Doing business today is inseparable from processing personal data: customer contacts are collected through website forms, employee records are kept in HR systems, and orders and payments are also processed on websites. In these circumstances, deciding where the customer database is stored is not just an IT question but part of legal compliance and risk management.

From 01.07.2025, Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" ("Law No. 152-FZ") was amended. Using databases located outside Russia when collecting personal data is now prohibited (Article 18(5) of Law No. 152-FZ).

Is it lawful to collect personal data on servers located outside the Russian Federation?

"Collection of personal data" means the targeted process by which an operator obtains personal data directly from the data subject or through third parties specially engaged for this purpose (for example, filling in a personal data form to register a user account on the operator's website).

Collection of personal data includes the following actions (Article 18(5) of Law No. 152-FZ):

Recording;
Systematisation;
Accumulation;
Storage;
Clarification;
Retrieval.

The initial collection of such data must be carried out exclusively using databases registered in Russia (for example, Google Analytics services fall under the ban because they are designed to transfer data immediately, including to the USA).

Russian law thus establishes the principle of personal data localisation: personal data must first go into databases located in Russia.

Is it lawful to transfer personal data abroad?

Transferring personal data to the territory of a foreign state, to a foreign authority, or to a foreign individual or legal entity ("cross-border transfer of personal data") is permitted.

To do so, the operator must comply with the established requirements, in particular: notify Roskomnadzor of the planned cross-border transfer and obtain certain information from the foreign persons to whom the data is to be transferred (Article 12 of Law No. 152-FZ).

Thus, personal data stored on a Russian server at the point of collection may be transferred outside Russia provided the requirements of Article 12 of Law No. 152-FZ are met.

Liability for breaching personal data localisation requirements

Roskomnadzor regularly identifies companies that store the data of Russian citizens abroad. Administrative proceedings are brought against such organisations, fines are imposed, and their websites may be added to the register of violators and blocked. Roskomnadzor may also issue additional demands.

Russian law provides for administrative liability of an operator that, when collecting personal data, fails to ensure that the recording, systematisation, accumulation, storage, clarification (updating, modification) or retrieval of personal data takes place in Russia (Article 13.11(8) of the Code of Administrative Offences):

For individuals: an administrative fine of RUB 30,000 to 50,000;
For officials: an administrative fine of RUB 100,000 to 200,000;
For legal entities: an administrative fine of RUB 1 million to 6 million.

Recommendations from the C Cases team

Establish which personal data is collected through the website;
Analyse how personal data is processed and find out where personal data databases are physically stored (which server receives the first record, where the database is located, which system systematises and stores the data);
Localise databases in Russian data centres when processing the data of Russian citizens;
Include in contracts with contractors or processors an obligation to localise personal data and sanctions for breaching it;
Check whether any cross-border transfer takes place and, if so, whether the relevant notification has been filed with Roskomnadzor;
Review and (if necessary) update your personal data processing policy, data subject consents, contracts with processors, internal regulations and notifications to Roskomnadzor.

Conclusion

Personal data of Russian users collected through a website, including a mobile app, must first go into a database physically located in Russia. Only then may the data be transferred abroad, provided the relevant legal requirements are met.

If, as a personal data operator or processor, you need to establish where and how to collect customers' personal data lawfully, determine which data must be localised in Russia, regulate cross-border transfers and minimise legal risks for your business, the C Cases team is ready to carry out a comprehensive legal audit of your internal regulations and contracts with contractors and processors, and to build a detailed "map" of personal data collection and storage routes with recommendations for remedying any violations found.

Sources

• Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".
• Code of Administrative Offences of the Russian Federation No. 195-FZ of 30.12.2001.