Russia

Roskomnadzor oversees personal data processing, handles complaints, and enforces compliance.

Written consent for sensitive data. Other lawful bases available.

Rights to access, correction, blocking, destruction, and withdrawal of consent.

Transfers to adequate countries. Other transfers require consent and adequate protection.

Must notify Roskomnadzor within 24 hours. Must notify affected individuals within 72 hours (2024 amendment).

Must designate a person responsible for personal data processing.

General provisions apply. Enhanced protections under child protection laws.

Fines significantly increased in 2024: up to RUB 500 million for data breaches. Active enforcement.

CBR financial data rules, health data regulations, telecom requirements.

General consent requirements apply.

General rights apply. AI-specific legislation developing.

Russian citizens' personal data must be stored on servers located in Russia.

No equivalent concept. Registration with Roskomnadzor required.

Law applies to government processing with national security exemptions.