Part V, section 20

Cross-border transfer of PD

Procedure, recipient assessment and case law 2023-2026

40 slides
5 subsections
Edition of 25 October 2026

20.1

Concept and regulation of CBT

What counts as transfer and how regulators read it

TPD-001

CBT regulation in Russia

General Art. 12 regime of 152-FZ and sector rules, which are checked first

Slide text

GENERAL REGIME

Art. 12, 152-FZ

Basis and purpose

from Art. 6(1), purpose as actual activity

Recipient review

Art. 12(5) data before filing the notice

Notification of intent

Art. 12(3)-(4), apart from the processing notice

RKN decisions

ban or restriction, Art. 12(7)-(12)

Art. 3(11): CBT is transfer of PD to the territory of a foreign state to a foreign authority, individual or legal entity

SECTOR REGIMES

572-FZ, Art. 3(21)

ban on identification, authentication with CBT of biometrics, except by state bodies, Bank of Russia

86-FZ, Art. 13.1, 13.2, Res. 750

genetic data from 01.09.2026: free, notification and permission routes

87-FZ, Art. 4(11)

forwarder clients' PD are not sent abroad, except for international carriage

Res. 2526, 29.12.2022

16 public-law cases need no notice, 4 more - notice without a ban right

236-FZ, Art. 16

RKN may ban a violating foreign online entity from collecting and CBT of Russians' PD

Art. 272.1(4), Crim. Code

CBT and cross-border carrying of media are aggravating features

TPD-002

CBT concept

Three conditions met at once, Art. 3(11), 152-FZ

Slide text

Transfer

provision of or access to PD

+
From RU

to the territory of a foreign state

+
Foreign person

authority, individual or legal entity

CBT

Purposefulness

expert feature: the operator initiates the transfer, not a site user or the subject

Operator to operator

RKN 14.08.2026: CBT arises in operator-to-operator relations

Regime core

jurisdiction over data changes: recipient's registration country and server country count together (RKN 14.08.2026)

Border and media

since 2011 border crossing is no CBT sign (261-FZ), but carrying media is a sign of Art. 272.1 Crim. Code

Without any one condition there is no CBT, but Art. 18(5) localisation may still arise.

TPD-003

Examples of CBT

Typical scenarios requiring a basis, recipient assessment and notification

Slide text

Corporate group

reports with PD for a foreign parent company and its counterparties

parent, auditors and law firms in audits and investigations

staff PD in a global directory, portal, Active Directory

PD a Russian branch passes to its foreign company

Clouds, services

foreign clouds for processing and backup: Azure, Google Cloud, AWS

specialised platforms: Google Analytics, SAP, Workday, Salesforce

PD to cloud, mail, video call and messenger providers for work accounts

Staff and travel

booking foreign hotels and tickets with foreign companies

people from Russia attending foreign events

opening accounts and taking policies abroad

Mail and access

staff contacts to foreign recipients in business and contract work

access of foreign persons abroad, e.g. contractor staff, to PD in Russia

TPD-004

Examples of no CBT

No foreign recipient, no route from Russia or no deliberate transfer

Slide text

Recipient not foreign

a representative office or branch of a foreign company registered in Russia

a Russian citizen abroad, incl. an employee, and their access to PD in Russia

a foreign branch of a Russian company without legal entity status (disputed)

Not from Russia

transit via foreign territory between persons and systems in Russia

transfer from a foreign state to Russia and between foreign states

data returned by a foreign processor to a Russian operator

No deliberate transfer

dissemination to unspecified persons

PD sent abroad by the subject

a channel in a foreign messenger for users from Russia

services not processing PD, e.g. Google Tag Manager

Office clouds, mail, video

intended use, e.g. mail and video calls of two Russian companies, is hardly CBT

but work accounts with a foreign provider may be CBT (Microsoft 365, Google Workspace, Zoom)

storing Russians' PD there breaks localisation (RKN 26.09.2025, 12.01.2026)

TPD-005

Disputed classification

Positions differ, when in doubt the stricter one is safer

Slide text

NOT CBT
where regulators' positions lean
CBT

Foreign branch of a Russian entity
a branch is no foreign person (RKN oral 29.09.2022, 01.03.2023, 27.08.2025)
transfer to a branch abroad is CBT (RKN oral 15.05.2024)

Office clouds and mail
companies in Russia using services is not CBT, Google services are not CBT (RKN Office, 26.09.2025)
work accounts with a foreign provider, clouds for processing and backup - CBT

Mail in recipient assessment
ancillary transfer to comply with Art. 12 is not notified separately
employee contacts in mail are notified CBT (RKN 01.06.2023, Digital Ministry 07.04.2023)

Employee work data
a minimal set that cannot identify is neither PD nor CBT (RKN North Caucasus Office, 2026)
identifying volume needs notification

Recommendation: in a classification dispute take the stricter position and put the flow in the notice.

TPD-006

Expert view: access by a Russian citizen abroad is not CBT

Russian citizen, foreigner, stateless person: who is a foreign person under Art. 3(11), 152-FZ

Slide text

Who gets access from abroad
CBT
Why

Russian citizen, incl. dual citizens
no
for Russia he is only its citizen wherever he lives (Art. 10(1), 138-FZ), no RKN clarifications

but he receives data for a foreign company
yes
per the expert view the recipient is a foreign entity

foreign citizen
yes
a foreign individual in the territory of a foreign state

stateless person
disputed
not a Russian citizen (Art. 2, 115-FZ), treated as a foreigner for PD, country judged by location

any of them while in Russia
no
no foreign state territory (RKN oral 22.10.2025)

Expert approach

What to check before access

confirm Russian citizenship by document and log it in the access register, else the recipient is foreign

exceptions to Art. 10(1), 138-FZ: federal law or international treaty

a foreign cloud holding data is CBT to its provider, a messenger to a Russian citizen is not (RKN oral 14.08.2026)

access goes to Russian DBs, Art. 18(5) localisation remains

Do not confuse: the data subject's citizenship does not change classification (RKN oral 15.05.2024, 22.10.2025). The recipient's territory and status decide

TPD-007

Expert view: giving a foreigner his own PD is not CBT

Russian operator, foreign subject abroad: the letter of Art. 3(11) and operator-relation logic

Slide text

Letter of law

Looks like CBT

Art. 3(11) names a foreign individual as recipient, with no carve-out for the subject

subject's citizenship does not change it (RKN oral 15.05.2024, 22.10.2025)

literally, notify before first replying to a foreigner's Art. 14 request

Regime logic

Not CBT, expert view

CBT arises in operator-to-operator relations (RKN oral 14.08.2026)

a subject holding own data for personal needs is no operator (Art. 1(2)(1), 152-FZ)

disclosure honours rights under Art. 14, 20, and Art. 12 protects the subject, not cuts him off

Where the conclusion stops working (expert view)

Others' data

the pack holds companions', relatives', co-borrowers' PD: CBT

Not the subject

a representative, employer or bank abroad is a foreign person

Operator channel

a foreign cloud, CRM or mail storing the operator's data means CBT to the provider

Transfer on request

subject's data sent at his request to a foreign company is CBT

Practice: no direct guidance. Decide deliberately whether to put the flow in the notice and log it in the register, as RKN orally (27.08.2025) calls a non-CBT description an error

TPD-008

Localisation and CBT: two separate tracks

Each data flow abroad is checked against both

Slide text

Localisation does not legalise CBT, and lawful CBT does not cure a localisation breach

STEP 1

Is Russians' PD first recorded at collection in a foreign system?

yes

Art. 18(5) breach

STEP 2

Does a foreign system keep an updated copy of the Russian DB?

yes

Art. 18(5) breach

STEP 3

Is an extract of PD sent abroad for a specific purpose?

yes

CBT, go to step 4

STEP 4

CBT procedure met: basis, recipient assessment, notice?

yes

flow is lawful

Exceptions: Art. 6(1)(2), (3), (4), (8) lift localisation but not the CBT procedure. Office clouds and Google Sheets are a localisation issue, not CBT, per RKN 2025-2026.

TPD-009

Regulator positions 2022-2024

RKN, Digital Ministry letters that set practice under the new rules

Slide text

09.11.2022 RKN, 08VM-98928
procedure

transitional notifications of CBT carried out, after 01.03.2023 - of intent

06.12.2022 RKN, 08VM-107716
procedure

Art. 12(5) assessment is the operator's call, no notice per fact or counterparty

15.02.2023 RKN, 08-12444
procedure

pre-reform CBT - notify by 01.03.2023 regardless of instruction

15.02.2023 RKN, reply to 02-11-4435
CBT

notice states the country of the foreign person's servers

27.03.2023 RKN, reply to 02-11-9606
CBT

foreign persons' access to a corporate directory is CBT

07.04.2023 Digital Min., P25-7258-OG
CBT

employee contacts in mail to a foreign mail server are CBT

01.06.2023 RKN, 08-46101
CBT

business mail contacts are CBT, notification needed

14.12.2023 RKN, 08-145976
not CBT

a Telegram channel joined by invite link is not CBT

18.04.2024 RKN, 08-119857
procedure

a new notice only for new flows: purposes or countries

26.06.2024 RKN, 08-242780
CBT

Google Analytics on a site is CBT, notice required

TPD-010

Regulator positions 2025-2026

Metrics, clouds, messengers: the CBT-localisation line

Slide text

24.03.2025 RKN, 08-134789 and 08-169079
procedure

Art. 18(5) does not limit CBT of PD collected in Russia, Art. 12 stays

12.05.2025 Digital Min., P25-44929
CBT

foreign metrics tools are CBT, copies kept in Russia

03.07.2025 Digital Min.
not CBT

messages via a foreign messenger to users in Russia are not CBT

16.07.2025 RKN Central FD Office
procedure

the country list is built on Convention 108 criteria

04.08.2025 RKN, 08-373883
CBT

foreign metrics are CBT, allowed if Art. 18(5) is met

19.08.2025 RKN Volga FD Office
not CBT

Telegram is no processor, channel posts are not CBT

26.09.2025 RKN Office for Perm Krai
not CBT

Google services: not CBT, localisation needed

01.11.2025 RKN, reply
not CBT

Google Sheets with PD collected earlier: not CBT, notice not considered

2026 RKN North Caucasus Office
not CBT

work data without identification is not CBT

14.08.2026 RKN, open day
procedure

operator to operator, registration and server country together, ban for any country

TPD-011

How CBT regulation evolved

From written consent to notice and recipient assessment

Slide text

25.07.2011

261-FZ

border crossing removed from the definition

14.07.2022

266-FZ

new CBT procedure, from 01.03.2023

05.08.2022

RKN Order 128

adequate country list

29.12.2022

Res. 2526

cases without notice

10.01.2023

Res. 6

decisions on agency submissions

16.01.2023

Res. 24

RKN decisions on notices

01.03.2023

Start

notices of intent

26.07.2026

265-FZ

adequacy only per RKN list

16.09.2026

RKN Order 253

88 states, from 30.10.2026

Until 01.03.2023: to non-adequate countries - with written consent, no RKN notice
From 01.03.2023: basis under Art. 6(1), recipient assessment, notice of intent before transfer starts

TPD-012

Russian CBT regime among global models

Midway between the EU's contract logic and China's administrative logic

Slide text

contract safeguards
administrative approval

EU, GDPR
Russia, 152-FZ
China, PIPL

Adequacy
European Commission decision, transfer equals domestic
RKN list, but recipient data and notification are needed for any country
no adequacy institution

Safeguards
SCC, BCR, codes, certification (Art. 46-47 GDPR)
no SCC or BCR in law, replaced by list, recipient assessment, notification
model contract, certification

Regulator
authorisation only for some safeguards, after Schrems II - transfer impact assessment
notice of intent before transfer, ban or restriction by RKN decision
security assessment by the regulator for CII, big operators (Art. 40 PIPL)

Localisation
no general rule
initial collection into Russian DBs (Art. 18(5))
for CII and big data operators

Practical takeaway: European tools do not work directly in the Russian regime, and for transfers from the EU to a Russian company, SCC and an impact assessment are expected.

20.2

CBT procedure and recipient assessment

Country category, recipient data and ban risks

TPD-013

Not all jurisdictions help equally

RKN list category and friendliness are different axes

Slide text

On list, friendly

EAEU, Azerbaijan, Serbia, Argentina, Brazil, Mexico, Malaysia, China, India, Vietnam, South Africa, Singapore, Israel, Turkey, Qatar

Off list, friendly

UAE, Bahrain, Iran, Bolivia, Venezuela, Egypt, Philippines, Hong Kong (China)

On list, unfriendly

EU, UK, Switzerland, Norway, Australia, New Zealand, Canada, Japan, South Korea

Off list, unfriendly

USA, Taiwan (China)

on RKN list: start after notification
off list: start after 10 working days

friendly

unfriendly (430-r)

Sample countries. Unfriendly status (430-r) and list 2560-r do not change the Art. 12 category but raise the ban risk. RKN Order 253 cuts the list to 88 states from 30.10.2026, Ukraine out.

TPD-014

265-FZ of 26.07.2026 and the new list

In force from 26.07.2026: Convention 108 membership alone gives no adequacy

Slide text

Until 26.07.2026

adequate: Convention 108 parties and RKN list countries

Convention parties had a separate clause in Art. 12(5)(2)

list - RKN Order 128: 89 states, 55 Convention parties and 34 outside it

From 26.07.2026

single benchmark - the RKN list, Convention removed from Art. 12(5), (10), (11)

inclusion test: regulation and measures applied conform to the Convention

ban or restriction under Art. 12(7), (8), (12) possible for any country, as before (RKN 14.08.2026)

Order 128 applies until 30.10.2026, then Order 253, and Convention parties are adequate only if on the list

COUNTRY LIST NOW

89
states in RKN Order 128, valid until 30.10.2026, USA and UAE not included

88
states in RKN Order 253 of 16.09.2026, Ukraine removed

253
order published 19.10.2026, in force 30.10.2026, Order 128 lapses

To do: inventory routes that relied on a country's Convention membership, check the country against Order 253 from 30.10.2026, apply the off-list procedure to transfers to Ukraine and assess the fate of notices already filed.

TPD-015

CBT rules from 01.03.2023

Country category sets the data needed and the start time

Slide text

Intent to carry out CBT

Country on RKN list
Off-list country
Res. 2526 cases

Data from recipient

name and contacts

confidentiality assurance

security measures

conditions to end processing

RKN notice, Art. 12(4)

start right after notification

Data from recipient

name and contacts

confidentiality assurance

security measures

conditions to end processing

country's PD legal regulation

RKN notice, Art. 12(4)

start only after 10 working days

16 cases: no notice is filed at all

4 cases: sport, culture, science, payments, telecoms - notice, no ban right

RKN may ban on its own initiative (Art. 12(8)) and on agency submission (Art. 12(12), Res. 6)

RKN review: 10 working days, +15 if assessment requested (Res. 24 p.13)

Ban or restriction: stop and ensure destruction
No decision: transfer starts or continues
Detailed scheme on Yandex Disk

disk.yandex.ru/d/WoTRd6ywxvC6yQ

TPD-016

CBT: procedure from 01.03.2023 and 2026 changes

Recipient assessment, notice and a 10-working-day wait

Slide text

1. Basis

Art. 6(1). Portal form has 7 bases, others on paper. Employment contract is no basis

2. Recipient review

safeguards and end terms, off-list countries: law review, assessment act

3. RKN notice

not the Art. 22 notice: purposes, categories, countries, assessment date

4. 10 working days

review, request for recipient data: reply in 10 days, extension 5

5. Start

listed countries right after notice, others after the period with no ban

Ban or restriction

possible for any country, listed ones too (RKN, 14.08.2026)

grounds for a regulator decision - closed list in Res. 24, interagency submissions - Res. 6

Res. 2526: no notice in 16 cases, in 4 more - without a ban right

on a ban the operator must ensure destruction at the recipient: only a contract clause covers this

265-FZ of 26.07.2026

listing is by law and measures matching Convention 108, membership alone is no longer enough

the list changes by order, so the operator tracks the country category itself

no separate offence for not notifying CBT: Art. 13.11(1) is charged, sometimes (10), main risk - ban and order to remedy

TPD-017

Notice review deadlines

When transfer may begin

Slide text

working days from notice receipt

Review
base period 10 days
+15 on assessment request

Listed country
transfer allowed right after notice

Off-list country
no transfer
allowed if no decision

Incomplete data
reply 5 days
3 days

Incomplete data: review is suspended, operator replies in 5 working days, resumes within 3 working days at most

Decision comes by letter

with grounds and recommendations, no reply - no decision

5 working days

on agency submission, Res. 6

Re-filing

after causes are fixed, 10+ working days after the decision

TPD-018

What to get from a foreign recipient

Art. 12(5) data are gathered before filing the notice

Slide text

All recipients

full name and contact details

PD confidentiality assurance

processing security measures

description of end-of-processing terms

Plus, off-list countries

PD law in the recipient's country

PD legislation

oversight of processing and protection

liability for violations

joining international PD treaties

other issues RKN expects

END-OF-PROCESSING TERMS WORTH RECORDING

purposes met, retention period over
unlawful or excessive PD
consent withdrawal or subject demand
authorised person's request
other contract terms

Assessment is the operator's job (RKN 06.12.2022): its date in the notice cannot be after filing.

TPD-019

Recipient security measures

Scope depends on whether the recipient acts on instruction

Slide text

CBT, NO INSTRUCTION

5 core measures

1
identifying PD security threats

2
legal, organisational and technical measures

3
restoring PD after incidents

4
regular control of effectiveness

5
confirmed PD destruction

CBT WITH INSTRUCTION: 23 MEASURES, ART. 18.1, 19

Organisation

DPO, policy, internal regulations, breach procedures, internal control, harm assessment

Information system protection

threats, measures, security tools, effectiveness checks, access rules, logs, control, owner

Media, premises, people

storage and media records, separate DBs, premises regime, access list, training

Incidents, destruction

attack response, recovery, destruction with confirmation

TPD-020

Ways to obtain data

From open sources to expert review: deeper means more reliable

Slide text

Recipient policies

public PD and IS texts with a snapshot and date

Contracts

draft and signed processing or transfer contracts

Document request

PD protection papers, off-list countries - on national law

Interview or form

the operator picks the request form (RKN 15.05.2024)

Legal expertise

analysis of off-list country law, in-house or external

depth and reliability

Record process and result: a recipient's refusal or silence is also a result.
Shift the work to the recipient: the contract obliges it to prepare the data and report changes.

TPD-021

CBT risk management

Ban, restriction and start delay are identified before the notice

Slide text

Ban

Res. 24, para. 23

the recipient does not protect PD or set destruction terms

recipient is an organisation banned in Russia

recipient is an undesirable NGO

CBT conflicts with purposes

CBT not covered by Art. 6(1)

Restriction

Res. 24, para. 26

PD content and scope do not fit the purpose

subject categories do not fit the purpose

Start delay

practice

no Art. 22 processing notification

country off RKN list

biometrics, special categories, depersonalised PD, minors

basis missing from the e-form - file on paper

CBT purpose differs from collection

4 ways

to manage

reduce

refuse

transfer

accept

First, check earlier decisions banning or restricting CBT (Art. 12(8), (12), Res. 6).

TPD-022

If RKN bans or restricts CBT

Decision effects and the operator's remedies

Slide text

RKN decision: letter with grounds

Ban

the planned transfer is not possible in full

Restriction

transfer with adjusted purposes, subjects and PD scope

Ensure the recipient destroys the PD (Art. 12(14)): the lever is only contractual, so set the destruction procedure and confirmation in advance.

REMEDIES

Appeal

to a court or a superior official, complaint within a month

Repeat notice

after causes are fixed, 10+ working days after the decision

Decision on submission

under Res. 6 - ask the submitting agency for removal

TPD-023

Genetic data: a separate regime from 01.09.2026

Res. 750 of 15.06.2026 under Art. 13.1, 13.2, 86-FZ

Slide text

Population genetic and immunological study data is not passed to foreign persons, their branches and representatives, even inside Russia, except in rare cases by commission decision.

1 Free

care for a specific patient, drugs and BMCPs for a patient with a medical licence, international cooperation

no approval

2 Notification

population studies publishing summary indicators

notify the commission at least 20 working days ahead

3 Permission

other cases

commission decision in 15 working days, may be extended

Government commission

headed by the deputy PM for health, run by FMBA, no fee charged

Refusal by closed list

incomplete data, risks to citizens' rights, biosafety risks

Alongside Art. 12, 152-FZ

via the commission data go in depersonalised form

20.3

Notification of intent

Content, purpose, errors and support

TPD-024

Content of the notice of intent

Eight items under Art. 12(4), 152-FZ, no separate form formally approved

Slide text

Notice of intent to carry out CBT

1
Operator's name and address

2
Date, number of processing notice

3
Name, contacts of the DPO

4
CBT legal basis and purpose

5
Categories and list of PD sent

6
Subject categories

7
List of foreign states

8
CBT assessment date

BASES IN THE E-FORM

subject's consent

international treaty or law

justice and enforcement proceedings

enforcing an authority's act

contract with subject

journalism and media

statistics and research

No legitimate interest in the form: such a basis is declared on paper, delaying the start.

The assessment date cannot be later than the filing date, and a notice does not replace the legal basis.

TPD-025

How to word the CBT purpose

A purpose states why data is sent, not a rule or a basis

Slide text

Wrong

Compliance with Russian law
too vague

Labour Code
act, no norm

Data subject consent
basis, not a purpose

Processing PD of staff and clients
mixed subjects

Right

Booking tickets and hotels for employees' business trips
employees

Preparing reports on management body composition for the parent company
body members

Analysing site traffic with a web analytics service
site visitors

ERP technical support by a foreign contractor
ERP users

One purpose - one subject category

employees apart from clients

Macro-purpose via micro-purposes

by process and recipient

Employees: basis is disputed

RKN 2024 - Art. 88 Labour Code,

2025-2026 - business trips need no consent

TPD-026

Common errors in CBT notices

Seven errors per RKN and nine from practice

Slide text

ROSKOMNADZOR

7 common errors

1
excessive PD transferred

2
PD do not match purpose

3
recipient assessment date later than the filing date

4
incomplete Art. 12(4) item list

5
purpose worded vaguely

6
acts cited as purpose, no rule given

7
legal basis given as purpose

t.me/rkn_tg/724

Inventory

not all CBT cases found, recipient server country ignored

CBT change plans not counted

CBT not told apart by instruction and by listed or off-list country

Recipient review

excessive data request or a form as the only method

CBT admissibility treated as assessing a single recipient

assessment process and results not documented

Documents

the contract lacks CBT terms and PD destruction on a ban

no current notice under Art. 22(1)

CBT basis not matched to purpose and subject category

TPD-027

Filing the notice

E-form on the PD portal or paper, one notice per line of activity

Slide text

1 PD portal

pd.rkn.gov.ru, cross-border transfer section

2 Filling in

RKN sample, Art. 12(4) fields

3 Signing

e-signature or printout sent by post

4 Waiting

decision comes by letter, no letter - no decision

One notice per activity line

a set of purpose, countries, categories, volume - not each fact or counterparty (RKN 06.12.2022)

Register not a precondition

a CBT notice can be filed without a processing notice, but lacking it is a separate violation

Syncing three documents

CBT notice, processing notice and policy agree on purposes, PD, subjects and the transfer

Notice is not a basis

lawful transfer rests on a basis from Art. 6(1), a notice does not replace it

Form: pd.rkn.gov.ru/cross-border-transmission/form2 Sample: pd.rkn.gov.ru/docs/primer_zapolnenija_uvedomlenija_TPdn.pdf

TPD-028

How to notify of CBT changes

No change procedure in 152-FZ or on the PD portal

Slide text

What changed?

New purpose or new country

new notice for the changes only

RKN 18.04.2024, 08-119857

New categories or PD scope

a whole new notice, even for a minor change

RKN 15.05.2024

Fewer purposes, countries, termination

a whole new notice, for termination an information letter

RKN 15.05.2024

New recipient only

no notice needed, Art. 12(5) data are requested again

RKN 15.05.2024, 14.08.2026

Tip: build foreseeable plans into the notice, and record the decision to file or not file a new one in the register of cross-border flows.

TPD-029

RKN on the new CBT procedure

RKN webinar replies 15.05.2024, updates 14.08.2026

Slide text

?
Which country to state?

2024: the recipient's registration country. From 14.08.2026 both registration and server country count.

?
When to file a new notice?

New purpose, country or PD categories, and fewer purposes or countries - in full too.

?
How to request data?

Operator picks the form: letter, questionnaire, interview or recipient documents.

?
Foreign branch of a Russian entity?

In 2024 RKN saw a transfer to it as CBT, in 2022, 2023 and 2025 it said otherwise.

?
Only the recipient changed?

No new notice is needed, but the new recipient's Art. 12(5) data are requested afresh.

?
Can CBT to an adequate country be banned?

Yes, Art. 12(7), (8), (12) bans and restrictions ignore country category (14.08.2026).

TPD-030

Refile notices for the new country list?

Decide for each activity line and document it

Slide text

For refiling

ends doubt about a notice when the country category changes

updates purposes, PD scope and countries, incl. recipient server country

syncs the notice with the updated recipient assessment

Against

law requires no new notice if purposes, countries, PD scope are unchanged

Order 128 applies until 30.10.2026, reasons for removing Ukraine not published

for an off-list country new transfers start only after the review period

A list change does not ban transfer

For a country removed from the list, the start of new transfers changes (after the 10-working-day review) and so do the recipient data: the country's PD legal regulation is added.

TPD-031

Incidental CBT: notify about correspondence?

Staff contacts inevitably go abroad during recipient assessment

Slide text

Operator question

Business correspondence with a foreign recipient to gather data on its safeguards sends operator employees' contacts abroad.

Is a separate notice needed or is this transfer merely incidental?

Author's view: incidental CBT for Art. 12 need not be singled out, but regulators are stricter.

REGULATOR POSITIONS

07.04.2023 Digital Min., P25-7258-OG
CBT

employee contacts in mail to a foreign mail server are CBT

01.03.2023 RKN, oral
partly

phone numbers alone are not CBT, e-mail addresses are CBT

01.06.2023 RKN, 08-46101
CBT

contacts in business mail with a foreign person are CBT with notice

2026 RKN North Caucasus Office
not CBT

minimal work data that cannot identify are not CBT

Safe option: list business correspondence with foreign counterparties in the notice as a separate purpose.

TPD-032

Setting CBT terms in the contract

The contract is the operator's only lever on a foreign recipient

Slide text

Cross-border PD transfer agreement

1.
Subject. CBT purposes, PD scope, subject categories

2.
Art. 12(5) data. duty to provide them and report changes

3.
Safeguards. confidentiality and security measures

4.
Incidents. immediate report to the operator, who has 24 and 72 hours

5.
RKN ban. stop the transfer and destroy PD under Art. 12(14)

6.
Destruction. deadlines, procedure and confirmation

7.
Onward transfer. only with the operator's consent

8.
Instruction. Art. 6(3) terms if the recipient is a processor

DTA

Recipient as an independent operator: sets the purposes and means of processing and answers to the subject itself.

DPA

Recipient acts on instruction: a foreign processor is jointly liable with the operator to the subject (Art. 6(6)).

No contract, no way to ensure PD destruction after an RKN ban: set procedure and confirmation in advance.

TPD-033

Cross-border flow register

An internal document linking Art. 12 to evidence of compliance

Slide text

Transfer
Review
Notification
Control

Stream	Country, category	Recipient	Purpose	PD, subjects	Review	Notification	Revisit
Web analytics	USA, off list	Google LLC	site traffic analysis	identifiers, cookies, visitors	policy, DPA	no decision, start after 10 days	annually
Group reporting	Germany, on list	parent company	reports on body composition	name, position, body members	document request	start now	when body changes
ERP support	India, on list	contractor	ERP support	name, login, users	form, contract	start now	on contractor change

sample entries

SYNCING THREE DOCUMENTS

CBT notice
Processing notice
Website policy

Purposes, PD, subjects, transfer fact match in all three documents.

A separate register is optional: just add CBT fields to the record of processing.

20.4

Case law and liability

RKN statistics, sanctions, rulings

TPD-034

Liability for CBT procedure breaches

No separate offence for not notifying CBT, classification varies

Slide text

up to ₽5k

Art. 19.7 CAO

no notice or improper notice

up to ₽20k

Art. 19.5(1) CAO

failure to obey an RKN order

up to ₽100k / ₽300k

Art. 13.11(1), (1.1)

CBT with no basis or beyond purposes

up to ₽300k

Art. 13.11(10)

no notice, prosecutors' practice

₽1m to ₽6m

Art. 13.11(8)

flow also breaks localisation

criminal

Art. 272.1 Crim. Code

unlawfully obtained PD

An RKN order to suspend or ban CBT (Art. 23(3)(4), 152-FZ) plus reputational harm.
Classification risk: one failure to notify is assessed under Art. 13.11(1), (10) or (8) and Art. 19.7.

TPD-035

Practice 2024-2026

Prosecutors, courts, Constitutional Court on CBT breaches

Slide text

18.06.2024
Magistrate, precinct 351, Moscow

prosecutor: CBT of employee data, consent issues, Art. 13.11(2)
₽100k fine

08.09.2025
Bashkortostan Arbitrazh Court, A07-27941/2025

prosecutor: children's trips abroad without CBT notice, Art. 13.11(10)
warning

2026
Magistrate, precinct 113, Abinsky District

foreign platform on the administration site, charged Art. 13.11(8)
₽100k official

09.06.2026
Moscow Arbitrazh Ct, A40-325054/2025, Taobao

localisation, Art. 13.11(8), Art. 12 in reasoning, appeal 29.09.2026
₽1m fine

30.06.2026
Const. Court, No. 2027-O, case A40-238444/2024

provider's move of customer data to foreign servers is abuse of right
complaint declined

TPD-036

Criminal risk: Art. 272.1

Unlawful use and transfer of computer data with PD, since 11.12.2024

Slide text

OFFENCE

Part 1

use, transfer, collection and storage of unlawfully obtained computer data with PD

Part 4

the same acts linked to CBT or cross-border carrying of media - an aggravating feature

note 2

carrying media - import or export of a machine-readable PD medium, even if not handed to a foreigner

BOUNDARY WITH ADMINISTRATIVE LIABILITY

CAO

breach of the procedure for lawfully obtained PD: no notice, basis, assessment

Crim. Code

data obtained unlawfully, and CBT or taking out a medium aggravates liability

What to do

confirm the lawful source of PD, especially bought or received from partners

keep records of PD media and encrypt travel laptops

do not use exports of unconfirmed origin for CBT

TPD-037

CBT roadmap

Six steps repeated at every change of flows

Slide text

Lawfulness

a state,

not an event

Inventory

flows from processes, systems, incl. access from abroad

Data

Art. 12(5), from each recipient

Analysis

basis, country category, ban risks

Notification

and the wait for off-list countries

Contract, register

DTA or DPA, document sync

Monitoring

changes in flows, country list, RKN positions

20.5

Workshop

Eight situations and a roadmap

TPD-038

Workshop: classify the situations

Is there CBT, is a notice needed, is localisation breached?

Slide text

1
An online shop uses Google Analytics

2
A parent company auditor from Germany gets remote access to the HR system in Russia

3
A Russian employee on a Kazakhstan trip opens the CRM in Russia

4
Sales keeps a Google Sheet of clients exported from the CRM in Russia

5
The company posts news with employee names in its Telegram channel

6
A pack of corporate documents with directors' PD is sent to the US head office

7
A clinic sends a patient's genetic data to a foreign laboratory to choose treatment

8
Transfer to the Armenian branch of a Russian company, not a legal entity under local law

TPD-039

Workshop: answers

Qualification and basis for each situation

Slide text

1
CBT
CBT with notification, plus a localisation breach if PD reach the service before the Russian DB
RKN 04.08.2025 No. 08-373883, 22.01.2026

2
CBT
CBT, Germany is on the list: transfer possible right after the notification is sent
Art. 3(11), Art. 12(3), (10)

3
not CBT
not CBT: the recipient is not a foreign person
Art. 3(11)

4
localisation
not CBT per RKN's position, but a breach of Art. 18(5)
RKN 01.11.2025, 12.01.2026

5
not CBT
not CBT: dissemination to an indefinite group, but consent to dissemination is needed
Art. 3(5), (11), Art. 10.1 of Law 152-FZ

6
CBT
CBT, USA not on the list: transfer only after a 10-working-day review
Art. 12(11), RKN Order No. 253

7
Gov. Res. 750
Gov. Res. 750: free route with a medical licence, plus Art. 12 as regards PD
Res. 750, Art. 12 of Law 152-FZ

8
disputed
disputed: RKN 01.03.2023 and 27.08.2025 - not CBT, 15.05.2024 - CBT
oral RKN positions

TPD-040

Key takeaways

Slide text

CBT is a transfer from Russia to a foreign person in a foreign state; crossing the border is not a criterion, and grey areas are resolved strictly.

Before transfer: a basis under Art. 6(1), recipient data under Art. 12(5), notification; off-list countries wait 10 working days.

Law 265-FZ left one benchmark, the RKN list, and any country can be banned or restricted.

A flow register, a recipient contract and aligned documents turn a one-off notification into lasting compliance.

t.me/prv_adv