Conditions

Under what conditions is it allowed to transfer personal data abroad. Law No. 152-FZ “On Personal Data” divides all foreign countries into two categories.

  1. Countries that provide adequate protection of the rights of personal data subjects (“adequate countries”). These include parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and other states included in the list approved by Roskomnadzor (Convention of 28.01.81; Roskomnadzor Order of 05.08.2022 No. 128 – in effect from March 1, 2023; Roskomnadzor Order of 15.03.2013 No. 274 – in effect until March 1, 2023). For example, these are Georgia, Azerbaijan, Turkey, Kazakhstan, Belarus, and China.
  2. Countries that do not provide adequate protection of the rights of personal data subjects (“inadequate countries”). These include all states that are not on the above lists approved by Roskomnadzor. For example, the Central African Republic.

Until March 1, 2023, personal data can be freely transferred to “adequate countries” subject to compliance with Law No. 152-FZ. However, the personal data subject has the right to know that the operator entrusts someone with the processing of his or her personal information (paragraph 8 of part 7 of Article 14 of Law No. 152-FZ).

Cross-border transfer to ‘inadequate countries’ is possible only if one of the following conditions is met:

  • With the written consent of the personal data subject;
  • In cases provided for by international treaties of the Russian Federation;
  • If it is necessary by law to ensure the constitutional system, defense and security of the country, transportation protection;
  • To fulfill the conditions of a contract with the personal data subject;
  • To protect the life, health, interests of the citizen and other individuals when it is impossible to obtain written consent for cross-border transfer of personal data.

This list is explicit. It enumerates all possible cases when personal information of a citizen can be transferred to another country without guaranteeing the protection of their rights (part 4, article 12 of the Law No. 152-FZ).

Starting from March 1, 2023, a new version of Article 12 on cross-border transfer of personal data (TPPD) in the Law No. 152-FZ (part 7 of article 1 of the Federal Law dated July 14, 2022 No. 266-FZ) comes into effect. The main requirement for transferring personal data of Russian citizens to another country becomes the notification of Roskomnadzor, which must be submitted before starting such activity.

Please note:

Operators who already transfer personal data to other countries and plan to continue doing so after the new version of Article 12 comes into force must notify Roskomnadzor by March 1, 2023 (Clause 5 of Article 6 of Law No. 266-FZ). This can be done on the official Personal Data Portal.

The transfer of personal data to inadequate jurisdictions is possible only after 10 working days have elapsed, which is the period for considering the notification by Roskomnadzor. The transfer to adequate jurisdictions is not restricted and can be carried out immediately after the notification has been submitted to Roskomnadzor.

Penalties

If you do not send a notification to Roskomnadzor about the intention to carry out cross-border transfer, companies risk two fines at the same time. The first is for not sending the notification itself – from 3000 to 5000 rubles under Article 19.7 of the Code of Administrative Offenses. The second is for transferring personal data in a case that is not provided by law – from 60,000 to 100,000 rubles under Part 1 of Article 13.11 of the Code of Administrative Offenses.

Notifications

Tips for preparing and submitting a notification of cross-border transfer of personal data:

Step 1. Assess the foreign counterparty’s compliance with the confidentiality and security of personal data when processing it. The new version of Article 12 of Law No. 152-FZ does not contain detailed information on how to do this. Only the information that the operator should request from the foreigner is specified:

  • measures to protect the transferred personal information of Russian citizens and conditions for its processing termination;
  • legal regulation in the field of personal data protection of the recipient state, if it is an “inadequate country”;
  • information about the foreign person to whom personal data is transferred – the name or surname, first name, patronymic, as well as contact phone numbers, mailing addresses, and email addresses.

Step 2. Fill out the notification form on the official Portal of Personal Data of Roskomnadzor.

To submit the data electronically, a verified account on the Gosuslugi portal will be required. For a company, it must be linked to that company. Paper copies should not be sent.

If the operator does not have a personal account on Gosuslugi, the notification can be taken from the Roskomnadzor Portal, and based on that, the document can be made. The completed form is printed, signed by the manager, and sent by mail (part 4 of article 12 of Law No. 152-FZ in the version of Law No. 266-FZ).

Our support

Our specialists can assist in filling out, submitting, and analyzing this form for cross-border transfer of personal data, as well as overall registration with Roskomnadzor. For more information on personal data protection services, please contact us.

Related materials