Liability for PD violations

Law 420-FZ of 30.11.2024

CAO: leaks and biometrics

turnover-based fines for repeat leaks, up to ₽500m

fine scale by number of subjects and identifiers

offences for failing to notify Roskomnadzor

new Art. 13.11.3 on biometrics

in force since 30.05.2025

Law 421-FZ of 30.11.2024

Crim. Code: Art. 272.1

unlawful use, transfer, collection and storage of computer data with PD

creating resources for illegal trade in PD

up to 10 years' imprisonment

in force since 11.12.2024

Law 104-FZ of 23.05.2025

CAO: information protection

tougher Art. 13.12 of the CAO

up to ₽100k for legal entities for uncertified security tools and protection breaches

Art. 13.12 limitation period raised to 1 year

up to ₽15m

One-off leak

Art. 13.11(12)-(14) by scale: from ₽3m already at 1-10k subjects

1-3% of revenue

Repeat leak

Art. 13.11(15), (18): from ₽20m or ₽25m to ₽500m

up to ₽20m

Biometrics leak

Art. 13.11(17); special categories up to ₽15m under (16)

up to ₽3m

Failure to report a leak

Art. 13.11(11); no notice of processing: up to ₽300k, (10)

fines under Art. 13.11(1)-(1.1) and (2)-(2.1) rose to ₽300k and ₽700k, for repeats to ₽500k and ₽1.5m

new Art. 13.11.3 on biometrics in the UBS and biometric systems and Art. 14.8(8) on refusing a consumer who declines biometrics

Art. 13.11(1.1), (8)-(18): sole traders liable as legal entities

turnover fine under (15), (18) falls to 1/10 of minimum on three conditions (Art. 4.1(3.4-2))

Full-size map

on Yandex Disk

Diagram labels in Russian

• Art. 13.11 part
• Violation
• Legal entity
• Official

• (1) and (1.1)
• processing without a basis or beyond collection purposes
• 150-300k, repeat 300-500k
• 50-100k, repeat 100-200k

• (2) and (2.1)
• without mandatory written consent
• 300-700k, repeat 1-1.5m
• 100-300k, repeat 300-500k

• Part 11
• failure to notify Roskomnadzor of a leak
• 1-3m
• 400-800k

• Part 12
• leak: 1-10k subjects or 10-100k IDs
• 3-5m
• 200-400k

• Part 13
• leak: 10-100k subjects or 0.1-1m IDs
• 5-10m
• 300-500k

• Part 14
• leak: over 100k subjects or 1m IDs
• 10-15m
• 400-600k

• Part 15
• repeat leak under (12)-(14)
• 1-3% of revenue, 20-500m
• 800k-1.2m

• Part 16
• leak of special categories of PD
• 10-15m
• 1-1.3m

• Part 17
• leak of biometric PD
• 15-20m
• 1.3-1.5m

• Part 18
• repeat leak of special categories or biometrics
• 1-3% of revenue, 25-500m
• 1.5-2m

• CAO provision
• Violation
• Legal entity
• Official

• Art. 13.11(10)
• no or late notice to Roskomnadzor of PD processing
• 100-300k
• 30-50k

• Art. 19.7
• failing to give Roskomnadzor information; use for CBT non-notification is disputed
• 3-5k
• 300-500

• Art. 13.11.3(1)
• placing and updating biometric PD in the UBS in breach of the law
• 500k-1m
• 100-300k

• Art. 13.11.3(2)
• breaching the procedure for biometric PD and UBS vectors
• 500k-1m
• 100-300k

• Art. 13.11.3(3)
• failure to secure biometric PD in the UBS or in biometric systems
• 1-1.5m
• 300-500k

• Art. 13.11.3(4)
• processing biometrics, UBS vectors for authentication without accreditation
• 1-2m
• 500k-1m

• Art. 14.8(8)
• refusing a consumer a contract for declining biometric identification or authentication
• 200-500k
• 50-100k

Subjects

official: an official of a state or municipal body or NPO

legal entity: any other operator

(1.1), (8)-(18): sole traders treated as legal entities

Aggravation for (15) and (18)

continuing a violation despite a demand to stop (Art. 4.3(1)(1))

the violator was already penalised under Art. 13.11(1)-(11), 13.6 or 13.12 at the time

Processor and notifications

for a leak at a processor, the instructing operator is liable

(10) formally does not cover notices on CBT, changes of data and end of processing, but is sometimes applied to them

• 1
• Retroactivity

applying the new offences to pre-30.05.2025 violations is debatable given Art. 1.7 CAO

• 2
• Identifier

how to tell an ID from other data, judge uniqueness, count repeats in one database and treat IDs outside a PDIS; will tying fines to IDs discourage a move from universal to local identifiers

• 3
• Failure to report a leak

(11) covers Roskomnadzor only, not the FSB, and is silent on whether the breach is continuing or continued

• 4
• Investigation

for (1)-(2.1), (12)-(18), expert work and lengthy procedural steps require an administrative investigation (Art. 28.7), which also establishes guilt

• 5
• Jurisdiction

commercial courts heard Art. 13.11 cases from 30.05.2025; from 01.01.2026 they returned to general courts (Law 508-FZ of 28.12.2025), and cases already accepted stay with the commercial court

Transition trap

Limitation

a report sent to a commercial court in late 2025 reached a district court after transfer on jurisdiction beyond the one-year period, and the case was closed as time-barred

01

Release from liability

where the offence is insignificant, Art. 2.9

02

Warning

for a first violation with no harm, threat of harm or damage, Art. 4.1.1(1) and Art. 3.4(2). In 2026 magistrates gave it in 8 of 83 rulings

03

Half the fine

in exceptional circumstances tied to the nature and consequences of the violation and the legal entity's finances, Art. 4.1(3.2)-(3.3)

04

Minimum fine

for cases found in supervision, if consequences were averted, damage paid or harm remedied, Art. 4.1(3.4-1), Art. 4.2(1)(5)-(6)

Important

broad use of Art. 2.9 and Art. 4.1(3.2)-(3.3) for Art. 13.11(15) and (18) is unlikely

payment within 20 days gives no 50% discount (Art. 32.2(1.3-3))

an organisation and its official are usually liable in parallel; exceptions in Art. 2.1(4)-(5), incl. turnover fines under (15), (18)

see cl. 21, Supreme Court Plenum Ruling No. 5 of 24.03.2005

The fine drops to one tenth of the minimum, but not below ₽15m or above ₽50m, if all conditions are met at once:

1

IS spending

at least 0.1% of annual revenue in each of the past three years on measures by FSTEC (technical protection) or FSB (crypto) licensees, or by the operator itself if licensed

2

Proof of protection

documented compliance with PD protection requirements in the PDIS for 12 months before the violation is found

3

No aggravating factors

no aggravating circumstances under note 5 to Art. 13.11: continuing the violation or an existing penalty for related offences

Open questions: whether services and security tools from non-licensees count, and in what form to prove compliance, practice has not yet answered

rarely works for leaks and only on a combination of circumstances

first offence, in state control, no harm or threat. Practice splits on (13); appeal of 14.08.2026 held replacement unlawful

exceptional circumstances, sanction from ₽100k, not below half the minimum

case found in supervision, harm prevented or voluntarily compensated

to 1/10 of minimum, within ₽15-50m: IS spend of 0.1%+ of revenue for 3 years through licensees, a year of proven protection, no aggravating factors

USUALLY DOES NOT WORK

we were hacked, no evidence of measures: the RZD case (10.06.2026) helps only if measures are shown

"not PD": name and phone still relate to a person

contractor's fault: the operator answers to the subject

data is outdated: PD status lasts until destruction

employee convicted under Art. 272.1: organisation not released

fast payment: no 50% discount for Art. 13.11

• Four pillars of defence
• 1
• incident circumstances: scale, categories, exposure
• 2
• status and conduct: first offence, admission, remedy
• 3
• measures before/during: documents, IS, harm assessment
• 4
• actions after: notices, alerts, compensation

• Provision
• Violation
• Citizen
• Official
• Legal entity

• Art. 13.12(2)
• using uncertified information systems, databases and security tools where certification is mandatory
• 5-10k
• 10-50k
• 50-100k

• Art. 13.12(6)
• breach of information protection requirements, except state secrets
• 5-10k
• 10-50k
• 50-100k

Also: the limitation period under Art. 13.12 is extended to 1 year from the offence, and a penalty under Art. 13.12 aggravates liability for a repeat leak

• Part
• Offence
• Maximum penalty

• Part 1
• unlawful use, transfer, collection, storage of computer data with PD obtained by unlawful access or other interference
• fine up to ₽300k or 1 year's income, forced labour or imprisonment up to 4 years

• Part 2
• same with PD of minors, special categories or biometric PD
• fine up to ₽700k or 2 years' income, forced labour or imprisonment up to 5 years

• Part 3
• Part 1 or 2 with mercenary motive, major damage, as a group by prior agreement or using official position
• fine up to ₽1m or 3 years' income, forced labour up to 5 years, imprisonment up to 6 years

• Part 4
• Parts 1-3 involving cross-border transfer of PD or movement of media
• up to 8 years' imprisonment, fine up to ₽2m, disqualification up to 4 years

• Part 5
• Parts 1-4 with grave consequences or by an organised group
• imprisonment up to 10 years

• Part 6
• creating or running a resource knowingly meant for unlawful storage or dissemination of PD
• fine up to ₽700k, forced labour or imprisonment up to 5 years

How obtained

Parts 1-5 require PD to be obtained by unlawful access or other interference with processing tools, or another unlawful way

Personal needs

does not apply to processing by individuals solely for personal and family needs

Cross-border element

besides transfer of PD, moving a machine-readable medium with PD across the border counts

Grave consequences

the article has no definition of its own

Practice forecast

with mitigating circumstances courts will likely choose a fine and disqualification from office, keeping imprisonment for large, high-profile cases

Art. 61(1)(e) of the Criminal Code (dependence) lets the court downgrade the offence (Art. 15)

a civil claim for moral and property damage may join the criminal case (Civil Code Arts. 151, 1099; Crim. Procedure Code Art. 44)

guidance: Supreme Court Plenum Ruling No. 37 of 15.12.2022 on computer crimes

The disposition of Part 1 of draft Art. 272.1 of the Criminal Code lacks crime-forming elements that would distinguish this crime from the unlawful acts under Art. 13.11 of the CAO...

Supreme Court opinion on the bill of 11.01.2023 No. 4-VS-79/23, Deputy Chairman of the Supreme Court V.A. Davydov

Differences

• 1
• the CAO names the operator, the Criminal Code does not

• 2
• CAO: information with PD; Criminal Code: computer data with PD

Risk

the same act can be classed as both an offence and a crime, including depending on a subjective view of its social danger

Focus on the subjective side: criminally punishable should be PD processing for a purpose directly prohibited by law. Unlawful processing of PD for an originally lawful purpose, such as research, should not be classed as a crime

Basis

Supreme Court Plenum No. 58, 22.12.2015

the nature of social danger is set by criminal law and depends on whether the act targets the values it protects and on the harm caused

Criminal liability

processing for a prohibited purpose: selling databases, fraud, stalking

Administrative liability

breach of processing rules with a lawful business purpose

OVERLAP ZONE

Who faces liability

those who unlawfully use, transfer, collect and store PD accessed illegally

those who create and run resources where such information is stored and disseminated

Unlawful access

unlawful interference with servers, computers and networks to disrupt PD processing and storage

e.g. hacking, illegal entry and theft

IS specialists

to investigate leaks they have to handle illegally disseminated data

the law permits such processing, e.g. to protect citizens' life, health and other interests

923

crimes under Art. 272.1

registered in 10 months of 2025; earlier many were charged under Arts. 137, 272, 274

Who is prosecuted

mobile shop staff, law enforcement, public service centre and tax employees, bank couriers, medics

DPO

no cases of prosecuting a DPO noted; the position matters only for special offences

Bots and brokers

owners of data-search bots, such as Userbox, and grey data brokers fall under liability

Typical acts

leaking data to a specific person, SIM card schemes, selling passport scans, photos of computer screens

• Article
• What was done
• Who
• Result

• Art. 274.1(5)
• attack on an airline booking system, taking passenger PD
• two vice presidents of the system developer
• case opened in 2024

• Art. 274.1(5)
• installed remote access software on the "ProMed" medical system for a funeral agency
• system administrator of an ambulance station, Astrakhan
• 5 years suspended

• Art. 272.1(3)(g)
• gave outsiders the PD of an honoured artist and another subscriber
• mobile shop employee, Kirovsk
• cases opened

• Art. 272.1
• 36 queries in three months and sale of subscriber data for cryptocurrency
• mobile shop employee, Novosibirsk
• case based on FSB materials

• Art. 272.1(3)(g)
• passed acquaintances data from the unified real estate register
• head of a department at a public law company branch, Karelia
• Investigative Committee case

• Art. 272.1(2)
• photographed a patient's diagnosis on a screen and posted it in a messenger
• district hospital cleaner, Sverdlovsk region
• fine ₽10k

Trend: in this sample most cases target employees with data access, not external hackers

• Article
• What was done
• Who
• Result

• Art. 272.1(3)
• gave a subscriber's name and address to a third party by phone and messenger
• telecom company specialist, Khakassia
• Interior Ministry case

• Art. 272.1(3)
• sold fraudsters data on over 27k people
• head of MFC and clinic call centre, Cherepovets
• remanded in custody

• Art. 272.1
• service selling access to leaked databases: subscriptions up to ₽1m+ a month, over 25 TB seized
• organiser and tech support
• in custody

• Art. 272.1(3) and (5)
• registering over 1,500 SIM cards using purchased passport scans
• three telecom operator partners, Krasnoyarsk Krai
• case opened

• Art. 183(2); Art. 272.1(3)(g)
• gathering tax secrets, passing PD to third parties
• tax inspector (Art. 183) and treasury employee (complicity and Art. 272.1), Kaluga
• Investigative Committee case

• Art. 272.1(5) and (6)
• Telegram bot "Userbox" disseminated PD from leaks
• bot creator and administrator, St Petersburg
• charges brought

Example: the Userbox case shows that Art. 272.1(6) is applied to resource creators, not only to those who pass on specific records

135

leaks in 2024

710m records

168

leaks in 2023

300m records

140

leaks in 2022

600m records

2023

₽4.6m in fines

39 unscheduled inspections, 37 confirmed leaks, 122 reports, 87 of them led to fines under Art. 13.11(1) and (2)

a warning (Art. 4.1.1) was often given instead of a fine, or the operator was released as insignificant (Art. 2.9)

practice followed strict liability: operators were held liable for a leak without establishing guilt (Art. 2.1)

16

administrative investigations

into unlawful transfer of PD that infringed subjects' rights

15

leaks confirmed

by Roskomnadzor regional offices

(1), (12), (13)

Art. 13.11 of the CAO

offences with reports drawn up

New: reports were also drawn up under the new Parts 12 and 13, with sanctions from ₽3m and ₽5m for legal entities

Distribution by Art. 13.11 offence

• Offences
• Share

• (1)-(1.1): unlawful processing and small leaks
• almost 2/3

• (3)-(6): policy, subject rights, RKN requirements, manual processing
• about 1/5

• (2)-(2.1): no mandatory written consent
• single-digit %

• (8)-(9): no localisation of PD databases
• single-digit %

Warnings

over half of 2025 cases ended in a warning, while in 2026 magistrates gave 8 of 83 rulings

Initiators

Roskomnadzor starts about three quarters of cases, prosecutors the rest

Who was held liable

banks, telecom, state bodies, schools, hospitals, digital services, housing bodies, individuals

New special offences

no large fines in 2025; in 2026 a commercial court gave ₽400k under (14) (YuKIDS) and a warning under (13)

• Case
• Offence
• Result
• Key points

• YuKIDS, A40-351064/2025
• Part 14
• ₽400k
• micro-enterprise fine cut under Art. 4.1.2 to the official's rate, no warning, upheld by 9th AAC on 03.06.2026

• Orion Telecom, A19-25808/2025
• Part 13
• warning
• first offence, no harm, 4th AAC left it 14.08.2026

• MK NAKFF, 05-1258/252/2026
• Part 16
• ₽5m
• patient data leak: fine cut for a medium enterprise, amount redacted in the copy, reportedly ₽5m against a ₽10m minimum, in force from 15.09.2026

• MGEU, 05-669/2026
• Part 1
• ₽150k
• leak of 2,486 applicants' data classed under (1) though subjects number over a thousand

• Rostelecom, A56-82945/2025
• (1), (12)
• not held liable
• cassation 02.10.2026: operator answers for contractor, but limitation expired

Dispute: the line between (1) and (12) is unsettled: sub-threshold leaks fall under (1), and courts move earlier contractor leaks out of (1) and back. Record the volume of affected data right after the incident

9th AAC 16.02.2026, Moscow Dist. AC 10.06.2026, No. A40-263206/2025

₽150k fine annulled

Roskomnadzor found an RZD staff database of 17m+ rows in Telegram channels: names, positions, e-mail. The first instance fined under Art. 13.11(1). RZD cited a targeted attack; a criminal case was opened under Art. 272.1(1) Criminal Code

Key findings

a leak in itself is not the company's guilt; administrative liability arises only with guilt (Art. 2.1(2) of the CAO)

Roskomnadzor must prove which measures the company could take but did not

if the company aimed to protect and criminals caused the harm, there is no administrative guilt

finding guilt is premature before the hacking criminal case ends; geopolitical context lowers the degree of guilt

Important: this is a case-specific finding: in Comline, PKR Analytics and Orion the courts found the operators guilty despite cyberattacks and victim status

Supreme Court, 21.01.2026, No. 5-AD25-119-K2

₽100k fine under Art. 13.11(1)

In November 2023 ministry staff and relatives' data leaked online. The Ministry of Labour blamed a hack of a contractor, which had failed to secure it

Key findings

operator status requires organisational and technical protection measures, and handing processing to a contractor does not remove liability

the ministry did not notify Roskomnadzor itself and confirmed the leak only after the regulator's request, which was treated as inaction

no evidence of internal control and audit of compliance with Arts. 18.1, 19 and 22.1 of Law 152-FZ

SPb AC, 26.02.2026, A56-4733/2026

Warning under Art. 13.11(13)

In August 2025, after a cyberattack, a website's database reached Telegram: 70k representatives and employees of legal entities, names, positions, work e-mail and phone. The company filed the initial and follow-up notices on time

Key findings

the court refused to suspend the case over a police check: a crime register extract is not a decision to open a criminal case

guilt found, but the first-offence fine became a warning under Art. 4.1.1 CAO even with 70k subjects

first-instance courts keep applying strict liability and require operators to prove every possible protection measure

Kemerovo Region AC 28.04.2026, 7th AAC 27.08.2026, No. A27-23786/2025

Warning under Art. 13.11(12)

In June 2025 the BO_Team_UA group compromised data of 4,225 subscribers: names, passports, addresses, phones. A BI.ZONE report ordered by the operator itself showed an active account of a 2022 leaver, passwords dating from 2019 and vulnerable software

Key findings

a criminal case against the hackers (Art. 272.1) does not release the operator; the offences divide the attacker's and operator's liability

Category 3 CII object status gives no right to a leak

the court treated delaying the case and a late request for an expert examination as abuse of rights

₽3-5m sanction replaced by a warning: SME, first violation

Communication: the company first called it a DDoS attack and denied a leak, admitting it only after the database was published

Irkutsk Region AC 12.05.2026, 4th AAC 14.08.2026, No. A19-25808/2025

Warning under Art. 13.11(13)

Database published in Telegram on 29.07.2025. The defence argued the 30.05.2025 intrusion bars Part 13. The company is a victim in a criminal case under Arts. 272, 273, 272.1 Criminal Code

Key findings

a material offence: complete on the unlawful transfer, i.e. publication of the database

Art. 272.1 Criminal Code punishes the attacker, Art. 13.11 CAO the operator's failure to protect; the offences are distinct

guilt is a legal issue, so expert review of its degree was refused

appeal: leaked passport data, addresses and phones mean a significant rights violation; Art. 3.4(2) conditions for a warning not met

Result: the penalty was not raised only because the one-year limitation, counted from the database's publication, had expired. Practice on warnings for large leaks is split

• 1
• Closed hearings

allowed when the file holds IT infrastructure details and internal IS audit results

• 2
• Guilt found

in all cases companies were held liable for failing to secure PD, penalty "other" - a warning

• 3
• Substituted terms

the press release on "no dissemination" swapped the subject: the charge was failing to ensure security, not dissemination

Held liable

6 companies, 8 rulings

LLC "Orion Telecom", Krasnoyarsk: A33-29341/2025, A33-29658/2025, A33-29660/2025

LLC "Orion Telecom", Krasnoyarsk Krai

LLC "KrisTelecom"

LLC "45 KA"

earlier: LLC "Comline" and LLC "Orion Telecom", Irkutsk

Moscow AC, 07.11.2025, No. A40-236948/2025

Sole trader's claims rejected

A sole trader challenged the RKN Central FD office's refusal to act against Otzovik.com's administrator over a review with his data and defamatory claims

Key findings

name partly hidden by asterisks, ruling out identification

the review's address is a Moscow warehouse; the applicant is registered in Tula

link to the reviewed company not proven

platform is an information intermediary, not liable for others' posts without knowing they are unlawful (Constitutional Court, 09.07.2013, No. 18-P)

Savyolovsky District Court, 16.07.2025, No. 02-2324/2025

Consent not required

In an employment dispute an employee claimed the employer unlawfully passed her PD to a company handling accounting and tax records and to the office landlord to issue a pass

Key findings

an employer may process employee PD without separate written consent if needed to perform the employment contract and employer duties

basis: Art. 86(1) Labour Code, Art. 6(1)(5) of Law 152-FZ

Practice: transfer to a processor on instruction or for access control stays within the contractual basis

A74-10378/2025

What the court requested

Roskomnadzor describes measures the company should have taken but did not

the defendant describes and documents the protection measures taken

A33-29369/2025

What the court requested

Roskomnadzor assesses protection-system arguments and justifies the date of access to the PDIS and the end of the violation

the defendant proves it took all necessary preventive measures

Takeaway: collect evidence of measures before the incident: after a leak it cannot be created

Moscow AC 10.12.2025, 9th AAC 14.04.2026, Moscow Dist. AC 08.07.2026, No. A40-201075/2025

Liability refused in three instances

Using its AS MPD system, Roskomnadzor treated DLBI as an intermediary giving access to illegal databases without grounds (Art. 13.11(1)). DLBI separated processing of site visitors' data from the hash-based search algorithm and provides checks via partners

Key findings

the service processes not PD but data in which signs of users' PD are searched

Roskomnadzor did not prove that the analysed data are PD protected by law

DLBI's activity matches global practice and aims to prevent leaks

Significance: Roskomnadzor lost because it failed to prove the analysed data are PD; the court did not separately assess the service model

...following the analysis, a more differentiated scale for different legal entities may appear...

Andrey Klishas, Chair of the Federation Council Committee on Constitutional Legislation and State Building, 26.11.2024

What was discussed

• 1
• different penalties for large and small banks

• 2
• discussion with industry lobbyists continues

What to watch

• 1
• practice under Art. 13.11(15), (18) CAO

• 2
• use of Art. 4.1(3.4-2) CAO to cut turnover-based fines

01

A leak costs millions

since 30.05.2025 the fine depends on scale, data category and repetition, and a repeat leak costs up to 3% of revenue

02

Guilt back in focus

in the RZD case courts demanded proof of guilt, but most cyberattack cases find the operator guilty

03

A warning is not a win

it is a penalty: for a year the person counts as penalised, aggravating liability under (15), (18) (note 5 to Art. 13.11)

04

Evidence of measures in advance

IS spending, proof of compliance and investigation are prepared before the incident

05

Criminal risk for insiders

Art. 272.1 is most often applied to staff with lawful access to data