Key personal data regulation developments: summer 2026 review

Dear Colleagues,

This review focuses on key developments in the field of personal data regulation that occurred in the summer of 2026 and to which we would like to draw your attention.

Tightening of cross-border personal data transfers

On July 26, 2026, the Federal Law No. 265-FZ "On Amending the Article 12 of the Federal Law “On Personal Data” and Certain Legislative Acts of the Russian Federation" (hereinafter referred to as "Federal Law No. 265-FZ") came into force. The purpose of the specified law is to strengthen the protection of personal data when transferring abroad.

What has changed?

According to the previously effective version of the Article 12 of the Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" Federal Service for Supervision of Communications, Information Technology and Mass Media (hereinafter Roskomnadzor) approved the list of foreign states that ensure adequate protection of the rights of personal data subjects (hereinafter referred to as the "List"), which included:

• states that are parties to the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (hereinafter referred to as the "Convention"), as well as
• foreign states that are not the parties to the Convention, provided that the effective legal norms in the respective state and the measures applied to ensure the confidentiality and security of personal data during their processing comply with the provisions of the Convention.

Currently the specified List should include only states in which the legal regulation in the field of personal data and the measures applied by such states to comply with the fundamental principles of protection and to ensure the confidentiality and security of personal data during their processing correspond to the provisions of the Convention.

Thus, the mere fact that a foreign state is a party to the Convention is no longer sufficient for that state to be included in the List. What matters is the content of the legislation of the respective foreign state, the measures actually applied to protect personal data and the assurance of their confidentiality and security.

Has the List been approved as of now?

Currently, the List approved by the Order of Roskomnadzor No. 128 dated August 5, 2022, is still in effect.

However, Roskomnadzor has already prepared the draft of a new List, which retains all states included in the current List, except Ukraine. Furthermore, instead of dividing states into parties and non-parties to the Convention, a single alphabetical list has been established.

What does this mean for businesses?

If your organization performs cross-border data transfers (for example, uses foreign cloud services or sends the data of foreign clients or employees to head offices abroad), you are to monitor closely the updated List of Roskomnadzor. A change in the status of any country will require the immediate suspension of personal data transfers and the submission of a new notification to the department.

Key outcomes from the open day of Roskomnadzor

On August 14, 2026, Roskomnadzor held a large-scale open day, at which it summarized the results of inspections for 2025 and the first half of 2026. The main conclusion of the meeting was that the department has fully switched to a risk-based approach: instead of mass on-site inspections, the priority is given to automated remote audits of websites.

Here are the key outcomes that businesses need to know:

• Repeat data breaches have been minimized. Deputy Head of Roskomnadzor Milos Vagner officially stated that over the past year and a half, the agency has not recorded a single repeat incident of personal data breaches at companies that had already been held liable. Businesses have begun to take security more seriously amid discussions of large turnover-based fines.
• Automation of supervision (remote monitoring). Roskomnadzor checked almost 160,000 internet resources in the .ru, .рф and .su zones. The inspections are performed without the companies' knowledge: automated systems continuously scan data collection forms on websites. The algorithms look for typical violations: absence of a privacy policy, pre-checked consent boxes, data collection without notification to Roskomnadzor or hidden scripts. If violations are detected, the operator first receives an official letter demanding that everything be corrected and only if this is ignored is an order or fine issued.

The 4 key compliance principles of the regulator:

• Conscious data collection. You cannot collect information "just in case." Companies are required to define clearly a specific purpose for each type of data. Collecting excessive profile fields without a justified business purpose is a guaranteed violation.
• Control over data transfers. Businesses should know the entire data journey: to whom, how and why the data is transferred (including contractors, cloud services and analytics platforms). Any transfer is to be legally justified.
• Abandoning "universal" consents. Consent should not be used as a universal basis for any processing: in a number of cases processing may be performed on the basis of a contract or legal requirements. Roskomnadzor considers excessive, giant "everything at once" consents to be a violation.
• Lifecycle management. Data cannot be stored forever. It is necessary to establish strict retention periods and, most importantly, to implement a procedure for the guaranteed destruction of personal data (preparing the relevant acts) at the moment the purpose of their collection has been achieved.

We will be glad to answer any questions and check the website of your company for compliance with the new requirements in 2026. We are also ready to conduct an audit of personal data flows in your IT-systems, including the verification and legalization of cross-border data flows.