Russia: Implemented Law No. 152-FZ on Personal Data including cross-border data transfer regulation

On 23 January 2007, Law No. 152-FZ on Personal Data, including cross-border data transfer regulation, entered into force. The Law requires entities to ensure that the data is transferred to foreign states that provide adequate protection of the rights of personal data subjects. The transfers to foreign states that do not provide an adequate level of protection can be constructed based on the consent of the data subject, international treaties, based on laws to protect the right of citizens and national security, to execute an agreement to which the data subject is a party and protection of life, health, and other vital interests of the data subject. Transfers can be prohibited to protect the morality, health, rights and legitimate interests of citizens and defence of the country and the security of the state.