152-FZ "On Personal Data"

What is Federal Law No. 152-FZ "On Personal Data"

Federal Law No. 152-FZ "On Personal Data" is a key regulatory legal act of the Russian Federation, adopted on July 27, 2006. The law regulates the collection, processing, storage, transfer and protection of personal data (PD) of Russian citizens. Its requirements are mandatory for all organizations and individual entrepreneurs working with personal information: government bodies, banks, insurance and medical companies, internet services, HR departments and any other structures that in one way or another process data about people.

In simple words, 152-FZ is a set of rules that protects your personal information from leaks and unscrupulous companies. The law obliges any organization (operator) to ask for your consent to collect data, keep it confidential and reliably protect it, and also delete it on first request. This applies to banks, online stores, medical institutions and any other structures that in one way or another gain access to your data.

Compliance with the law is controlled by Roskomnadzor, and serious fines and criminal liability are provided for violations. According to Roskomnadzor, in 2025 more than 5,000 violations of 152-FZ were detected, and the total amount of fines exceeded 2.5 billion rubles. This underscores the importance of compliance with the law for any organization working with citizens' data.

Main provisions of 152-FZ

The law establishes clear principles for personal data processing that all operators must comply with:

• Legality and fairness: Data processing must be carried out on a legal basis and with good faith intentions. Processing data by deception or without legal grounds is not allowed.
• Limitation by specific purposes: Data must be processed only for predetermined and lawful purposes. Use of data for purposes incompatible with those originally stated is not allowed.
• Inadmissibility of combining databases: It is prohibited to combine databases containing personal data whose processing is carried out for incompatible purposes.
• Ensuring accuracy and relevance: The operator is obliged to take measures to ensure the accuracy and relevance of data, as well as to delete or clarify incomplete or inaccurate data at the request of the subject.
• Storage no longer than necessary: Data must be stored no longer than the purposes of processing require. After achieving the purposes or when the need is lost, the data is subject to destruction or depersonalization.

A key requirement of the law is obtaining the informed and conscious consent of the subject to the processing of their data. Additional requirements and enhanced protection are established for biometric and special categories of personal data (race, nationality, political views, health, intimate life). To effectively protect such data, organizations often implement DLP systems to prevent leaks and SIEM solutions for monitoring security events.

Obligations of personal data operators

Operators (organizations and individual entrepreneurs processing personal data) are obliged to fulfill a number of requirements fixed in 152-FZ and by-laws (in particular, FSTEC Order No. 21 and Government Resolution No. 1119):

• Notify Roskomnadzor about the start of personal data processing (except for cases when this is not required — for example, if data is processed only for the execution of an employment contract).
• Ensure the confidentiality of personal data and take technical and organizational protection measures.
• Use certified CIPF tools when necessary (for example, when transferring data over open communication channels or when working with biometrics).
• Appoint a person responsible for organizing the processing of personal data.
• Conduct certification of information systems to confirm compliance with regulator requirements (FSTEC, FSB).
• Maintain internal records and control over personal data processing.

Comprehensive measures are used to protect data: firewalls, DLP systems, SIEM solutions, access control systems and antivirus software. You can learn more about protection tools in our glossary.

Liability for violation of 152-FZ

Violation of the requirements of the law entails serious liability — from administrative fines to criminal prosecution:

• Administrative liability (Code of Administrative Offenses of the Russian Federation): Fines for officials — from 10,000 to 100,000 rubles, for legal entities — from 100,000 to 500,000 rubles. For processing data without consent or for incompatible purposes, fines can reach 700,000 rubles.
• Turnover fines: For repeated violations and large data leaks, turnover fines of up to 3% of the company's annual revenue are provided, but not less than 1 million rubles (according to the amendments that came into force from 2025).
• Criminal liability (Article 137 of the Criminal Code of the Russian Federation): For illegal collection and dissemination of personal data (including using official position), imprisonment for up to 5 years is provided.
• Website blocking and suspension of activity: Roskomnadzor has the right to block websites that violate 152-FZ, as well as to suspend the activities of organizations until violations are eliminated (up to 90 days).

According to statistics, in 2025 Roskomnadzor issued more than 7,000 rulings on administrative fines for violations of 152-FZ. The average fine for legal entities was 250,000 rubles, and for officials — 40,000 rubles.

How to ensure compliance with 152-FZ

To minimize risks and ensure compliance with legal requirements, organizations are recommended to take the following steps:

1. Conduct a regular audit of all systems and personal data processing processes, identify all sources and data flows.
2. Appoint a person responsible for organizing personal data processing and develop internal policies (Personal Data Processing Policy, Privacy Policy).
3. Obtain the consent of subjects to process data in written or electronic form (using an electronic signature).
4. Implement technical protection tools: DLP systems to prevent leaks, SIEM systems for monitoring, CIPF tools for encryption, and firewalls to protect against external threats.
5. Conduct certification of information systems by authorized bodies (FSTEC, FSB) in accordance with the requirements.
6. Train employees in the rules of working with personal data and liability for their violation.

Our certification and design of secure systems services will help you comply with regulator requirements and avoid sanctions. The full text of the law and current amendments are always available in the documents section.