The September 1, 2015 came into force the Russian Federal Law n. 242 of 21 July 2014.
The new law on the location of personal data requires that all personal data of Russian citizens treated by foreign companies, are stored and processed in Russia without exemptions for trade data. The operator must ensure that foreign recording, systematization, saving, storing, updating and retrieving personal data of Russian citizens should be made only in databases located in the State Russian.
The subjects covered in this law are foreign companies with legal presence in Russia and foreign companies not legally present in Russia but that provide online services to Russian citizens (eg. E-commerce).
The main actions are:
• Risk Assessment to determine whether the company will process data as provided by Russian Law Localisation
• internal policies and to define where the data reside in Russia
• specific information and consents
• Local notification to the DPA (Roskomnadzor)
• Data Transfer Agreement