Federal Law No. 265-FZ of 26 July 2026, ‘On Amendments to Article 12 of the Federal Law “On Personal Data” and Certain Legislative Acts of the Russian Federation’, has been officially published.[1]

The Law changes the approach to compiling the list of foreign countries deemed to provide adequate protection of the rights of personal data subjects (the ‘List’). The amendments entered into force on the date of their official publication.

The significance of the List lies in the simplified procedure available to operators intending to transfer personal data to countries included in it. For example, operators are not required to obtain and provide Roskomnadzor with information on the data protection laws of the relevant country and may begin transferring personal data immediately after notifying Roskomnadzor of their intention to carry out cross-border transfers.

Under the previous version of Article 12 of the Federal Law ‘On Personal Data’, the List included countries meeting either of two criteria: (1) they were parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data[2] (including all Council of Europe member states, Mexico and Argentina); or (2) their laws and measures for ensuring the confidentiality and security of personal data during processing complied with the provisions of the Convention.

Under the amendments, countries that are parties to the Convention are no longer automatically deemed to provide adequate protection of the rights of personal data subjects. Instead, countries will be included in the List following an assessment by Roskomnadzor of their data protection legislation and the measures they implement to uphold fundamental data protection principles and ensure the confidentiality and security of personal data during processing.

Operators will continue to be required to notify Roskomnadzor in advance of their intention to carry out cross-border transfers of personal data. However, the following points must now be taken into account:

• If an operator intends to transfer personal data to a country that is a party to the Convention, it must first check whether that country is included in the List. If it is not, the operator must obtain information about the country's data protection legislation from the intended foreign recipients before submitting the notification.
   
• Personal data may not be transferred to a country that is a party to the Convention but is not included in the List until the statutory period for Roskomnadzor to review the notification has expired. This period is 10 working days from receipt of the notification, although the review may be suspended in certain circumstances.[3]

The amendments may have significant practical implications:

• First, Roskomnadzor may revise the list of countries deemed to provide adequate protection of the rights of personal data subjects.
• Second, there may be an increase in the number of cases in which cross-border transfers of personal data to certain countries are prohibited or restricted.
• Third, compliance costs for personal data operators may increase as they adapt to the revised cross-border transfer requirements, including the costs of obtaining and analysing information about the legal frameworks of foreign countries.

It remains unclear whether changes to the List will affect new transfers of personal data to countries newly classified as providing ‘inadequate’ protection, where those countries were previously regarded as providing ‘adequate’ protection and the operator had already notified Roskomnadzor of its intention to transfer data to the relevant jurisdiction before the List was amended. This uncertainty arises where there have been no changes to the personal data being transferred, the categories of data subjects or the purposes of the transfer. An example would be an operator regularly transferring particular personal data to a foreign counterparty in the course of performing a contract between them.

To mitigate the associated risks, operators are advised to:

• Request information from their foreign counterparties about the applicable data protection legislation in the relevant countries in advance, without waiting for the new List to be approved.
• Review existing and planned cross-border transfers of personal data in light of potential changes to the status of the countries to which the data is transferred.
• Make any necessary amendments or additions to agreements with foreign counterparties.
• Update internal policies and procedures governing the monitoring and management of cross-border transfers of personal data.

1. Federal Law No. 265-FZ of 26 July 2026, officially published on the Russian Legal Information Portal.
2. Hereinafter referred to as the ‘Convention’.
3. Except where the transfer is necessary to protect the life, health or other vital interests of the data subject or other individuals.

__________

This material has been prepared solely for informational and/or educational purposes and does not constitute legal advice or a legal opinion. EPAM Law, its management, lawyers, and staff cannot guarantee the applicability of such information to your specific circumstances and accept no liability for any decisions you make, or for any direct or indirect losses and/or damages arising from the use of the information contained in these materials, in whole or in part.