on regulating artificial intelligence.
• The Ministry of Digital Development should send the document, prepared with these wishes taken into account, to the government for approval by the end of February, a source close to several relevant agencies said.
• The absence of a requirement for a decisive human role when using AI carries systemic risks, believes Anton Nemkin, a member of the State Duma Committee on Information Policy and federal coordinator of the party project "Digital Russia".

• The bank card register will not contain personal information about holders of payment instruments, Alla Bakina, head of the National Payment System Department of the Bank of Russia, told journalists on the sidelines of the Ural Forum "Cybersecurity in Finance".
• Earlier, Ivan Lebedev, State Secretary and Deputy Minister of Digital Development, said that within a year the Bank of Russia would prepare a unified database with information on bank cards issued to each Russian citizen. The Bank of Russia press service confirmed that work is under way on creating a unified register of citizens' bank cards to record their total number as part of the "Antifraud 2.0" project.

• LDPR leader Leonid Slutsky proposed enshrining in Russian law a duty for personal data operators to give users the possibility to withdraw consent to data processing in the same form in which it was obtained. A corresponding appeal was sent to Digital Development Minister Maksut Shadaev.
• In the text of the appeal Slutsky noted that current Russian legislation regulates the procedure for obtaining consent but does not oblige operators to provide a symmetrical procedure for withdrawing it, he added.
• "As a result, to withdraw consent given online a citizen often has to send an official letter to the organisation, which in most cases is ignored. This entails additional time and material costs and substantially hinders the citizen's exercise of their rights", the letter says.

• The Big Data Association (BDA), which unites Sber, Yandex, VK and other major players, proposed giving companies participating in the unified antifraud system access to certain categories of data from Ministry of Internal Affairs databases. The initiative was sent to Sergey Boyarsky, head of the State Duma IT Committee.
• This concerns information on suspects and accused persons, including for administrative offences, on wanted status, registration records and legal capacity. The authors of the letter point out that this "will allow credit and other organisations to build more comprehensive antifraud systems that take more parameters into account".
• "The proposal of the 'Big Data Association' deserves comprehensive analysis and elaboration with colleagues from the competent authorities", Boyarsky said.
• Telecom operators support the initiative. MegaFon believes it will allow "better and sometimes faster detection of fraud schemes". Any data exchange, especially of data that allows risks to be verified, brings benefit one way or another, notes Evgeny Vinokurov, head of the cyber fraud prevention directorate at Alfa-Bank.

• Yana Lantratova (A Just Russia), chair of the State Duma Committee on Civil Society Development and Public and Religious Associations, proposed creating a single service for withdrawing consent to personal data processing on the Gosuslugi portal.
• A corresponding appeal was sent to Maksut Shadaev, head of the Ministry of Digital Development. The deputy noted that the current legal regulation does not establish a unified and guaranteed mechanism for withdrawing consent to personal data processing. As a result, in practice heterogeneous procedures emerge that are determined solely by the internal rules of personal data operators.
• The letter specifies that the functionality of such a service could include displaying the list of organisations to which a citizen has given consent to personal data processing, the ability to withdraw consent remotely through an electronic interface, automatic notification of operators on receipt of such a withdrawal, and recording of deadlines for fulfilling the duties to stop data processing.
• In addition, the deputy proposes to enshrine in law a citizen's right to withdraw consent in any convenient way: online, via Gosuslugi, a personal account on the operator's website, by e-mail, through a multifunctional centre (MFC) or in writing.
• Lantratova also considers it appropriate to establish that the method of withdrawing such consent must not be more complicated than the method of giving it. Operators are also proposed to be obliged to accept a withdrawal regardless of how it is sent, to register requests and to notify the applicant of the result.

• Bank of Russia Governor Elvira Nabiullina called on regulators to solve the problem of data access and exchange for developers in the banking industry. She made this proposal at the plenary session of the Data Fusion forum on 8 April.
• According to a Bank of Russia survey, 2/3 of the organisations surveyed believe that without access to data they will not be able to use AI-based solutions, Nabiullina said. At the same time, in her words, not everyone in finance has access to data: there is a group of leaders with a lot of data, and there are financial organisations without such access.

• On 15 April a round table on "Liability for obstructing advocate activity. Protecting advocates' rights in the digital environment" took place in the Federation Council.
• Participants noted that despite formal guarantees, advocates face systemic violations, and digitalisation creates new risks to advocate-client privilege.
• Alexander Ternovtsov (Civic Chamber of the Russian Federation) proposed amending the Law on Personal Data and the Law on Free Legal Aid to provide a special simplified regime for processing PD by advocates providing free legal aid, and to exempt them from the duty to send notifications of PD processing to state bodies.
• Elena Avakyan (adviser to the Federal Chamber of Advocates of the Russian Federation - head of digital transformation of the advocacy) named one of the key problems: access to digital evidence and registers. Unlike a prosecutor, an advocate has no access to registers - advocate requests get refusals, and if an advocate finds information in another way, he is accused of unlawfully obtaining PD. Solving the problem requires amendments to the Law on Personal Data and the Law on the Advocacy.

• An unscheduled inspection at the N.L. Turupanov Vologda Emergency Medical Service Station revealed numerous information security violations. The information has been sent to the supervisory and control bodies.
• An internal departmental inspection established that the chief physician passed the data of patients brought in by ambulance to third parties.
• The chief physician was dismissed. The case is telling in the context of managing insider risks in healthcare and controlling medical staff's access to patients' PD.

• The Unified Biometric System (UBS) holds more than 100m face and voice samples of Russians; ~40m records are voice records. UBS users number 69m citizens: 6m with biometrics confirmed in a personal visit, 24m with standard confirmation, 7m who gave data remotely.
• The number of transactions using biometrics exceeded 32bn. Of these, 320m are bio-acquiring (payment "by smile"), 17m are metro travel, 13m are the conclusion of telecom contracts with foreigners and second-factor identification on Gosuslugi and in banks.
• The Ministry of Digital Development plans to:

1. 1Scale up the use of biometric data and widen collection channels (including remote submission of biometrics through dedicated apps).
2. 2Expand scenarios of mandatory biometric identification: foreign citizens when concluding telecom contracts; marketplaces (antifraud amendments); MFOs from 1 March 2026; microcredit companies - in a year.

• The pilot project is run by Aeroflot Group at Sheremetyevo and Pulkovo airports on Moscow - Saint Petersburg - Moscow flights. Passengers will be identified using the Unified Biometric System (UBS) and ESIA.
• The technology provides for automatic face scanning at turnstiles with biometric equipment, which will speed up check-in, pre-flight screening and boarding.
• Biometric data can be submitted directly at Sheremetyevo airport - the procedure will take no more than 10 minutes.
• The experiment implements the Ministry of Digital Development draft resolution published on 04.01.2026 (see section 5).

• The Bank of Russia has adjusted the requirements for microfinance companies, which from 1 March were required to serve clients using biometrics when issuing online loans. The regulator will not penalise companies for breaching this rule until 1 January 2027.
• Thanks to this relief, the market may show 10-15% growth in loans issued by the end of the year, whereas a decline had previously not been ruled out.

• According to RKN, as of 21.05.2026 it had brought 85 telecom operators to administrative liability for failing to provide data on subscribers' IP addresses. In March 2026, a total of 1,359 operators received notices that they must submit such data.
• The obligation derives from Art. 64 of the Law "On Communications" (assistance to operational-investigative activities, countering threats to the stability of the Runet). The stated aim is to counter cyberattacks, localise spam and secure the Russian segment of the network.
• Experts (citing Izvestia) note that the accumulated database of IP matches makes it possible to detect active VPN sessions in near real time and block them via the TSPU. In parallel, since 01.01.2026 new CAO offences apply for errors in reporting to RKN (Art. 19.7.10 - up to ₽500k/₽1m) and for violations when verifying subscriber data (Art. 13.29).
• Privacy-matters: the regime of collecting IP bindings does not formally qualify as PD in the strict sense, but combined with subscriber data (Art. 53 of the Law "On Communications") it in practice widens the perimeter of user information available to the regulator.

• By 2027 Russia will introduce a verification system for car-sharing users to establish identity and check driving licences using biometrics. The Ministries of Digital Development, Industry and Trade, Economic Development, Transport and Internal Affairs are responsible.
• By 2027 an age verification system using biometrics and a passport is also planned for personal mobility device (PMD) rental services.

• Maksut Shadaev, head of the Ministry of Digital Development, said at SPIEF-2026 that building age identification into platforms is a matter for the "near-term agenda".
• He said Europe and many developed countries are already going "down the path of strict restrictions"; the Ministry is studying, in particular, Roblox's experience of introducing age identification.

• T-Bank plans to launch Russia's first end-to-end advertising campaigns based on banking data. For targeting in external inventory (games, mobile apps, media) it intends to use information on the average receipt, income level, attitude to discounts, categories and places of purchases, brand preferences and the customer's life events (moving, changing jobs).
• A Kommersant source at an advertising agency notes that this list of data looks excessive for depersonalised collection and is useful only for setting up advertising aimed at a specific user.
• T-Bank assures that it does not pass client data to external platforms or third parties: "bank secrecy and clients' personal data remain within the bank's perimeter."

• Maintaining the EGRN (Unified State Register of Real Estate) and processing the information in it, including PD, is a direct statutory duty of Rosreestr. A data subject's prohibitions on processing and requests for destruction do not apply to processing in the state and public interest.
• The law on state registration of real estate does not provide for deleting PD from the EGRN at a citizen's wish: the data is kept permanently, and its destruction or removal is not permitted. When data changes, previously entered data is retained.
• Thus, the absence of the right holder's consent or a request to delete PD is not a ground for destroying it in federal state information resources.

• The state company Avtodor is developing an AI-based system for automatically detecting tired drivers (per SPIEF-2026 materials). The system will "see" cars that swerve on the road or drive for a long time without stopping.
• "We see everyone anyway - there is information by plate number," explained the head of the state company Vyacheslav Petushenko. Drivers are to be informed by SMS, phone call or road display board. No launch date has been set.
• From an information privacy perspective: linking number-plate recognition with the owner's contact details and automated calling raises questions about the legal bases for processing PD and about profiling.

• The Director of the Department for the Development of Mass Communications said that deanonymisation on the internet is a matter of the state's information security and that work on it is being carried out consistently, since security issues must be resolved online in the same way as offline.
• It was also noted that traditional media value their reputation and understand their responsibility for the information they publish, unlike new media-like entities, which remain anonymous and disregard the interests of society.

• To combat fraud and spam, tighter rules for the circulation of M2M SIM cards (data transfer between devices) and eSIM are under discussion: placing them in a separate category, additional user identification, excluding voice and SMS, and banning eSIM registration from abroad.
• There are about 60 million M2M SIM cards on the market, most often registered to legal entities.

• Speaking at the St Petersburg International Legal Forum, Valery Zorkin noted that the digital revolution has raised labour productivity but at the same time carries risks of total control barely compatible with human dignity, of complete loss of privacy and of cybersecurity problems that are currently unsolvable.
• The risk of people quickly losing control over whether the actions of general-purpose AI models comply with human goals, values and legal norms was also singled out.

• The President of InfoWatch pointed to the high cost of mass biometric identification, including storage, the technical difficulty of obtaining a quality template, and the development of deepfakes, to the point where the eye can no longer tell artificial images from real ones.

• The operator of the visa centres warned that registration and authentication using foreign services (including Apple ID and Gmail) will not be confirmed, and previously created accounts may be deleted unilaterally. Users are advised to create an account with a login and password on a Russian e-mail service.
• This is not the visa centre's own initiative but a consequence of the requirements on authorisation methods on Russian information resources, i.e. one of the first noticeable practical effects of these rules for services working for a Russian audience.

• On 03.08.2026 the Big Data Association appealed to the Ministry of Digital Development with a request to allow data to be processed using privacy-enhancing technologies (PETs) without citizens' consent for the development, training and use of AI.
• In the association's view, the current regulatory framework does not treat PETs as a separate category, and any mathematical or algorithmic transformation of PD falls equally under depersonalisation methods, so mature solutions are legally indistinguishable from intermediate ones.
• It is proposed that the conditions for applying PETs be zero or no more than a small fraction of a percent risk of identity disclosure, use of the data only for AI, and processing in the territory of the Russian Federation by Russian companies. It is also proposed to introduce the concept of a trusted intermediary, accredited by state bodies and operating an information system for storing depersonalised PD, and to divide data into paid and free.

• The Chairman of the State Duma Committee on Information Policy said that ticket booking services should not store passengers' PD after transferring it to the relevant state systems, and that retention periods and processing rules for such data should be set out in law.
• It was noted that the dataset may include not only routes and tickets but also phone numbers, e-mail addresses and payment information, so when buying a ticket the passenger must be told in plain terms what data is transferred, to whom and for what purposes, and only genuinely necessary data should be collected.

• In early August, AI working groups discussed a business proposal to the Ministry of Economic Development and the Ministry of Digital Development to create, within an ELR, a closed platform with access to state and quasi-state data, including sectoral GIS, registers and departmental systems, without extracting or copying data beyond it. Project details must be submitted to the regulators by October 2026.
• Access is to be given only to companies with the status of developer of a national or sovereign model (see Law 243-FZ in section 1), possibly extended to sectoral application developers. According to participants in the discussion, an ELR would make it possible to bypass selectively the barriers of Law 152-FZ, medical secrecy and sectoral regulations and to relieve the data holder of personal liability.
• The Ministry of Economic Development and the Ministry of Digital Development said that no specific proposals have been received yet. Experts point out that an ELR can work only within exceptions already provided for by federal laws, and without an obligation on data holders to share data the experiment risks remaining voluntary.

• Following observation of the elections in Kazakhstan, Ella Pamfilova, head of the Central Election Commission, said Russia could use stencils that cover other people's data in voter lists. When signing the list and receiving a ballot, voters see only their own data.

• The initiative is contained in the draft roadmap for developing the data centre market and concerns commercial data centres that merely host clients' equipment and provide infrastructure services (power supply, server cooling, physical security), without having access to the data or processing it. In the authors' view, enforcement practice currently allows such data centres to be held liable for leaks, up to turnover-based fines for a repeat leak.
• The document is planned to be sent for interdepartmental approval, and the proposals are to be introduced as amendments to Law 152-FZ, possibly within the next year.
• The Ministry of Digital Development has received no such proposals from the market, but agrees that a data centre that only provides infrastructure, does not determine the purposes and means of PD processing and has no access to PD is not a PD operator. In essence this is a matter of qualifying the participant's role rather than a concession, since liability under Art. 13.11 of the CAO is tied to the processing of PD.

• The Ministry of Digital Development is discussing refining the rules for pre-installing domestic applications on imported devices, including pre-installing a system AI assistant based on sovereign or national foundation models (see Law 243-FZ in section 1). A draft resolution introducing a choice of system assistant at the first start-up of a device was posted for discussion in early August, then removed from the portal and is being revised.
• According to sources, "Alice AI" may gain access to the user's other applications, including banking and other apps with sensitive data, with that data stored on the developer's infrastructure. The changes affect not only smartphones and tablets but also smart speakers.
• The Ministry of Digital Development stated that this is not about advantages for a specific service, and that the rules should ensure equal conditions for integrating domestic AI technologies. Experts see a risk of market monopolisation.
• From an information privacy perspective: a system assistant with access to notifications, applications and authorisation becomes a point of concentration of the user's PD, and the question of the legal bases for such processing remains open.

• Boris Chernyshov (LDPR) sent the head of Rospotrebnadzor an appeal proposing that online shops, marketplaces and grocery delivery services be required to offer a function for voluntarily switching off personalised advertising and recommendation offers of sweets, confectionery, sweet drinks, crisps and snacks generated from purchase history, search queries and other data.
• The setting is proposed to extend to recommendation blocks, add-on product offers when building a basket, personal selections and push notifications, while the user retains the ability to find and buy any product on their own.
• The current regulation of recommendation technologies (Art. 10.2-2 of Law 149-FZ) does not provide users with a right to switch off recommendations by product category.

• According to sources close to the Presidential Administration, the new committee will be responsible for marketplaces, AI, drones and the creative industries. At present AI is mainly overseen by the Committee on Information Policy, marketplaces and the creative economy by the Committee on Economic Policy, and drones by the Committee on Industry.
• The committee is to be headed by Alexander Sidyakin, head of the central executive committee of United Russia. For AI regulation this means a change in the lead committee through which bills in this area will pass.

• According to a survey by AlfaStrakhovanie of 2,500 economically active Russians, 2% of respondents read a PD processing consent or privacy policy carefully, and another 13% skim individual provisions, most often those on transferring data to third parties. The rest accept the terms without reading: 56% cite the excessive volume of documents, 48% say they cannot use the service without consent anyway.
• Only 4% have ever withdrawn consent and 7% have asked for their PD to be deleted. When abandoning a service, 71% simply delete the app, and one in four wrongly believes that the account and related data are deleted along with the app. 64% have accounts they have not used for over a year.
• Respondents are most worried about leaks of passport (76%) and banking (73%) data.
• The results support the thesis that consent has become a ritual, on which the initiatives for a consent platform and for deprioritising consent as a basis for PD processing rely.

• The head of the press service of the Moscow Main Directorate of the Ministry of Internal Affairs told TASS in an interview that copying a passport without legal grounds is unlawful, since it is PD handling that needs a specific purpose, and that at check-in one should ask why a copy is being made.
• As a rule, a hotel establishes identity by inspecting the document and recording the data in internal records; a copy is possible with the guest's consent, after which it is destroyed or stored. The Ministry representative recommended refusing consent to copying and asking for the data to be entered into the database and the passport returned.

• According to the company, hackers may have gained access to the PD of some customers, including names, addresses, e-mail addresses, phone numbers, dates of birth and order contents. The company does not store payment data.
• The company notified RKN of the incident, the attackers' access has been blocked, and an internal investigation is continuing.

Update On 14.10.2026 the Tverskoy District Court of Moscow placed under house arrest a defendant in the cyberattack case. He is charged with unlawful use, transfer, collection and storage of computer information containing PD, out of mercenary motives, by a group of persons (Art. 272.1(3)(a), (c) of the Criminal Code). The investigation continues to identify those involved.

• In September, BI.ZONE Threat Intelligence recorded two offers on underground forums of stealers with built-in AI profiling of victims. In addition to passwords, session cookies, bank card data and crypto wallets, the new generation of stealers extracts chat history and authentication data, including tokens, from AI assistants.
• A language model analyses the stolen log and builds a profile of the owner with their likely profession, interests and visited resources, which helps to quickly find valuable victims, for example developers with access to corporate systems.
• From an information privacy perspective: chat history with AI assistants becomes a standalone target for theft, so uploading work documents and PD to such services increases the consequences of a compromised work device.

• A working group of the government subcommission on AI development has prepared amendments to the bill on cloud services and IT outsourcing for financial institutions, and the initiative is supported by the Ministry of Digital Development. It is proposed to allow accredited IT companies to host, store and process bank secrecy and other restricted-access information on servers they own.
• It is proposed to oblige contractors to report incidents involving breaches of information protection requirements to financial institutions within two hours of detection.
• Experts point to the uncertainty of the requirement that servers be owned, under which providers with leased equipment may be left without admission, and to the fact that additional Bank of Russia requirements may make such outsourcing available only to the largest players. The bill passed its first reading in 2023; the second reading is expected this year.

Update On 14.10.2026 the State Duma passed the bill on information outsourcing in the second and third readings (see section 4).

• In a letter to the Chairman of the Government of the Russian Federation dated 15.10.2026, the Association of Internet Trade Companies proposed a special legal regime for companies affected by large-scale accidents and damage to digital infrastructure. It would allow critical systems to be temporarily hosted in backup data centres of friendly countries if it is impossible to keep them running at Russian sites.
• To that end, a temporary exemption from the localisation requirement when collecting PD is proposed for the period of infrastructure recovery, but no later than 01.03.2028, subject to official confirmation of the incident and compliance with IS requirements. It is proposed that the authorised body determine the list of countries and that the procedure for issuing temporary permits be developed together with the Ministry of Digital Development and RKN.
• According to Alexey Muntyan in a Forbes comment, the regime would be activated only after a confirmed incident and in effect confirms that keeping a reserve abroad in advance is not allowed. At the same time, the localisation requirement applies only to the collection of PD (Art. 18(5) of Law 152-FZ), so a conscientious business can arrange backup already now, and copies abroad should be kept encrypted with keys in Russia, retaining full responsibility to customers.
• On 20.10.2026 the Big Data Association declared its readiness to urgently develop rules for the safe storage of Russians' PD in data centres of friendly countries, not only after attacks but also for pre-arranged backup storage. In the BDA's position, hosting abroad must not lower the level of protection, and responsibility for the security of PD remains with the Russian company.

• In all multifunctional centres (MFCs) of the Moscow Region, staff use an AI service built into their work software that recognises data from passports and birth certificates and fills in applications when issuing internal and five-year international passports, obtaining SNILS and confirming the citizenship of children under 14.
• The operator scans the document, the neural network identifies its type and enters the surname, first name, series, number and other data into the application fields, and the MFC specialist checks the filled-in form and sends the document to the agency. The aim is to reduce typing errors in manual input.
• From an information privacy perspective: recognition of passport data by an AI model remains processing of PD for the purpose of providing a public service, so the place of processing, the absence of transfer of scans to external services and the retention of final human review are important.

• The material contains a scheme for filtering PD processing operations for the applicability of Art. 6(1)(7) of Law 152-FZ, and an example of such filtering for the following scenarios:
• organising access control to the territory where the operator is located;
• considering a job applicant for employment and the accompanying processing of data of their relatives;
• carrying out the operator's internal and external audits;
• investigating incidents related to PD security concerning the operator's data subjects.
• The selection does not replace or substitute a full assessment of the applicability of legitimate interest, but serves to exclude false notions that some PD processing can be legalised by relying on legitimate interest - without a full, in-depth assessment of its applicability, which is feasible for large operators but out of reach for SMEs.

• Global experience: ranking types of localisation by degree of restriction on the freedom of data flows
• Data localisation in Russia
• Evolution of the requirement to localise databases of Russian citizens' data
• Comments on the changes to localisation requirements
• RKN's interpretation of the clarified localisation requirements
• Interpretation options for the clarified localisation requirements
• A compromise interpretation of the clarified localisation requirements
• General conclusions on the clarified localisation requirements
• Retrospective of enforcement practice 2016-2025
• Definition of a database with PD
• Collection of PD as a single process rather than an action
• Collection and other ways of obtaining PD
• Decomposition of PD sources - using online learning as an example
• Express scheme for identifying databases subject to localisation
• Strategies for responding to the localisation requirement
• Difficulties in choosing a localisation strategy
• Approaches to estimating the cost of localisation strategies
• Estimating the costs of implementing localisation strategies
• Risks and consequences of non-compliance with localisation requirements
• Risk assessment when implementing localisation strategies
• Formula for assessing the attractiveness of strategies
• Calculator for assessing localisation strategies
• Example of ranking localisation strategies

🔥Example of a calculator for the attractiveness of localisation strategies

The phenomenon of "inflationary storytelling" describes a critical oversaturation of the digital environment with content of low semantic density ("media filler"). For information privacy this has direct and alarming consequences that go beyond media theory. Under oversaturation, a user's ability to give meaningful consent is de facto annihilated. A data subject in a state of cognitive exhaustion perceives requests for consent to data processing as one more kind of information noise. Clicking "I agree" becomes a mechanical ritual of getting rid of a nuisance rather than a conscious legal act.

• Main regulatory novelties of 2025 and forecast of trends for 2026: deprioritisation of consent and sectoral standards for data processing.
• Changes to the rules on RKN's supervisory activities and the practice of monitoring data subjects' rights on the internet.
• Results of 2025 case law on data leaks and the outlook for 2026, taking into account the return of some categories of cases to the courts of general jurisdiction.

The study is devoted to data depersonalisation methods and their practical application in analytics, AI model training and inter-company scenarios of working with information. The analytical report examines the main approaches to data depersonalisation, examples of their use in real business scenarios, as well as the risks of re-identification and the legal aspects of using depersonalised data. The document also contains recommendations for companies that are building or reviewing their depersonalisation processes. A separate section of the report covers the legal aspects of depersonalising PD. Experts note that regulatory requirements in this area continue to evolve, and their practical application requires taking into account both the regulator's recommendations and organisations' internal processes.

🪪Imagine that personal data laws (all those "I agree" tick boxes) were written for a world where information is a physical object, like a brick or a letter in an envelope. If you scratch out the name on the envelope (anonymise it), nobody will know whose it is. That is "Newtonian mechanics" - the old, familiar world.

✨But we live in a digital world. Here data behaves not like bricks but like light or a wave in quantum physics. It can be in two places at once, change its properties depending on who is looking at it, and instantly become linked with other data.

💡The author of the article tried to pull the scattered thoughts of the scientific community together into a single Tensor theory of regulating the processing of personal data, which proposes to stop fruitlessly updating analogue laws and tormenting people with endless consents to the processing of their data. Instead, digital automation of regulating data flows can be applied, working by the laws of physics and mathematics:

1. 1It weighs data by "mass" (uniqueness and sensitivity).
2. 2It looks at the "speed" of its circulation and use.
3. 3It checks the various "directions" (purposes and context) of data use.

⚖️If the risk (momentum) of using the data is too high or the direction does not match, the system simply will not allow the data to be processed. This turns privacy protection from bureaucracy into a precise science.

This tool assesses the likelihood that a given dataset will let us recognise (identify) a specific person.

🧮Index calculation formula:

Index = Data properties x Context

• Data properties ("mass"): how unique and unchanging the data is.
• Context (multiplier): whether we have the technical ability and a legal purpose to link this data to a person.

🚦Three risk zones of data processing:

🟢Green zone (low index): we process data but do not know the people. The requirements of Law 152-FZ hardly concern us.

🟡Yellow zone (medium index): there are no names, but we can "work out" the person or their device. The law begins to apply.

🔴Red zone (high index): we know exactly whose data we are processing. The full range of regulator requirements applies.

⭐Why use this index?

1. 1A "calorie counter" for data (Data Minimisation). The index works like a diet for databases. Every extra field (even a "harmless" one) raises the risk score. This shows marketing and HR clearly that collecting data "just in case" is not free but legally expensive. Solution: delete the excess or reduce precision (for example, an age range instead of a date of birth) to get back into the "green zone".
2. 2Fairness and savings (Privacy by Design). The index proves mathematically that data uniqueness ≠ personal data. If we store complex hashes or session GUIDs but use them only for technical support (context!), and not to look for a person, the risk remains low. This lets us avoid spending budget on protecting technical logs as strictly as on protecting the HR database.

🤝The attributability index helps to draw a clear line in disputed situations and to approach work with data consciously, focusing protection where it is really needed for people's privacy.

• The Russian Railways case formally sets no precedent, and the dispute was heard by an arbitrazh court, whereas from 1 January 2026 cases on leaks and other violations in the area of personal data return to the courts of general jurisdiction. Still, for business this case once again shows that a leak is not a matter of "if" but of "when". A number of practical conclusions for business can also be drawn:

1. 1Documenting preventive measures. Companies need a clear, up-to-date and documented history of carrying out measures and implementing PD protection measures. In the event of an incident, these documents will be the main argument confirming that the business took all measures within its power to prevent the leak.
2. 2A proactive stance in incidents. Concealing a leak is the worst strategy. Filing a report with law enforcement, informing the authorised bodies (RKN, the National Coordination Centre for Computer Incidents) and actively assisting the investigation of the incident are necessary elements of the legal defence of the company and its partners.
3. 3Substantiating the skill of the cyberattack. In court it will be necessary to prove not just the fact that the company's systems were hacked but the level of its sophistication and professionalism: the attackers' use of specific software, bypassing of existing (and working) security perimeters, the sophistication of the attack techniques.

The presentation briefly covers the following:

• Scale of the threat and evolution of fraud
• Anatomy of synthetic identities
• Risks of the total criminalisation of deepfakes
• Transition to transparency: labelling deepfakes
• Administrative liability and terminology
• Global regulatory landscape
• Self-regulation by platforms and the media industry
• Balance of interests

The checklist consists of 15 core and additional controls on third parties' compliance with PD processing and protection requirements, grouped into three sections:

1. 1Basic requirements (for any transfer of PD)
2. 2Additional requirements for processing PD on instruction
3. 3Additional requirements for cross-border transfer of PD

Scheme of regulatory requirements and methods for PD depersonalisation in Russia.

• The world of digital data has changed, and the old approaches to protection (like sorting grains of sand) no longer work. 👁 Alexey Muntyan, Managing Partner of Privacy Advocates, proposes looking at privacy through the lens of the physics of digital flow - as a continuation of the article on wave-particle duality of personal data and the tensor theory of regulation.

🔹Data has states of matter:

🧊Solid (archives): minimal kinetic energy but enormous risk potential.

💧Liquid (active databases): they flow but are restrained by the "viscosity" of regulation.

☁️Gaseous (API): they tend to fill all the available volume.

🔥Plasma (AI): data is irreversibly torn from context, like electrons from an atom.

🔹Dangerous transitions:

An archive leak is sublimation (an instant transition from ice to gas). And AI training is ionisation, after which the data starts to live its own life.

🔹The stasis effect:

When the speed of the data flow is extreme, the protection system may "freeze" - it records the attack but has no time to respond to it.

🎯What to do? Move to tensor regulation. Instead of static paperwork, a mathematical risk assessment through the vector of purposes, the mass and the speed of data.

💫The privacy of the future is not about prohibitions but about "smart containers" and digital force fields.

🔍We looked at four key questions that PD operators face when working with communication services:

Can PD be transferred through e-mail, messengers and videoconferencing at all - and what is wrong with employees' personal accounts?

Do the localisation and cross-border transfer requirements apply to correspondence in foreign services?

When does a messenger or e-mail service become a PDIS - and when not?

The ban on using foreign messengers to inform citizens and the specifics of the status of the national messenger (MAX)

🏛️The material covers the current positions of RKN and the Ministry of Digital Development for 2025-2026, risk analysis and specific recommendations.

🧩What is inside the document?

• An information brochure created to make it easier for staff to get to know the Regulation and focus on the most important aspects of working with PD.
• The detailed text of the draft Regulation, comprising 12 sections.

🚀Key features of the Regulation:

• The Regulation applies an effective mechanism for allocating roles in working with PD - the RACI model (Responsible, Accountable, Consulted, Informed).
• Each thematic section (2 to 11) must include: applicable rules with regulatory references, allocation of roles, a list of documented information (artefacts) and related documents.
• The document may be used and modified by any interested persons without restriction, provided it is used in good faith.

📅Requirements for the methods of logging in to Russian information resources came into force on 01.12.2023.

✅What is allowed:

• Mobile phone number
• ESIA (Gosuslugi portal)
• UBS (biometric data)
• Own authorisation systems (VK ID, Yandex ID, etc.)
• E-mail on a Russian domain (draft law)

❌What is prohibited: Apple ID, Google Sign-In and other foreign authorisation services on Russian resources

👤Who is affected: Russian companies and sole traders - owners of websites, applications, information systems and software

🔍Recommendation technologies (RT) - a set of algorithms that analyse your preferences and predict what will interest you. These are social networks, video hosting sites, marketplaces, streaming platforms and search engines.

❌What is prohibited:

• Applying algorithms that violate citizens' rights
• Using RT to spread fakes and content that violates Russian law
• Artificially creating "information bubbles" that limit a user's views

✅What is mandatory:

1. 1Publish the rules for applying RT (in Russian, accessible, not concealed)

• description of the processes for collecting data on preferences
• information processing methods
• types and sources of data

1. 2Post a notice on all pages

• text: "Recommendation technologies are used on this information resource"
• link to a detailed description

⚖️Liability: RKN sends demands to remedy violations. If they are not complied with - blocking of the resource.

👤Who is affected: Russian companies and sole traders - owners of any internet resources that use RT for users in Russia.

📌Three pillars of data pragmatism:

• Classic privacy compliance
• Lean data processing
• Secure data processing technologies (SDPT)

⚡The key algorithm has three stages:

1. 1analysis of the context and intensity of processing
2. 2identification of deviations
3. 3risk management

📊Risk assessment is based on two parameters:

• victimisation of processing = how "attractive" your processing is to attackers and the regulator
• criticality of deviations = how significant the violations of requirements are

🧮Excel calculator of PD processing risks - a ready-made tool for independently assessing any PD processing activity in your organisation. Three sheets: analysis of processing, identification of deviations, risk management. Scores and the risk level are calculated automatically.

📖Training material for the calculator - step-by-step instructions on a live case: a joint marketing campaign through the Marketo platform involving two companies. We go through all 10 analysis parameters and 10 groups of controls with hints and examples.

🧭Scheme of the PD processing risk-management algorithm - a visual map of the three stages with the full list of parameters, scores and insights. Handy as a memo when carrying out an assessment and as material for training a team.

🫆Concept and types of biometrics - static (fingerprints, iris, genome, photo) and dynamic (voice, signature, behavioural patterns) characteristics in the context of Art. 11(1) of Law 152-FZ.

🏛️Positions of the agencies - a comparative table of letters from the Ministry of Digital Development and RKN on whether a photograph is biometric PD. Spoiler: there is still no single answer.

⚖️Case law - two bodies of cases: when courts recognised information as biometrics (photos on passes, a vein pattern, video from cameras in common ownership) and when they did not (city cameras of the Ministry of Internal Affairs, video from a mobile phone, a recording of a sleeping employee).

🚨The precedent involving the FSB and Rosgvardia - analysis of a real 2022 case: the "Zelenograd" business centre, 170 photographs of children without parental consent, a fine under Art. 13.11(2) of the CAO.

🏗️The UBS and Law 572-FZ - types of biometrics (simplified, standard, confirmed), transactional and vector models of interaction, accreditation requirements.

🛑7 restrictions when embedding biometrics in IT/AI products: the closed list of the UBS, the ban on cross-border transfer, mandatory accreditation, a special consent regime, protection of minors, accuracy limits (FAR/FRR), vector model only for accredited entities.

⚠️7 key risks: irreversibility of a leak, fines of up to ₽500m and criminal liability, discrimination by AI models according to NIST FRVT data, deepfake attacks, function creep, reputational risks, prosecutors' inspections.

✅Recommendations for product teams - architectural (on-device, vector storage, liveness detection) and process-related (risk assessment before launch, consent logs, notifying RKN within 24/72 hours).

• New groups of personal data have been added to the PD Catalogue:
• 125. Consumer neurodata
• 139. Medical neurodata
• 154. Body odour and exhaled air composition data
• 155. Breathing data
• 156. Lip movement data
• 157. Finger micro-vibration data
• 158. Middle-ear acoustic response data
• 159. Bioacoustic signature data
• 160. Skin and epithelium structure data
• 161. Biochemical characteristics data
• 162. Signature dynamics data
• 172. Biometric neurodata
• The expansion of the catalogue reflects the development of recognition and identification technologies (including neural interfaces), which calls for a review of approaches to classifying PD and assessing the risks of processing it.

• The schemes in the Privacy Advocates "Almanac" describing the regulation and specifics of two legal institutions - user authorisation on information resources and recommendation technologies - have been updated to take account of the law on administrative fines for owners of Russian websites adopted by the State Duma (new Arts. 13.55 and 13.56 of the CAO, see section 4).

• Law 43-FZ amending Law 86-FZ "On State Regulation in the Field of Genetic Engineering Activity" enters into force on 01.09.2026: a separate concept of human genetic data and rules for its cross-border transfer appear.
• Genetic data is classified as a special category of PD or as biometric PD depending on the purpose and context of processing, taking into account Law 242-FZ on genomic registration, where genomic information is expressly classed as biometric. Under a conservative approach, any information on the presence or probability of a genetic variant can be considered genetic data.
• CBT of genetic data is possible only through the Interdepartmental Commission. The draft Government Resolution prepared by the FMBA on 16.04.2026 establishes a permit-based procedure with exceptions for medical care, drug development for a specific patient and international cooperation, or a notification procedure for scientific publications with aggregated depersonalised indicators.
• Transfer of genetic data to foreign persons, their branches and representatives is prohibited within Russia as well: the criterion is not the border but the national affiliation of the recipient, and a Russian representative is treated as equal to the foreign principal.
• Risks of the new regulation: localisation of databases with PD of Russian citizens, turnover-based fines for leaks of special categories for the mere fact of a leak, and criminal liability of up to five years under Art. 272.1(2) of the Criminal Code.
• On 24.06.2026 an updated presentation "PD_genetic data" was published.

• The scheme describes the model for obtaining consent to PD processing and adds to the Almanac's line of schemes on the legal bases of processing.

• The scheme for authorising users of Russian resources has been updated to take account of the third package of measures of the Ministry of Digital Development (see section 4): the obligation to authorise by subscriber number extends to any owners of internet resources, including foreign persons, Russian owners keep the menu of four methods, and the subscriber number becomes fixed as the universal identifier of a person for authorisation.

• The event lasted about 3.5 hours and included supervision results, the work of the Main Radio Frequency Centre's Legal Assistance Centre for Citizens in the Digital Environment, analysis of questions sent in advance and answers to questions from the audience.
• The speakers' positions are collected in a single summary and structured by topic: designing the processing, transfer and instruction, CBT and localisation, notification, consent and cases where it is not required, employees and applicants, biometrics, dissemination and open sources, destruction and archive storage, data subject requests, authorisation and recommendation technologies on a website, mailings.
• A separate appendix contains questions from the audience with answers: a destruction certificate under a processing instruction, one instruction from several operators, proving proper consent, the column on the location of databases, a face vector in a loyalty programme, legitimate interest, deletion versus destruction.
• The summary is a paraphrase and generalisation of what was said; wordings are given in abbreviated form.

• A technical overview report on differential privacy, a mathematically rigorous paradigm of PD protection that gives formal and provable privacy guarantees when publishing statistics, training machine learning models and synthesising data.
• The report covers the conceptual difference between privacy and classical information security, the history and formal definition of DP, its classification (global, local, shuffle and others) and examples of industrial application.
• The report continues the BDA series on secure data processing technologies after the report on depersonalisation (see above) and is available in short and extended versions.

• The 2025-2026 retrospective is put together on a single map and covers tougher liability, localisation 2.0, new depersonalisation rules, the separation of consent, risk-based supervision under the updated Government Resolution No. 1046 and automated website monitoring.
• Case law under Art. 13.11 of the CAO for January-August 2026 is given as a full cross-section of 222 rulings. The sanction split into two tracks. Magistrates fine without substitution (replacing a fine with a warning under Art. 4.1.1 of the CAO occurred once), while arbitrazh courts of first instance replace the fine with a warning in two cases out of three. All the large amounts (₽1m, ₽2m and ₽6m) come from foreign operators' failure to localise databases.
• A leak does not equal fault. RKN must prove what measures the operator could have taken and did not, but neither a contractor nor silence about an incident saves from liability.
• The 2026-2028 outlook includes symptoms of the exhaustion of the consent concept, sectoral processing standards instead of the "cult of consent", competition among four equal bases and a consent platform based on ESIA.
• Changes in infrastructure cover the new generation of FSTEC requirements (Order No. 117 and the methodological document), bringing processing onshore to Russia, Antifraud-2 and Antifraud-3, user authorisation under Art. 8(10) of Law 149-FZ with sanctions from 07.07.2026, and AI regulation under Law 243-FZ.
• Six trends for autumn 2026 and the key takeaways for DPOs boil down to the fact that liability and control have become harsh and not always predictable, and the regulator's focus has shifted from the form of consent to the substance of processing.

• The checklist now has 132 controls. 10 new ones have been added: a record of PD processing as the single source for the policy, RKN notifications and consents; video and audio recording and monitoring of work tools; PD of minors and age verification; origin of external PD datasets (purchased databases, scraping); provision of PD on requests from authorities, advocates and counterparties; oversight of processors; use of external AI services; receiving and logging data subject requests; a map of websites and applications with an archive of document versions; staff undertakings not to disclose PD.
• 10 existing controls have been refined, including those on passport copies, review of the bases of processing, written assessment of legitimate interest, prohibitions in consent to dissemination, transfer of genetic (Resolution 750) and biometric PD abroad, processing after withdrawal of consent, and FSTEC requirements (Order No. 117).
• The risk factors have been checked against the RKN inspection checklist (Order No. 253), taking into account the draft of its update (see section 6), and the draft Regulation on the organisation of PD processing and security has been updated in line with the updated checklist.

• The authors propose a three-stage test of the lawfulness of processing PD on the basis of a user agreement. First the general legislation is checked, then the general requirements of PD legislation, and only then the special requirements for a contract as a basis for processing (Art. 6(1)(5) of Law 152-FZ).
• The principles of PD processing play the key role. It is they, not the agreement itself, that set its limits, and no checklist can replace their systematic embedding in the operator's work.
• For comparison, GDPR and the legislation of Belarus, Kazakhstan, Armenia and Kyrgyzstan are analysed.

• The basic checklist for cloud AI services, APIs, local models and AI agents contains 16 controls (mandatory and recommended) on one page, with examples and references to norms.
• The checklist should be completed before launch together with the DPO, the information security specialist and the person responsible for AI use, and the assessment repeated at a scheduled inspection and before any change of model, supplier or terms of working with PD.
• The comments record confirmations of checks, limitations and deadlines for fixes, which helps to determine for which tasks and data AI can be used.

• The presentation briefly sets out the results of analysing the version of the package dated 30.09.2026 and its impact on PD regulation. It covers the consent platform on ESIA and the Gosuslugi portal, sectoral acts instead of consents, two authorisation regimes and three-year storage of login data, the data that will accumulate for the state, and the requirements for hosting, corporate VPNs, virtual PBXs and SMS mailings.
• Antifraud-3 goes beyond fighting fraudsters and changes the very institution of consent to PD processing, so it is worth preparing for its entry into force on 01.03.2028 already now.

• The guide breaks an AI system down into six layers, from the agent to the model weights, and shows the compliance zone at each of them.
• The guide brings together a timeline of regulation for 2025-2027, from the new depersonalisation rules to Law 243-FZ and sovereign models, professional secrecy as a second lock on top of the PD regime, AI agents, supplier status, localisation and CBT.
• It analyses the first practice, namely a ₽50k fine for references invented by a neural network (case No. A27-7831/2025) and a lawful dismissal for uploading reports to DeepSeek (case No. 02-1545/2026), as well as seven steps for managing AI in a company.
• Before launching a specific scenario, the guide suggests checking against the PD checklist for the use of AI (see above).