Russia: Implemented Federal Law No. 266-FZ amending 152-FZ on Personal Data (Bill No. 101234-8) including cross-border data transfer regulation

On 1 March 2023, the Federal Law No. 266-FZ amending 152-FZ on Personal Data (Bill No. 101234-8), including cross-border data transfer regulation, entered into force. In particular, the Law allows data transfers to countries that provide an adequate level of personal data protection and requires entities to notify Roskomnadzor of transfers. However, they don't need approval for transfers. In the absence of an adequate level of personal data protection, entities must obtain approval from Roskomnadzor, which has to review the application for approval in a maximum of 10 days. The only exemption applies to transfers necessary to protect the data subjects' life, health, and other vital interests, allowing data operators to transfer the data before obtaining approval. In their notification, entities have to specify the legal basis and purpose of the cross-border transfer of personal data and processing, the categories of personal data to be transferred and the jurisdictions where the data is to be transferred.