Clarification on Russia’s New Data Localization Laws

The Russian Ministry of Communications and Mass Media recently provided further information regarding Russia’s data localization law that is set to take effect on September 1, 2015. The data localization law generally requires companies to store all personal data of Russian citizens in databases located inside Russia. While the law generally does not apply to non-resident entities, the Ministry clarified that the requirements may apply to foreign entities that target Russian audiences.

In describing what constitutes targeting Russian audiences, the Ministry pointed to the use of top-level domains such as .ru, .su, .moscow, Russian-language advertisements or Russian-language websites, or online transactions that may be executed with Russian currency.

The Ministry indicated that the laws are not intended to prohibit Russian citizens from disclosing their personal data to foreign companies that provide international services, such as online banking services or online shopping. However, the Ministry explained that the data subject’s consent to process data outside of Russia will not excuse a data operator from complying with the new law.

TIP: Companies based in Russia or companies directing business to Russia should be analyzing the applicability of the localization law to their data collection and storage practices.