Private data security

Russia's Personal Data Localization Law: Expanding Enforcement

Confusion and concern have surrounded Russia's personal data localization law since it went into effect on September 1, 2015. The law mandates that data operators that collect personal data about Russian citizens "record, systematize, accumulate, store, amend, update and retrieve" data using databases physically located in Russia. Prior Duane Morris Alerts ( October 16, 2015, September 2, 2015, and June 15, 2015) have addressed a number of the most salient requirements of the new law. The October 16, 2015, Alert summarized the progress on implementation of the law to date and discussed the predictions by Roskomnadzor (the Russian agency responsible for enforcing the law) and various commentators about future enforcement.

With more than six months of history now in the books, a review of how the law has been implemented and enforced is worthwhile; and consideration of future implementation, including expanded enforcement, is prudent.

... Initial indicators signal that Roskomnadzor is wholeheartedly committed to enforcement of the new law. In the remaining months of 2015 following enactment, Roskomnadzor conducted 302 inspections for compliance with the new localization rule.