From March 1, 2023, new rules will come into force, whereunder Roskomnadzor will be able to ban cross-border personal data transfers by personal data processors (Government Decree No. 24 dated 16.01.2023).

Grounds for ban on international data transfer

In accordance with the new rules, the grounds for ban on cross-border personal data transfers include:

  1. Failure of the receiving party to take measures to protect personal data or absence of certain conditions for termination of its processing.
  2. Personal data is transferred to a person whose activity is prohibited on the territory of Russia by virtue of a court judgement or is recognized as undesirable.
  3. Cross-border transfer and subsequent processing of transferred personal data is inconsistent with the purposes of its collection.
  4. Cross-border personal data transfer does not comply with the purposes and principles provided by the Federal Law “On Personal Data”.

The ban on personal data transfer must meet the purpose of protecting the morality, health, rights and legitimate interests of citizens. In addition to the ban on personal data transfer, Roskomnadzor is also authorized to limit the amount of information transferred.

Decision made by Roskomnadzor must be sent to data processor by any available means, including to the address indicated in the notice on the start of personal data processing. If the data processor receives such a decision from Roskomnadzor, it is entitled to eliminate the identified violations and to repeatedly submit a notice of personal data processing and of making the relevant changes to the register.

Related articles

Our services

GDPR Legal Issues Legal risks Personal data protection