Russia: Adoption of Amendment to Law No. 152 on Personal Data including cross-border data transfer regulation

On 8 July 2022, the Federation Council of the Russian Federation adopted the Amendment to Law No. 152 (Bill No. 101234-8), introducing new requirements for the cross-border transfer of personal data. In particular, the Bill allows data transfers to countries that provide an adequate level of personal data protection and requires entities to notify Roskomnadzor of transfers. However, they don't need approval for transfers. In the absence of an adequate level of personal data protection, entities must obtain approval from Roskomnadzor, which has to review the application for approval in a maximum of 10 days. In their notification, entities have to specify the legal basis and purpose of the cross-border transfer of personal data and processing, the categories of personal data to be transferred and the jurisdictions where the data is to be transferred. The data transfers can be prohibited or restricted in order to protect the "morality, health, rights and legitimate interests of citizens" by Roskomnadzor following the assessment of notifications it receives for data transfers. Finally, the Law requires Roskomnadzor to adopt a list of countries that provide adequate data protection.