PD regulatory trends

Diagram labels in Russian

• 2020
• 2022
• 2023
• 2024

Liability

• 260-FZ foreign PD collection
• 277-FZ foreign messengers
• 78-FZ spam calls, Art. 14.3 CAO

420-FZ turnover fines for leaks

421-FZ PD trade, Art. 272.1 Crim. Code

• Processing
• 519-FZ dissemination of PD

233-FZ depersonalisation, NSUD

Identity and biometrics

• 572-FZ biometrics and UBS
• 406-FZ website authorisation

408-FZ recommender technologies

589-FZ biometrics fines

• Control, supervision
• 540-FZ control reform, Res. 1046

• 2025
• 2026

• Liability
• 104-FZ
• Art. 13.12 CAO fines

• 281-FZ
• Arts. 13.29.2, 19.5.3 CAO

• 508-FZ
• 13.11 cases back in general courts

• 199-FZ
• Arts. 13.55, 13.56 CAO

• Antifraud
• 41-FZ
• Antifraud-1

• 156-FZ
• separate consents

• 210-FZ
• Antifraud-2

• Localisation and CBT
• 23-FZ
• localisation 2.0, siloviki PD

• 140-FZ
• forwarders' client PD

• 351-FZ
• research and surveys

• 43-FZ
• genetic data

• 265-FZ
• new adequate-country list criterion

State access and AI

• 244-FZ
• data centre rules

• 492-FZ
• database copies for FSB

• 52-FZ
• genomic registration

• 55-FZ
• MVD address certificates

• 130-FZ
• AI images in campaigns

• 243-FZ
• AI support

₽3-20m

Art. 13.11 CAO: leaks

or 1-3% of annual turnover for a repeat leak, ₽1-3m for failing to notify RKN; the article now has eighteen parts (420-FZ).

923 cases

Art. 272.1 Crim. Code

in 10 months of 2025, mostly data peddlers and insiders; for leaks top managers are still tried under Art. 274 Criminal Code (Sirena-Travel, retrial).

up to ₽100k

Art. 13.12 CAO

for breaching information protection rules, plus confiscation for uncertified tools (104-FZ, 23.05.2025).

01.01.2026

Back to general courts

all Art. 13.11 CAO cases are again heard by general courts (508-FZ); arbitrazh courts took PD cases only from 30.05.2025.

Plan 2207-r, item 4: by Q3 2027 the MVD, Ministry of Digital Development, Ministry of Economic Development, FSB and RKN will propose higher liability and a longer limitation period for PD violations.

01

Localisation concept

The core concept for PD collection is unchanged but reworded: a ban on recording, accumulating and storing in foreign databases.

02

When collection ends

A reasoned, provable determination of when PD collection ends and Art. 18(5) of Law 152-FZ stops applying becomes critical.

03

Foreign databases

Do not place PD collected in Russia in controlled foreign databases, and do not admit using such databases to process it.

2026 practice: foreign players

At least 7 RKN claims against foreign gaming companies (EA, Take-Two, NetEase, Battlestate Games, Embracer - ₽1-2m each), fines for Duolingo and Miro (₽2m each), Change.org (₽1m), SSI International (₽6m for repeat).

PERSONAL LIABILITY

In Kuban a district administration official was fined ₽100k for a foreign platform in site code; banks and MFIs faced 21+ cases under Art. 13.11.2 CAO for WhatsApp correspondence with clients.

Still PD

Depersonalisation: actions after which PD cannot be attributed to a data subject without additional information (Art. 3(9) of Law 152-FZ).

Not destruction

Art. 21(4) requires destruction at purpose end; Art. 5(7) also allows depersonalising.

Special requirements

RKN order requirements and methods apply to the depersonalisation process and methods.

NSUD transfer demand

From 01.09.2025 (Art. 13.1, 152-FZ) operators may be told to depersonalise PD and send it to the GIS EIP NSUD.

DIGITAL MINISTRY ORDER 03.03.2026 No. 173

Guidelines for preparing depersonalisation demands approved; draft Government Resolution (07.05.2026) allows sending statistics without special software or SMEV; business (Big Data Association, BDA) asks to defer to 2027.

BDA initiative, 03.08.2026

Allow PD processing with privacy-enhancing technologies (PETs) without data subject consent to train AI models.

01

Visual and semantic separation

Consent is separate from other documents: user agreement apart, consent apart.

02

Separate act of will

Consent given by a separate action: e.g. its own tick box, not a signature under a general document.

03

Approved forms

Forms approved by acts of public authorities (e.g. for the UBS) are mandatory (RKN orally, 22.08.2025, 14.08.2026).

Supreme Court, 22.06.2026

Ad consent in return for a discount is lawful

Melon Fashion Group case: consent to ads in exchange for a discount is valid; the seller need not give a discount without consent.

DRAFT RKN INSPECTION LIST, 03.08.2026

77 questions, not 75

5 new questions: consent criteria and separation, destruction on reaching purposes, notice per purpose. 3 dropped, incl. question 33 on organisational measures. Still a draft in early October 2026.

High

2-yearly inspection or annual preventive visit

Significant

mandatory preventive visit max. every 3 years

Medium

mandatory preventive visit max. every 5 years

Moderate

• mandatory preventive visit max. every 6 years
• Low

no planned checks or preventive visits

Severity group A now includes PD processing based on consent where the law does not require it; probability groups are aligned with Arts. 13.11, 13.11.2, 13.11.3 CAO.

2026 visit plan (RKN order 19.12.2025 No. 390): 1156 operators incl. state bodies, schools and medical centres; check your risk category in the Unified Register of Control Types.

Remote oversight: after a no-contact action, an operator may receive not only a caution but also a demand to destroy PD.

89%

accuracy of automated violation detection

500k

resources a year per spec (actually ~50k), 15k+ a week

77% / 84%

resources with signs of violations in 2024 and H1 2025

8k

demands to bring sites into compliance in H1 2025 (6.5k in 2024)

WHAT IT LOOKS FOR

Who is inspected first

Financial and credit institutions, insurers, collectors, social networks, telecoms, online shops, carriers, postal services, medical and educational bodies, utilities and housing managers, MFCs, authorities - sectors with the most citizen complaints.

Targets: banks, telecoms, state bodies, schools, hospitals, digital services, housing and utilities, individuals.

Over 57% of cases ended in a warning (first offence, guilt admitted, violations remedied); initiators - Roskomnadzor (72%), prosecutors (28%).

Key rulings: a reviewer's name and address may not be PD, and an intermediary is not liable for others' content until it learns of a violation (Moscow AC, 07.11.2025); passing employee PD to an accountant and a landlord for a pass needs no consent (Savelovsky Court, 02.07.2025).

No large fines under the new Art. 13.11 CAO offences were recorded in 2025.

244

rulings: 73 magistrates, 83 arbitrazh courts, 29 district court reviews, 59 appeals and cassations

77 / 44

fines and warnings at first instance: magistrates gave three warnings, arbitrazh courts 41 of 64

₽150k

median fine under Part 1 before magistrates; arbitrazh median ₽75k

₽6m

eight fines on foreign operators for repeat non-localisation (Part 9)

Targets: foreign operators (30 rulings, diving associations PADI, NAUI, SNSI, AIDA), utilities (30), telecoms (26), public sector (18), leaks (17), banks (14), schools (11), clinics, collectors, insurers.

Initiator: Roskomnadzor in 234 rulings, prosecutors in 7; in the other 3 none is named or the dispute is private.

Review: 88 rulings of district courts, appeals and cassations: 60 upheld, 10 remitted for retrial, 15 set aside in whole or in part (6 with discontinuation), 3 other outcomes.

Shift of the year: two sanction tracks: magistrates almost always fine (three warnings in St Petersburg in May and one release for insignificance, Art. 2.9 CAO, in Moscow in June 2026), arbitrazh courts replace the fine with a warning in two cases of three; only non-localisation brings big sums.

RZD CASE - MOSCOW DIST. AC, 10.06.2026

A leak alone does not prove operator fault

RKN must prove what measures the operator could but did not take; an attack and an Art. 272.1 Criminal Code case do not prove inadequacy.

MINTRUD AND ROSTELECOM - 2026

A contractor does not relieve the operator

Supreme Court, 21.01.2026: failure to notify RKN and lack of internal control counted against the operator. NW AC, 02.10.2026 (Rostelecom): operator answers for its contractor (Art. 6(5)), a leak is continuing, the refusal stood only by limitation.

ORION TELECOM, TD ASK - 2025-2026

Switch to a warning is not guaranteed

Self-notifying RKN, SME status and a first offence helped, but 4th AAC (11.08.2026) called the Part 13 swap unjustified, kept only by limitation. An investigation report hurts the operator.

LOCALISATION - 2026

Wave of claims against foreign firms

Gaming companies, Taobao (₽1m, appeal 29.09.2026), Duolingo, Change.org, Miro and SSI International; a district administration official was fined for a foreign platform in site code.

2007

Deciding to consent

Own will, own interest, freely

2011

Expressing consent

Specific, informed, conscious

2022

Expressing consent

Substantive, unambiguous

2025

Form of consent

Separate from other documents (156-FZ)

Result: the more features one document must combine, the easier it is to challenge and the costlier to administer; the regulator itself calls the institution obsolete.

The institution of consent to personal data processing is morally obsolete... A transition from the current model to industry standards is needed...

Head of Roskomnadzor Andrey Lipov, 31.10.2025

Deputy Head of RKN Milosh Wagner, 30.06.2025

1

consent is listed first among equal bases and is apparently wrongly seen as the main one

2

it is easy to obtain, carries no legal or administrative risk for the company, and on withdrawal the company easily finds another basis

06.2026

not enacted

Antifraud-2 (210-FZ)

ESIA consents, Gosuslugi complaints and a register of all consents were discussed but dropped from the final text.

30.09.2026

back in the draft

Antifraud-3

Consent and withdrawal via ESIA, all consents recorded in ESIA, viewing and complaints via Gosuslugi; block removed on 19.08.2026.

22.07.2026

set out in the draft

ICT Doctrine

ESIA-based consent platform, fewer cases of processing by consent, identification without transferring PD. Basis until 2030, rollout in 2030-2035.

2026

deputies' initiatives

Consent withdrawal

Single withdrawal service on Gosuslugi (01.04.2026) and withdrawal in the same form as the consent (21.02.2026).

Costs and risks of deprioritisation: higher standards for obtaining/withdrawing consent and more scope to challenge it (Art. 9(1), Law 152-FZ); consent not required by law - severity group A (Gov. Res. 1046), and Antifraud 3.0 bans demanding it (Art. 18(2.1)); cost of integrating consent records with ESIA/Gosuslugi

Government: cases, procedure and scope of data

• Data subject
• PD operator

gives/withdraws consent via ESIA Art. 9(1.1), (2.1)

sees on Gosuslugi who processes PD by consent Art. 14(7.1)

reports to ESIA direct consents and withdrawals Art. 9(1.2), (2.2)

may not demand consent beyond law and industry acts Art. 18(2.1)

RKN: complaints via Gosuslugi (Art. 17(1.1)), model consent forms with the Digital Ministry (Art. 9(1.3))

For the operator: consents and withdrawals are tracked in two channels; direct ones are reported to ESIA. Consent to dissemination goes only to the operator, the RKN system channel is abolished (Art. 10.1). In finance the procedure is agreed with the Bank of Russia; effective 01.03.2028.

2025 One consent to rule them all: a universal, "safe" basis that is easy to obtain and easy to replace.

2026-2028

Consent

Exception to the rule

Limited set of scenarios, stricter requirements for form, execution and records.

Contract

A means, not an end

Prohibited terms, strict consumer regulation, risk of invalidity.

Legitimate interest

Grey area

No balancing mechanisms: processing with an imbalance of interests needs prior filtering.

Obligation

Public-law basis

Industry standards, state data lakes, official orders and requests gain weight.

SCENARIOS WHERE CONSENT FITS

Antifraud-3 (draft 30.09.2026): consent and withdrawal via ESIA, and demanding consent not provided for by law or an industry act is banned (Art. 18(2.1)).

Supreme Court, 22.06.2026: consent to ads for a discount is lawful (Melon Fashion Group case).

Open question: consent to PD processing does not equal consent to instruct a processor (?)

BANNED CONTRACT TERMS WITH A DATA SUBJECT

Consumer regulation: strict rules on concluding, performing, amending and terminating consumer contracts.

Risk of invalidity: unlawful, sham, feigned or exploitative PD processing terms.

Subject issue: can PD processing be a stand-alone subject of a contract.

Antifraud-3: the listed terms are expressly banned by the new Art. 6(1)(5), and the contract must follow the industry act.

• Russian law has no mechanism to assess and balance legitimate interest: results are unpredictable and unrepeatable.
• Legitimate interest is a grey area: relying on it gives no assurance, and plainly unlawful processing can hide behind it.
• Processing with an imbalance of interests needs negative pre-screening, plus extra safeguards for data subjects.

Confirming inapplicability

Art. 6(1)(7), 152-FZ

three filters processing must pass before relying on legitimate interest

• 1
• Permissibility bases filter

• 2
• Entitlement norms filter

• 3
• Proportionality processing filter

Download

Milosh Wagner, 30.06.2025

"Strict industry standards must set the list of PD and processing periods needed by this very business in this very sphere, which will remove the need to obtain a person's consent to processing. They will be developed by sector agencies: healthcare, education, finance, utilities and others - in agreement with Roskomnadzor".

Q4 2026

Plan 2207-r, item 1

Agencies will define the PD volume business needs and submit proposals to the Government.

22.07.2026

Draft ICT Doctrine

Less PD in circulation via new approaches to processing and identifying citizens.

19.08.2026

Initiative

Limit booking services' storage of passenger PD after transfer to state systems.

POSSIBLE STRUCTURE OF A MODEL STANDARD

01

Process and parameters

purpose, basis, subject categories, PD white and black lists, sources, periods, destruction, transfer

02

PD security

model lists of organisational, legal and technical measures

03

Subject rights

requirements for exercising data subject rights

Who adopts: federal bodies responsible for policy and regulation in their field must (Art. 4(2.1)); regions, municipalities and the Bank of Russia may (Art. 4(2.2)).

PD scope

actions (operations)

RKN agreement up to 60 days (Art. 4(3.1))

Do not demand consent unless the law or an industry act provides for it (Art. 18(2.1)); the consent itself must match the act.

Contract under the act: no terms restricting subject rights, on cases of processing minors' PD or on inaction as a condition of conclusion.

Legitimate interest in an act: the industry act also sets PD scope and actions for such purposes.

Explanatory note: reduce cases of excessive collection of personal data on the basis of consent (beyond what operators need for their business activities).

Milosh Wagner, 24.09.2025

"We now see just two obstacles to special operators: large companies providing personal data protection services are booked up far ahead, and it makes no economic sense for them to serve the SME segment at a lower price. The state may impose a social obligation at some point. And probably will. But business must get there itself: however large it is, its country's citizens' data leaks".

PLAN 2207-r, ITEM 4

By Q3 2027 the MVD, Digital Development and Economic Development Ministries, FSB and RKN will propose higher liability and a longer limitation period for PD violations.

Russian legal entity

at least 5 staff specialists with higher education in IS

financial security for leak liability of at least ₽100m

databases only in Russia

processing in line with IS requirements

11.04.2025

signed

Order 117 replaces Order 17

01.03.2026

in force

Order 117 took effect

12.04.2026

in force

FSTEC methodology on measures

01.09.2026

in force

Order 137, K(zi) from 01.03.2027

24.07.2026

draft

Draft replacing Order 21

Order 117: what already applies

DRAFT REPLACING ORDER 21

For operators: new systems follow new rules, existing ones get a transition plan, attestations stay valid; maturity method (07.08.2026) covers PDIS; draft (24.08.2026) changes the AI block.

01.09.2027

Foreign clouds and software

The Ministry proposed a PDIS ban (except SMEs, sole traders, individuals), but no bill is public yet.

265-FZ

Cross-border transfer

Convention 108 no longer ensures adequacy; the benchmark is the RKN list (Order 253, from 30.10.2026: 88 states, no Ukraine); RKN may ban CBT to any country.

43-FZ

Genetic data

From 01.09.2026 transfers abroad only for care, medicines and international cooperation, via the Interagency Commission or, in Res. 750 item 4 cases, without it.

243-FZ

AI models

Sovereign and national models: a Russian developer and data processing in data centres in Russia; the Government may make them mandatory.

FSTEC, SORM

Channel security and control

New FSTEC requirements generation: Order 117 and the draft replacing Order 21; Digital Ministry Order 1174 on SORM in process networks covers passport, TIN, details, IP, logins and geolocation.

Plus 492-FZ: from 01.04.2026 FSB bodies may obtain, by order and without a court decision, copies of any organisation's databases. Antifraud-3: identification of hosting clients and a stated purpose, rules for corporate VPNs, virtual PBXs only on Russian IPs.

15.04.2025

in force

Antifraud-1 (41-FZ)

Limits on mass calls, call labelling, self-bans and the first antifraud platforms.

26.06.2026

partly

Antifraud-2 (210-FZ)

Up to 20 SIMs per person, refund of stolen funds, international call blocking, IMEI register, children's SIMs; Max, TIN and ESIA consents dropped from the package.

07.07.2026

in force

Sanctions (199-FZ)

Art. 13.55 CAO - up to ₽700k for improper authorisation; Art. 13.56 - up to ₽2.8m for recommender technology violations.

01.03.2028

draft of 30.09.2026

Antifraud-3

Foreign resources - number-only login, Russian ones - four methods; login records kept 3 years; ESIA consents; hosting, VPN, SMS without recipient PD.

Children's SIMs (draft rules of 18.08.2026, not adopted at 30.09.2026): no SMS to children's SIMs, incl. registration and login codes, except from a GIS; 55-FZ (from 05.09.2026) - tracing citizens via the MVD without disclosing PD to the applicant.

Oct 2026 - Mar 2027

01.10.2026

Platforms

289-FZ: data protection and automation transparency

30.10.2026

List of countries

RKN Order 253: 88 countries, not 89

01.01.2027

UBS

vector segments, end of interim e-signature

01.03.2027

AI and protection

243-FZ: sovereign models, FSTEC No. 137: K(zi)

01.03.2027

Telecoms and drivers

210-FZ: informing calls, 200-FZ: medical data

Sep 2027 - 2032

01.09.2027

Types of biometrics

Res. 408 expires, UBS types to be redefined

01.01.2028

Antifraud-2

final stages of 210-FZ

01.03.2028

Antifraud-3

draft: number login, login records kept 3 years

01.09.2032

AI transition

transition ends for 01.03.2027 systems

Current rule

An owner of a site, app or system with a Russian audience must authorise users in Russia in one of four ways: phone number, ESIA, UBS, or another system of a Russian legal entity or citizen. Apple ID and Google Sign-In are banned.

Limits of the rule

The test is location, not citizenship; foreign owners are outside the rule for now; a foreign email as a login is no violation; no exemptions for internal and B2B services.

Liability

Art. 13.55 CAO (from 07.07.2026): up to ₽700k for entities, resource owner liable. Art. 13.29.2 (from 01.09.2025): passing on login data, up to ₽200k; Art. 274.5 Criminal Code: up to 3 years' prison.

PRACTICE

Litres and VK Play drop Apple and Google ID login, Ozon has disabled it; conflict with App Store rule 4.8 and the fate of accounts are open.

ANTIFRAUD-3, DRAFT OF 30.09.2026

Foreign owners - phone number only (Part 10.1-1), Russian ones - four methods (Part 10.1); three-year retention of registration and login records is back, and ESIA stores ESIA logins.

WHAT TO DO NOW

First public resources with a visible foreign login button, then partner portals and APIs, then internal services; generate and verify login codes on the Russian side.

• WHO
• WHAT
• WHERE, HOW LONG
• PROVISION

• Owners of sites, apps and systems
• records of registration, authorisations and deregistration
• 3 years, for law enforcement and security services; ESIA logins - in ESIA
• Art. 8(10)(2), (10.1-2), 149-FZ

• Telecom operators
• network addresses and ports when contracting online
• 3 years at the operator
• Art. 64(1)(3), Communications Law

• Firms, sole traders with M2M/eSIM
• numbers, subscriber or installation addresses, eSIM equipment IDs
• entered in ESIA; operator verifies eSIM data before service starts

• Platforms with foreign contractors
• phone numbers of foreign contractors
• in a GIS (Art. 44.2, Communications Law), RKN checks
• Art. 13(13), 13.8, Foreigners Law

• Hosting providers
• client identification and purpose of capacity use
• violator register check before capacity is provided

• Antifraud GIS
• data on those involved in violations, incl. registration and login data
• as set by the Government, agreed with FSB
• Art. 1(5), 41-FZ

For the PD operator: document the protection measures and the procedure for giving law enforcement and security bodies user registration and authorisation logs.

243-FZ of 26.07.2026: from 01.09.2026, part from 01.03.2027

Institutions, standards: Presidential AI development commission (Decree 26.02.2026 No. 116), a Government subcommission, GOST R 72514-2026 "AI system impact assessment" based on ISO/IEC 42005:2025.

Coming: a bill on AI in public authorities (four criticality levels, FSTEC and FSB certification, Ministry of Digital Development testbed); deepfake bills; BDA proposal on PETs without consent for AI training.

Practice: 130-FZ banned AI likenesses and voices in campaigning; a first-instance court weighed a secret fed to a neural network at dismissal (07.2026); AI use does not cut citizens' guarantees (Degustatorstroy).

01

Tougher legal liability for PD violations

02

Digital tribute to fill the state "data lake"

03

Deprioritising consent as a PD processing basis

04

PD processing minimisation via industry standards

05

Differentiating PD operators by processing capability

06

From localisation 2.0 to onshoring PD processing

• implemented
• implemented
• Antifraud-3 draft, Doctrine

• Antifraud-3 draft, 2207-r
• postponed
• partly: 265-FZ, 243-FZ

The trend of coming years - concentrating PD processing in large organisations and moving identification and consent onto state infrastructure (ESIA, UBS, Antifraud GIS).

30.09.2026

draft published for public discussion

01.03.2028

planned effective date (draft Art. 10)

9 laws

amended together, incl. 152-FZ, 149-FZ, Communications Law

WHAT IN IT MATTERS FOR PD

• 152-FZ
• consent and withdrawal via ESIA, consent data in ESIA, Gosuslugi complaints, industry acts on PD scope, ban on demanding extra consent

• 149-FZ
• foreign resources: login by phone number only, login logs kept 3 years, hosting client identification, corporate VPN rules

• Communications Law
• SMS without recipient PD, subscriber ID via ESIA and UBS, online-contract network addresses kept 3 years, corporate M2M/eSIM in ESIA

• 41-FZ
• The Antifraud GIS stores data on those involved in violations, incl. registration and login data

Authors' rationale: after the first package the share of ICT crimes fell by 12% on average, but schemes evolve and need new measures (explanatory note).

RUSSIAN OWNERS, PART 10.1

any of four methods

• Phone number
• ESIA

• UBS
• Other Russian system

Nuance: Part 10.1 has no reservation for users in Russia, so the rule covers all users.

FOREIGN OWNERS, PART 10.1-1

phone number only

• +7
• for users in Russia; login via Apple ID or Google Sign-In alone is no longer an option

Foreign owners are now outside Art. 8(10); the draft removes their exemption.

LOGIN LOGS, PARTS 10(2), 10.1-2

Keep for 3 years

records of user registration, authorisation and deregistration

Provide

to law enforcement and security bodies as set by the Government

Login via ESIA

records of such logins are kept in ESIA, not by the resource owner

Already in force: Art. 8(10) per 406-FZ and Art. 13.55 CAO, up to ₽700k for entities from 07.07.2026.

Hosting

• Art. 10.2-1, 149-FZ
• Servers are leased only after checking the client's identity and purpose. VPN services not linked to the banned-sites register are refused and blacklisted for a year. In a cyberattack a server is cut off at the security services' request.

Corporate VPN

• Art. 15.8(18), 149-FZ
• Now a company VPN for its own staff and work tasks is exempt from VPN service rules. The draft keeps the exemption, but the Government with FSB will set requirements for such VPNs and a procedure for notifying RKN.

Virtual PBXs

Cloud PBXs through which businesses call clients will be hosted only on Russian IP addresses. Connecting to such a PBX from a foreign or unintended address will not work; the telecom operator will refuse service.

SMS mailings

• Art. 44.1, Communications Law
• SMS may not mention the name or other data of the recipient or relatives unless the sender may use them. The company itself, or a mobile operator for it, will sign the mailing contract, with no aggregators.

Onshoring trend: control shifts from the data itself to the channels and infrastructure that process it, from the server to SMS.

Antifraud-3 goes beyond fighting fraud: a separate set of 152-FZ amendments changes consent itself and the legal bases for PD processing.

Consent becomes the exception: an ESIA and Gosuslugi platform, model forms and a ban on demanding consent beyond law and industry acts.

Minimisation via industry acts moves from plans into law: an agency, agreeing with RKN, will set the PD scope and actions for consent, contract and legitimate interest.

t.me/prv_adv

Liability and oversight are tough and not always predictable: turnover fines, Art. 272.1 Criminal Code, risk-based supervision, remote monitoring, and from 2026 cases back in general courts and the "leak is not fault" line.

Consent loses its status as a universal basis: separate form, severity group A, and Antifraud-3 adds an ESIA consent platform, industry acts on PD scope and a ban on demanding consent without a duty.

Onshoring of processing advances on all fronts: the RKN list for cross-border transfer (265-FZ), genetic data (43-FZ), sovereign AI models (243-FZ), FSTEC requirements at CII level, SORM and the FSB right to database copies (492-FZ).

Identification passes to the state: authorisation by phone number and ESIA, UBS, Antifraud-3 for foreign resources - PD processing concentrates in large and state bodies.

t.me/prv_adv