Cross-border transfer of personal data in Russia: new rules

On 26 July 2026, Federal Law No. 265-FZ* (the “Law”) came into force, amending the Personal Data Law* in relation to cross-border personal data transfers.

Adequacy presumption no longer applies

The Law eliminates the previous rule that the states parties to the Council of Europe Convention No. 108 (the “Convention”) were automatically recognised as providing adequate protection to the rights of personal data subjects.

Under the new framework, Roskomnadzor has exclusive authority to determine whether a foreign country qualifies as “adequate” and add it to the Adequacy List* accordingly.

Current cross-border transfer regime

Since 2022, cross-border personal data transfers have been subject to a differentiated notification and authorisation procedure. The applicable rules vary according to the recipient country’s legal status:

• for “adequate” countries: the operator submits a notice to Roskomnadzor and may begin the transfer immediately.
• for countries not deemed “adequate”: the operator must wait 10 business days after filing the notice to Roskomnadzor. If Roskomnadzor raises no objection within that period, the operator may proceed with the transfer.

Practical implications of the amendments

For now, the Law does not impose any new obligations on data operators, since all Convention States Parties remain on Roskomnadzor’s Adequacy List.

Restrictions on transfers to the territories of the Convention States Parties will only arise if Roskomnadzor adopts a revised Adequacy List that excludes certain countries.

Should a country be removed from the Adequacy List, it remains unclear whether the revised list will apply retrospectively: in particular, to ongoing cross-border transfers already notified under the previous List.

If that happens, operators will likely need to suspend the transfer, file a fresh notice, and only resume the transfer after the 10-business-day period, provided that Roskomnadzor does not object. However, until the regulator publishes guidance on this issue, following this course would be premature.

Recommendations

Data operators are advised to monitor the Adequacy List for updates and issuance of Roskomnadzor’s clarifications regarding its application to ongoing transfers. We will keep you informed of further developments.

*In Russian