Personal Data Localization: Why the Old Schemes No Longer Work

The requirement to store personal data of citizens of Russia in Russian databases has been in force since 2015, but many companies operated for years using schemes that bypassed it: a form on the site sent the request directly to a foreign CRM, data were written in parallel to Russian and foreign databases, the Russian server acted as a simple transit. From July 1, 2025, such schemes became a direct violation.

A general overview of the requirements of Federal Law No. 152-FZ — Roskomnadzor notification, consent, leaks, all fines — is available in a separate article. This text is only about localization: what exactly changed, which technical schemes are no longer acceptable, and how to rebuild data collection.

What changed on July 1, 2025

From that date the new wording of part 5 of Article 18 of Federal Law No. 152-FZ (as amended by Federal Law No. 23-FZ) is in effect. The recording, systematization, accumulation, storage, clarification and retrieval of personal data of citizens of Russia when collecting them must be carried out using databases located in Russia. Initial recording in databases abroad is explicitly prohibited.

In practice this means the order in which data first land in the Russian database and only then — elsewhere:

1. the user submits a form;
2. the data are received by a server in Russia;
3. the data are written to a database in Russia;
4. after that they may be transferred further, including abroad, if the rules for cross-border transfer are observed (Article 12 of Federal Law No. 152-FZ, including notification of Roskomnadzor).

Which schemes now violate the law

• Form sending directly to a foreign service. A request from the website goes straight to a foreign CRM, mailing service or form service — the initial recording occurs abroad.
• Parallel writing. Data are written simultaneously to a Russian and a foreign database. The foreign write in this scheme is also initial, so the scheme does not comply with the new wording of the law.
• Russian server as transit. A server in Russia accepts data and immediately forwards them abroad without storing anything locally.
• Spreadsheets and documents in foreign clouds. A client list in Google Sheets, employee questionnaires in Notion or on a foreign cloud drive — it is reasonable to consider these also personal data databases: the law talks about databases without limiting them to database management systems.
• Logs and monitoring systems abroad, if they contain names, phone numbers, email addresses or users’ IP addresses.

Fines

Liability is established by Article 13.11 of the Code of Administrative Offences of the Russian Federation (KoAP RF). For organizations, for violating the localization requirement (part 8) the fine ranges from 1 to 6 million rubles; for a repeat offense (part 9) — from 6 to 18 million rubles. In addition to a fine, Roskomnadzor may issue an order and restrict access to a site: for example, LinkedIn was blocked in 2016.

How to rebuild data collection

1. Find all entry points

Make a list of places where the company receives personal data:

• forms on the website and in the mobile app;
• CRM and request tracking systems;
• mailing services and online chats;
• HR systems and candidate questionnaires;
• telephony and call recordings;
• logs, backups and monitoring systems.

For each entry point answer the question: where does the initial recording physically take place?

2. Make the Russian database the first point of record

Technically this can be solved in several ways:

• a custom form handler (API) on a server in Russia that first saves the data to the database and only then forwards them to other systems;
• a message queue or broker on a Russian server between the site and external services;
• replacing foreign services with Russian ones where cross-border transfer is not needed at all.

It is important that the recording in the Russian database is real and first: saving it “just to tick the box” after sending it abroad does not solve the problem.

3. Deal with users’ citizenship

The law protects citizens of Russia. If a company cannot distinguish them from other users, it is safer to assume that all users are citizens of Russia and apply the requirement to everyone.

4. Arrange cross-border transfers

If after recording in Russia the data are transferred abroad — to a foreign CRM, a parent company, a contractor — the requirements of Article 12 of Federal Law No. 152-FZ must be observed, including prior notification of Roskomnadzor, and contracts with recipients must be formalized.

5. Choose hosting in Russia and update the notice

The server and the database must be physically located in Russia; the provider must have documents confirming the hosting location. After rebuilding, update the notice on personal data processing with Roskomnadzor: it specifies the location of the databases.

Common mistakes

• Assuming the law applies only to large companies. The requirement applies to any personal data operator, including a small online store and a sole proprietor (individual entrepreneur).
• Forgetting about backups and logs — they also contain personal data.
• Moving the website to Russia but leaving the form on a foreign form builder.
• Failing to update the Roskomnadzor notification after changing hosting.

Rebuilding data collection is a task for both a lawyer and an engineer: the lawyer determines which data and flows fall under the requirement, the engineer figures out how to make the Russian database the first point of record.