Russian personal data law (152-FZ)

Personal data means any information relating to an identified or identifiable individual. In practice that covers almost everything an ordinary website collects: a name and phone number in a request form, an email in a newsletter signup, a delivery address, order history, the content of a support enquiry, and under some readings the combination of identifiers that makes a person recognisable. A company collecting that is a personal data operator with all the resulting obligations, regardless of its size or whether it ever thought about it.

The key requirement for technical decisions is localisation. Collection, recording, organisation and storage of personal data on Russian citizens must use databases located in the Russian Federation. That directly constrains the stack and the infrastructure: foreign managed services are out for the primary database, so are several external analytics and marketing tools, and cross-border transfer, where it is needed at all, requires a separate notification to the regulator. Bringing a system into compliance after launch usually means data migration and a rewrite of the access layer, meaning months of work with no new user-facing functionality.

The organisational side is equally mandatory and cheaper than it looks. The operator files a processing notification with Roskomnadzor, publishes a processing policy, collects consent as a separate action rather than a tick box buried in general terms, appoints a responsible person, maintains an inventory of the data processed and defines retention periods. Incident response is a distinct obligation: a breach must be reported to the regulator within 24 hours of discovery, with the results of the internal investigation submitted within 72 hours.

The stakes have risen considerably. Since 30 May 2025 a revised liability regime for personal data violations has been in force: fixed fines are measured in millions of roubles, and a repeat breach carries a turnover-based fine of 1 to 3% of annual revenue with a floor of 20 million RUB. Criminal liability for unlawful handling of personal data exists separately. The practical conclusion for any project is that storage, access, logging and transfer questions get settled in the first week of development, not when a regulator’s request arrives.

Related terms

• Software import substitutionSoftware import substitution means moving information systems onto Russian products listed in the state software registry: for public sector customers and critical infrastructure operators it is a legal requirement, and for other businesses it is a condition of tender access and a way to remove vendor abandonment risk.
• Technical specificationA technical specification is the document that fixes what exactly will be built and on what grounds the work counts as accepted: goals, roles, scenarios, screen-level requirements, integrations, non-functional requirements and an explicit out-of-scope section.
• SLAAn SLA is a service level agreement: it fixes system availability as a percentage, response and resolution times by incident severity, the hours support operates, and the compensation owed when the provider fails to meet those numbers.
• LLMAn LLM is a large language model: a neural network trained on vast amounts of text to predict the next token, which is why it can write, summarise and answer, yet it stores no facts the way a database does and can be confidently wrong.
• RAGRAG is a pattern where a language model first retrieves relevant fragments from your own knowledge base and answers from them, which delivers current data and a source citation without any fine-tuning of the model itself.

Related services

• IT consulting and product auditThe most expensive mistakes in software happen before the first line of code: a misread problem, a stack chosen out of a contractor’s habit, and a specification that does not exist. Consulting exists to settle all of that before the development meter starts running: what to build, out of what, at what cost and in which order. The result is a document, not an opinion on a call.
• Website development, end to endWe build sites that still hold up a year later: from a one-page CMS build to a store or a web application on React and Next.js. One team for design, code, integrations and launch.
• AI and ML developmentWe build AI that solves a defined task and pays for itself, not demos for the sake of demos. Classifiers, recommendations, text and document processing, LLM assistants, and model integration into an existing product.

Read more

• How to Choose a Tech Stack: Criteria That Outlive the HypeA stack is a five-year commitment usually made in a single call. Here is the order the decisions should be taken in, the criteria that carry real weight, working stacks for six project archetypes and what a wrong choice costs.
• Where AI and ML Actually Pay Off in a Business, and Where They Are Expensive HypeMachine learning pays off where there is a repeated decision, a lot of similar data and tolerance for error. Missing any one of the three means do not. Here are the use cases that work, their realistic accuracy, the running costs and how to run a four to six week pilot.
• An AI Assistant on Your Own Knowledge Base: How RAG Works and What It CostsHow a RAG assistant differs from a button-tree bot and from an LLM with no data, where hallucinations come from and what actually reduces them, what SaaS costs against a custom build, and which month the project breaks even.