Russia: Implemented Law amending Criminal Code establishing liability for illegal use and transfer, collection and storage of computer information containing personal data (Federal Law No. 421-FZ)

On 11 December 2024, the Law amending the Criminal Code establishing criminal penalties for personal data infringements (Federal Law No. 421-FZ/Bill No. 502113-8) enters into force. The law criminalises the unauthorised collection, storage, use, and transfer of databases containing personal data obtained through unlawful means. It also penalises the creation and operation of information resources intended for the unlawful storage and distribution of personal data. The penalties for these offences range from fines to imprisonment, depending on the severity and circumstances of the offence. Aggravating factors include actions committed by a group, resulting in significant harm or involving special categories of personal data such as racial, national, political, religious, or biometric data.