FEDERAL LAW
NO. 152-FZ OF JULY 27, 2006
ON PERSONAL DATA
(with the Amendments and Additions of November 25, December 27, 2009, June 28,
July 27, November 29, December 23, 2010, June 4, July 25, 2011, April 5, July 23,
December 21, 2013, June 4, 2014)
Passed by the State Duma on July 8, 2006
Approved by the Federation Council on July 14, 2006
Chapter 1. General Provisions
Article 1. Scope of This Federal Law
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Part 1 of Article 1 of this Federal Law.
The new wording shall extend to the legal relations arising from July 1, 2011
See the text of the Part in the previous wording
1. This Federal Law regulates the relationships relating to the processing of personal
data by federal governmental bodies, governmental bodies of subjects of the RussianFederation and other governmental bodies (hereinafter referred to as "governmental bodies"),
local self-government bodies and other municipal bodies (hereinafter referred to as "municipal
bodies"), legal entities and natural persons by means of automation facilities, for instance ininformation-telecommunication networks, or without such facilities, if the processing of
personal data without the use of such facilities corresponds to the character of the actions(operations) as involving the personal data by means of automation facilities, i.e., allows to
search - according to a set algorithm - for the personal data recorded on a material medium
and available in card files or other systematised corpuses of personal data and/or access tosuch personal data.
2. The scope of this Federal Law shall not apply to the relations arising:1) in case of personal data being processed by individuals exclusively for personal andfamily needs unless that is in violation of the rights of the subjects of personal data;
2) in the organisation of safe-keeping, building-up, record-keeping and use of personal
data containing Russian Federation's Archives fund documents and other archives documents
as envisaged under the legislation on Archives in the Russian Federation;3) abrogated from July 1, 2011;
Information on changes:

See the text of Item 3 of Part 2 of Article 14) in case of processing of personal data categorised, as appropriate, as the data
constituting a state secret.
Information on changes:

Federal Law No. 123-FZ of June 28, 2010 supplemented Part 2 of Article 1 of this Federal
Law with Item 5. The Item shall enter into force from July 1, 20105) the provision of information by empowered bodies on the activities of courts in the

Russian Federation in accordance with Federal Law No. 262-FZ of December 22, 2008 on theProvision of Information about the Activities of Courts in the Russian Federation.
Article 2. Aim of This Federal Law
The aim of this Federal Law is to provide for the protection of the rights and liberties of
person and citizen in the processing of his or her personal data, including protection of therights to the inviolability of private life, personal and family secrets.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Article 3 of this Federal Law. The newwording shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wording
Article 3. The Basic Notions Used in the Present Federal Law
The following basic notions are used for the purposes of this Federal Law:1) "personal data" meaning any information directly or indirectly concerning a natural
person who is defined or is being defined (personal data subject);2) "operator" meaning a governmental body, a municipal body, a legal entity or anatural person that on its/his/her own or jointly with other persons organises and/or realises
the processing of personal data, and also defines the purposes of personal data procession,
the composition of the personal data which are subject to processing and the actions(operations) involving personal data;3) "processing of personal data" meaning any action (operation) or a set of actions(operations) realised by means of automation facilities or without such facilities as involving
personal data, including the gathering, recording, systematising, accumulating, storing,
updating (renewing and altering), retrieving, using, transmitting (disseminating, providing andaccessing), depersonalising, blocking, deleting and destroying personal data;
4) "automated personal data processing" meaning the processing of personal databy means of computers;5) "dissemination of personal data" meaning actions aimed at disclosing personal
data to an unlimited group of persons;6) "provision of personal data" meaning actions aimed at disclosing personal data toa certain person or a certain group of persons;7) "blocking personal data" meaning the temporary termination of personal dataprocessing (except for cases when processing is needed for adjusting personal data);
8) "destruction of personal data" meaning actions resulting in the impossibility of
restoring the content of personal data in a information systems dedicated to personal data
and/or in the destruction of personal data material media;
9) "depersonalisation of personal data" meaning actions resulting in theimpossibility of identifying -- without the use of additional information -- the belonging of
personal data to a specific personal data subject;10) "information systems dedicated to personal data" meaning the combination of
the personal data contained in databases and the information technologies and hardware
allowing to process them;11) "transborder flow of personal data" meaning the dispatch of personal data to theterritory of a foreign state to a governmental body of a foreign state, to a foreign natural
person or a foreign legal entity.
Article 4. Legislation of the Russian Federation as Far as Personal Data Are

Concerned
1. The legislation of the Russian Federation in relation to personal data is based on theConstitution of the Russian Federation and international agreements of the RussianFederation and consists of this Federal Law and other federal laws determining instances andthe specificity of processing personal data.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Part 2 of Article 4 of this Federal Law.
The new wording shall extend to the legal relations arising from July 1, 2011
See the text of the Part in the previous wording
2. On the basis of and pursuant to federal laws governmental bodies, the Bank of
Russia and local self-government bodies within the scope of their powers may adopt
normative legal acts, normative acts and legal acts (hereinafter referred to as "normative legal
acts") on specific issues relating to the processing of personal data. Such acts shall notcontain provisions limiting the rights of personal data subjects, establishing restrictions -- otherthan those envisaged by federal laws -- on the activities of operators or vesting in operators
the duties not envisaged by federal laws, and they are subject to official publication.
3. The specificity of processing of personal data effected without the use of automationmeans may be prescribed by the federal laws and other statutory legal acts of the RussianFederation with due regard for the provisions of this Federal Law.
4. Unless an international agreement of the Russian Federation establishes rules otherthan those specified under this Federal Law, the rules of the international agreement shallprevail.
Chapter 2. Principles of and Conditions for Processing Personal Data
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Article 5 of this Federal Law. The newwording shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wording
Article 5. The Principles of Processing of Personal Data
1. Personal data shall be processed lawfully and fairly.
2. Personal data shall be processed within the scope of specified, preset and lawful
purposes. It is hereby prohibited to process personal data if such processing is incompatible
with the purposes of personal data gathering.
3. It is hereby prohibited to pool up databases containing the personal data whose
processing is done for purposes which are mutually incompatible.
4. Processing shall involve only the personal data which meet the intended purposes ofthe processing thereof.
5. The contents and scope of processed personal data shall correspond to the declared
purposes of processing. Processed personal data shall not be excessive in respect of thedeclared purposes of processing thereof.
6. When personal data are being processed one shall ensure the correctness of thepersonal data, the sufficiency thereof, and where necessary also feasibility in respect of the
purposes of personal data processing. The operator shall take the necessary measures ormake sure they are taken to delete or update incomplete or inaccurate data.

7. Personal data shall be stored in a form allowing to identify the subject of thepersonal data for a term not exceeding the one which is required by the purposes of personal
data processing, unless a storage term is established for the personal data by a federal law, acontract to which the personal data subject is a beneficiary or surety. Processed personal
data shall be destroyed or depersonalised when the purposes of processing are attained or if
the need for attaining such purposes is lost, except as otherwise established by a federal law.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Article 6 of this Federal Law. The newwording shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wording
Article 6. Conditions for Processing Personal Data
1. Personal data shall be processed so that the principles and the rules envisaged bythis Federal Law be observed. The processing of personal data is admissible in the following
cases:
1) the personal data are processed on the consent of the subject of the personal data
to his personal data's being processed;2) the personal data are to be processed for the purpose of attaining the objectives
envisaged by an international agreement of the Russian Federation or a law, for therealisation and execution of the functions, powers and duties vested in the operator by thelegislation of the Russian Federation;3) the personal data are to be processed for the purpose of exercising justice,performing a court's judgement, a decision of another body or official which have to be
performed according to the legislation of the Russian Federation on execution proceedings(hereinafter referred to as "the performance of a court's judgement");
Information on changes:

Federal Law No. 43-FZ of April 5, 2013 amended Item 4 of part 1 of Article 6 of this Federal
Law
See the previous text of the Item4) the personal data are to be processed for the purpose of providing the execution of
the powers of federal executive governmental bodies, the bodies of state non-budget funds,
the executive governmental bodies of subjects of the Russian Federation and local
self-government bodies and the functions of the organisations taking part in the provision ofstate and municipal services respectively which are envisaged in Federal Law No. 210-FZ of
July 27, 2010 on Organising the Provision of State and Municipal Services, including theregistration of a personal data subject on the integrated portal for state and municipal services
and/or the regional portals for state and municipal services;
Information on changes:

Federal Law No. 363-FZ of December 21, 2013 reworded Item 5 of part 1 of Article 6 of thisFederal Law. The new wording shall enter into force on July 1, 2014
See the Item in the previous wording5) personal data are to be processed for the purpose of executing the contract to which
the personal data subject is either a beneficiary or surety, in particular in the event of theexercise by the operator of the right thereof to assign the rights (claims) under such contract,and also of concluding a contract on the initiative of the personal data subject or a contract
under which the personal data subject is going to be a beneficiary or surety;6) the personal data are to be processed for the purpose of protecting the life, health orother vital interests of the personal data subject, unless the consent of the personal data
subject can be obtained;7) the personal data are to be processed for the purpose of exercising the rights andlawful interests of the operator or third persons or for the purpose of attaining goals of public
importance, unless in this case the rights and freedoms of the personal data subject are
infringed upon;
8) the personal data are to be processed for the purpose of pursuing the professional
activities of a journalist and/or the lawful activities of a mass medium or scientific, literary or
another creative activity, unless the rights and lawful interests of the personal data subject are
infringed upon;
9) the personal data are processed for statistical or other research purposes, except forthe purposes specified in Article 15 of this Federal Law, on the condition of compulsory
depersonalisation of the personal data;
10) the processing is done in respect of personal data to which access is provided by
the personal data subject or on the request thereof to an unlimited group of persons(hereinafter referred to as "the personal data made available to the general public by the
personal data subject");
11) the processing is done in respect of personal data which are subject to publicationor compulsory disclosure in accordance with a federal law.
2. The details of processing of special categories of personal data and also biometricpersonal data are established by Articles 10 and 11 of this Federal Law, respectively.
3. On the consent of the personal data subject the operator is entitled to entrust
another person with the processing of personal data, except as otherwise envisaged by afederal law, under a contract concluded with that person, for instance a state or municipal
contract or by means of a relevant act adopted by a governmental or municipal body(hereinafter referred to as "the operator's assignment"). The person processing personal dataon the operator's assignment shall observe the principles and rules governing the processingof personal data which are envisaged by this Federal Law. The operator's assignment shalldefine a list of the actions (operations) which are going to be committed (performed) inrespect of the personal data by the person processing personal data, and the purposes of theprocessing as well as that person's duty to observe the non-disclosure status of personal dataand it shall ensure the security of personal data when they are being processed and also referto the provisions governing the protection of processed personal data according to Article 19of this Federal Law.
4. The person processing personal data on the operator's assignment is not obligatedto seek the consent of the personal data subject to his personal data's being processed.
5. If the operator entrusts another person with the processing of personal data theoperator shall be liable to the personal data subject for the actions of said person. The person
processing personal data on the operator's assignment shall be liable to the operator.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Article 7 of this Federal Law. The newwording shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wordingArticle 7. The Non-Disclosure Status of Personal Data
The operators and the other persons which have access to personal data shall abstain
from disclosing to third persons and from disseminating the personal data without the consent
of the personal data subject, except as otherwise envisaged by a federal law.
Article 8. Generally Accessible Sources of Personal Data
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 amended Part 1 of Article 8 of this Federal Law.
The amendments shall extend to the legal relations arising from July 1, 2011
See the text of the Part in the previous wording
1. For informational support purposes, generally accessible sources of personal data(including reference books, address books) may be created. Generally accessible sources of
personal data may, with the consent in writing thereto of the subject of personal data,comprise his or her family name, first name, patronymic, year and place of birth, address,
subscriber's number, data on the profession and other personal data communicated by the
personal data subject.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 amended Part 2 of Article 8 of this Federal Law.
The amendments shall extend to the legal relations arising from July 1, 2011
See the text of the Part in the previous wording
2. The data on the subject of personal data shall be excluded at any time fromgenerally accessible sources of personal data at the request of the subject of personal data or
by decision of the court or other duly authorised state bodies.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Article 9 of this Federal Law. The newwording shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wording
Article 9. The Consent of a Personal Data Subject to His Personal Data's Being
Processed
1. A personal data subject shall take a decision on provision of his personal data andshall give his consent to their being processed without duress, by his own will and in his own
interest. The consent to the processing of personal data shall be specified, well-informed andin full awareness. The consent to the processing of personal data may be given by the
personal data subject or a representative thereof in any form that allows to acknowledge thatis has been obtained, except as otherwise established by a federal law. If the consent isobtained to the processing of personal data from a representative of the personal data subject
the powers of that representative to give consent on behalf of the personal data subject shallbe verified by the operator.
2. The consent to the processing of personal data may be revoked by the personal
data subject. If the consent to the processing of personal data is revoked by the personal data
subject the operator is entitled to keep processing the personal data without the consent of
the personal data subject if there are the grounds described in Items 2-11 of Part 1 of Article
6, Part 2 of Article 10 and Part 2 of Article 11 of this Federal Law.

3. The duty to provide evidence of the existence of the consent of the personal data
subject to his personal data's being processed or evidence of the existence of the grounds
described in Items 2-11 of Part 1 of Article 6, Part 2 of Article 10 and Part 2 of Article 11 of thisFederal Law is vested in the operator.
4. In the cases envisaged by a federal law, personal data are processed only on thewritten consent of the personal data subject. The following shall qualify as consent in writing
on a paper medium of a personal data subject containing the autograph signature of thepersonal data subject: consent filed as an electronic document signed in accordance with afederal law by means of an electronic signature. The consent in writing of the personal data
subject to his personal data's being processed shall for instance include the following:
1) the surname, first name, patronymic and address of the personal data subject, thenumber of his main personal identification document, the date of issue of said document andinformation on the body that has issued it;2) the surname, first name, patronymic and address of the representative of thepersonal data subject, the number of his main personal identity document, the date of issue of
said document and information on the body that has issued it, the details of the power ofattorney or the other document confirming the powers of that representative (if the consent isreceived from a representative of the personal data subject);3) the name or the surname, first name, patronymic and address of the operator whichseeks the consent of the personal data subject;4) the purpose of processing the personal data;
5) a list of the pieces of personal data to the processing of which the consent of thepersonal data subject is given;6) the name or the surname, first name, patronymic and address of the person thatprocesses the personal data on the operator's assignment, if such person is going to be
entrusted with the processing;7) a list of the actions involving the personal data to the commission of which theconsent is given and a general description of the personal data processing techniques usedby the operator;
8) the effective term of the consent of the personal data subject and also the manner inwhich it may be revoked, except as otherwise established by a federal law;9) the signature of the personal data subject.
5. The procedure for getting the consent of the personal data subject in the form of anelectronic document to his personal data's being processed for the purposes of providing stateand municipal services and also the services deemed necessary and compulsory for the
purposes of providing state and municipal services shall be established by the Government of
the Russian Federation.
6. If the personal data subject lacks capacity, consent to his personal data's being
processed shall be given by a legal representative of the personal data subject.
7. In the event of the death of the personal data subject a consent to his personal
data's being processed shall be given by the heirs of the personal data subject, unless suchconsent had been given by the personal data subject in his life.
8. Personal data may be received by the operator from a person other than the
personal data subject, if the operator is provided with evidence of the existence of the grounds
mentioned in Items 2-11 of Part 1 of Article 6, Part 2 of Article 10 and Part 2 of Article 11 of
this Federal Law.
Article 10. Special Categories of Personal Data
1. The processing of special categories of personal data concerning racial and/or
national background, political outlook, religious or philosophical convictions, state of health,intimate life shall not be allowed, except for the instances specified under Part 2 of this Article.
2. The processing of special categories of personal data specified under Part 1 of this
Article shall be allowed in instances when:
1) the subject of personal data gives his or her consent in writing to the processing of
his or her personal data;
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Item 2 of Part 2 of Article 10 of thisFederal Law. The new wording shall extend to the legal relations arising from July 1, 2011
See the text of the Item in the previous wording2) the personal data have been made available to the general public by the personal
data subject;
Information on changes:

Federal Law No. 266-FZ of November 25, 2009 supplemented Part 2 of Article 10 of thisFederal Law with Item 2.1
2.1) the processing of personal data is necessary in connection with the realisation of
the international treaties of the Russian Federation on readmission;
Information on changes:

Federal Law No. 204-FZ of July 27, 2010 supplemented Part 2 of Article 10 of this Federal
Law with Item 2.2
2.2) Personal data shall be processed in accordance with Federal Law No. 8-FZ of
January 25, 2002 on the All-Russia Census of the Population;
Information on changes:

Federal Law No. 216-FZ of July 21, 2014 amended Item 2.3 of part 2 of Article 10 of thisFederal Law. The amendments shall enter into force on January 1, 2015
Federal Law No. 261-FZ of July 25, 2011 supplemented Part 2 of Article 10 of this Federal
Law with Item 2.3. The Item shall extend to the legal relations arising from July 1, 20112.3) personal data are to be processed in accordance with the legislation on state
welfare, the labour legislation and the legislation of the Russian Federation on pensions understate pension schemes and labour pensions;
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Item 3 of Part 2 of Article 10 of thisFederal Law. The new wording shall extend to the legal relations arising from July 1, 2011
See the text of the Item in the previous wording3) personal data are to be processed for the purpose of protecting the life, health orother vital interests of the personal data subject or the life, health or other vital interests ofother persons, and no consent can be obtained from the personal data subject;4) personal data processing is effected for medical-disease-prevention purposes, forpurposes of establishing a medical diagnosis, providing medical-social services, provided
always that the personal data processing is conducted by a person who is professionallyengaged in medical activity and is obligated under the legislation of the Russian Federation tokeep medical secrecy;5) processing of personal data of members (participants) of a public association or
religious organisation is conducted by the appropriate public association or religiousorganisation operating in accordance with the legislation of the Russian Federation, forachieving legitimate goals envisaged in their constituent documents, provided that thepersonal data shall not be disseminated without the consent thereto in writing of the subjectsof personal data;
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Item 6 of Part 2 of Article 10 of thisFederal Law. The new wording shall extend to the legal relations arising from July 1, 2011
See the text of the Item in the previous wording6) personal data are to be processed for the purpose of establishing or exercising therights of the personal data subject or third persons, and equally in connection with theexercise of justice;
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Item 7 of Part 2 of Article 10 of thisFederal Law. The new wording shall extend to the legal relations arising from July 1, 2011
See the text of the Item in the previous wording7) personal data are processed in accordance with the legislation of the RussianFederation on defence, security, countering terrorism, transport safety, countering corruption,
operative search operations, execution proceedings and the criminal execution legislation of
the Russian Federation;
Information on changes:

Federal Law No. 205-FZ of July 23, 2013 supplemented Part 2 of Article 10 of this Federal
Law with Item 7.1
7.1) personal data obtained where it is established by the legislation of the RussianFederation shall be processed by the bodies of the procurator's office in connection with theexercise of procuracy supervision by them;
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Item 8 of Part 2 of Article 10 of thisFederal Law. The new wording shall extend to the legal relations arising from July 1, 2011
See the text of the Item in the previous wording8) personal data are processed in accordance with the legislation on compulsory typesof insurance or the insurance legislation;
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 supplemented Part 2 of Article 10 of this Federal
Law with Item 9. The Item shall extend to the legal relations arising from July 1, 20119) personal data are processed in the cases envisaged by the legislation of theRussian federation by governmental bodies, municipal bodies or organisations for the
purposes of placing children left without parental care into citizens' families for foster care.
Information on changes:

Federal Law No. 142-FZ of June 4, 2014 supplemented part 2 of Article 10 of this Federal
Law with Item 10. The Item shall enter into force upon the expiry of 60 days after the date of
the official publication of the said Federal Law10) personal data shall be processed in compliance with the legislation of the RussianFederation on Russian Federation citizenship.
3. The processing of personal data on previous conviction may be effected by the statebodies or municipal bodies within the limit of their respective powers vested in them under thelegislation of the Russian Federation and also by other persons in instances and in theprocedure to be prescribed in keeping with the federal laws.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 amended Part 4 of Article 10 of this Federal Law.
The amendments shall extend to the legal relations arising from July 1, 2011
See the text of the Part in the previous wording
4. The processing of special categories of personal data effected in the instances
specified under Parts 2 and 3 of this Article shall be immediately terminated, provided thereasons for which the processing was undertaken have been removed, except as otherwise
established by a federal law.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Article 11 of this Federal Law. The newwording shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wording
Article 11. Biometric Personal Data
1. The information which characterises the physiological and biological features of asingle individual whereby he/she can be identified (biometric personal data) and is used by anoperator to identify a personal data subject may be processed only if there is consent inwriting of the personal data subject, except for the cases envisaged by Part 2 of this article.
Information on changes:

Federal Law No. 142-FZ of June 4, 2014 amended part 2 of Article 11 of this Federal Law.
The amendments shall enter into force upon the expiry of 60 days after the date of theofficial publication of the said Federal Law
See the part in the previous wording
2. Biometric personal data may be processed without the consent of the personal datasubject in connection with the implementation of international agreements of the RussianFederation on readmission, in connection with the exercise of justice and the performance ofcourt's judgements and also in the cases envisaged by the legislation of the RussianFederation on defence, security, countering terrorism, transport safety, countering corruption,
operative search operations, the state service, the criminal execution legislation of theRussian Federation and the legislation of the Russian Federation on the procedure for exitfrom the Russian Federation and entry in the Russian Federation, on Russian Federation
citizenship.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Article 12 of this Federal Law. The newwording shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wording
Article 12. The Transborder Personal Data Flow
1. The transborder flow of personal data to the territories of the foreign states being aparty to the Convention of the Council of Europe for the Protection of Individuals with regard
to Automatic Processing of Personal Data and also of the other foreign states that ensure
adequate protection in respect of the rights of personal data subjects shall take place inaccordance with this Federal Law and it may be prohibited or restricted for the purposes ofprotecting the foundation of the constitutional system of the Russian Federation, the morals,
health, rights and lawful interests of citizens and safeguarding national defence and state
security.
2. The empowered body in charge of the protection of the rights of personal data
subjects shall endorse a list of the foreign states which are not a party to the Convention of
the Council of Europe for the Protection of Individuals with regard to Automatic Processing of
Personal Data and ensure adequate protection of the rights of personal data subjects. A state
not being a party to the Convention of the Council of Europe for the Protection of Individuals
with regard to Automatic Processing of Personal Data may be included in the list of the foreignstates which ensure an adequate protection of the rights of personal data subjects if thenorms of law and applicable personal data security measures effective in said state comply
with the provisions of said Convention.
3. Before the beginning of the transborder personal data flow the operator shall makesure that the foreign state to whose territory the personal data are sent provide adequate
protection for the rights of personal data subjects.
4. The transborder flow of personal data to the territories of the foreign states which do
not provide adequate protection for the rights of personal data subjects may take place in:1) case when there is a consent in writing of a personal data subject to the transborder
flow of his personal data;2) the cases envisaged by international agreements of the Russian Federation;3) the cases envisaged by federal laws if it is required for the purposes of protecting
the foundation of the constitutional system of the Russian Federation, national defence andstate security, and also ensuring the safe, steady and secure operation of the transportcomplex, safeguarding the interests of person, society and state in the transport complex fromillegal interference;4) the event of implementation of a contract to which a personal data subject is a party;5) the event of protection of the life, health, other vital interests of a personal data
subject or other persons, if no consent in writing can be obtained from the personal data
subject.

Article 13. Specificity of Personal Data Processing within State or Municipal
Informational Personal Data Systems
1. The state and municipal bodies shall set up within the limits of their authority
established in accordance with federal laws, state or municipal informational personal datasystems.
2. Federal laws may establish the specificity of record-keeping of personal data withinstate and municipal informational personal data systems, including the use of various
methods of designating the belonging of personal data contained in the appropriate state ormunicipal personal data informational system to a specific subject of personal data.
3. The rights and freedoms of person and citizen may not be restricted for reasonsassociated with the use of various methods of personal data processing or designation of thebelonging of personal data contained in the state or municipal personal data informational
systems to a specific subject of personal data. It is not permitted to use methods ofdesignation of belonging of personal data contained in the state or municipal personal data
informational systems to a specific subject of personal data that may hurt the feelings ofcitizens or be derogatory to human dignity.
4. For purposes of ensuring the realisation of the rights of the subjects of personal datain connection with the processing of their personal data within state or municipal personal
data informational systems there may be created a state register of the population whose
legal status and procedure for work with which shall be such as prescribed under Federal
Law.
Chapter 3. Rights of the Subject of Personal Data
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Article 14 of this Federal Law. The newwording shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wording
Article 14. The Right of a Personal Data Subject in Respect of His Personal Data
1. A personal data subject is entitled to receive the information specified in Part 7 ofthis article, except for the cases envisaged by Part 8 of this article. The personal data subject
is entitled to demand from an operator that his personal data be adjusted, blocked or
destroyed if the personal data are incomplete, outdated, incorrect, illegally received or are notnecessary for the declared purpose of processing, and also to take the measures envisagedby a law for protecting his rights.
2. The information mentioned in Part 7 of the present article shall be provided by theoperator to the personal data subject in an accessible form and it shall not comprise personal
data concerning other personal data subjects, except for cases when there exist legal grounds
for disclosing such personal data.
3. The information specified in Part 7 of the present article shall be provided by theoperator to the personal data subject or a representative thereof when an inquiry is received
from the personal data subject or a representative thereof. The inquiry shall contain thenumber of the main personal identity document of the personal data subject or of therepresentative thereof, the date of issue of said document and information on the body that
has issued it, information confirming the participation of the personal data subject in relations

with the operator (the number of a contract, the date of conclusion of the contract, aconventional word designation and/or other details) or information otherwise confirming thefact that the personal data are processed by the operator, the signature of the personal data
subject or of the representative thereof. The inquiry may be sent as an electronic document
and signed by means of an electronic signature in accordance with the legislation of theRussian Federation.
4. If the information available in Part 7 of the present article and also the processed
personal data have been provided to the personal data subject to get acquainted with them on
his request, the personal data subject is entitled to apply again to the operator or to send a
repeated inquiry thereto for the purpose of getting the information mentioned in Part 7 of thepresent article and get acquainted with them such personal data at least 30 days after the
initial application or the dispatch of the initial inquiry, unless a shorter term is established by afederal law, a normative legal act adopted pursuant thereto or a contract to which the personal
data subject is a party or a beneficiary.
5. The personal data subject is entitled to apply again to the operator or to send a
repeated inquiry thereto for the purpose of getting the information specified in Part 7 of thepresent article and also for the purpose of getting acquainted with the processed personal
data before the expiry of the term specified in Part 4 of the present article, unless suchinformation and/or processed personal data have been provided to him for him to get
acquainted with them in full according to the results of the initial application. The repeatedinquiry shall contain a reason for sending a repeated inquiry apart from the details specified inPart 3 of the present article.
6. The operator is entitled to refuse to perform the personal data subject's repeatedinquiry that does not comply with the conditions set out in Parts 4 and 5 of the present article.
Such refusal shall be substantiated. The burden of providing proof of the existence of a goodreason for the refusal to perform the repeated inquiry shall be borne by the operator.
7. The personal data subject is entitled to obtain information concerning the processingof his personal data, for instance including the following:1) confirmation of the fact that the personal data are processed by the operator;
2) the legal grounds and the purposes of processing of the personal data;
3) the objectives of processing of the personal data and the methods of processing
used by the operator;
4) the name and location of the operator, information on the persons (except for theoperator's employees) who have access to the personal data or to whom the personal data
can be disclosed under a contract with the operator or under a federal law;5) the processed personal data relating to the relevant personal data subject, thesource from which they are obtained, except as another procedure is envisaged by a federal
law for the provision of such data;6) the term for completion of personal data processing, including the term of data
storage;7) the procedure for the personal data subject to exercise the rights envisaged by thisFederal Law;8) information on the completed or would-be transborder data flow;9) the name or the surname, first name, patronymic and address of the person
processing the personal data on the operator's assignment, if such person has been or isgoing to be entrusted with the processing;10) other information envisaged by the present Federal Law or other federal laws.
8. The personal data subject's right of access to his personal data may be restricted inaccordance with federal laws, for instance if:1) the processing of the personal data, including the personal data obtained as theresult of operative-search operations, counter-intelligence and intelligence activities takes
place for the purposes of national defence, state security and law and order;2) the personal data are processed by the bodies which have detained the personal
data subject on suspicions of having committed a crime or which have presented
criminal-case charges to the personal data subject or have imposed a measure of restraint on
the personal data subject before presenting charges, except for the cases envisaged by thecriminal procedural legislation of the Russian Federation when the suspect or accused isallowed to get acquainted with such personal data;
3) the personal data are processed in accordance with the legislation on countering thelegalisation of incomes received through crime (money laundering) and the financing ofterrorism;4) the personal data subject's access to his personal data infringes on the rights andlawful interests of third persons;5) the personal data are processed in the cases envisaged by the legislation of theRussian Federation on transport safety for the purposes of ensuring the steady and safe
operation of the transport complex, safeguarding the interests of the individual, society andstate in the area of the transport complex from illegal interference.
Article 15. Rights of the Subjects of Personal Data in Case of Their Personal Data
Being Processed for the Purposes of Promotion of Goods, Work, Services in
the Market and Also for Purposes of Political Propaganda
1. The personal data processing for purposes of promoting goods, work, services in themarket by implementing direct contacts with potential consumers with the help ofcommunications facilities and also for the purposes of political campaigning shall be allowed
only on the condition of the prior consent thereto of the subject of personal data. The said
personal data processing shall be regarded as being carried out without the prior consent
thereto of the subject of personal data, unless the operator has proved that such consent was
obtained.
2. The operator shall be obligated to immediately terminate at the request of thesubject of personal data the processing of his or her personal data as envisaged under Part 1of this Article.
Article 16. Rights of the Subjects of Personal Data in Decision-making Exclusively on
the Basis of the Automated Processing of Their Personal Data
1. It is prohibited to take exclusively on the basis of the automated processing of
personal data decisions generating legal consequences vis-a-vis the subject of personal dataor any otherwise affecting his or her rights and legitimate interests, except for the cases
envisaged under Part 2 of this Article.
2. The decision generating legal consequences vis-a-vis the subject of personal data orotherwise affecting his or her rights and legitimate interests may be taken exclusively on thebasis of the automated processing of his or her personal data only with the availability of theconsent in writing of the subject of personal data or in cases stipulated under federal laws
establishing measures towards ensuring the rights and legitimate interests of the subject of
personal data.
3. The operator shall be obligated to explain to the subject of personal data theprocedure for taking decision exclusively on the basis of the automated processing of his or
her personal data and eventual legal consequences of that decision, to provide him or her
with the possibility to put up an objection against that decision and also to explain theprocedure for protection by the subject of personal data of his or her rights and legitimate
interests.

Information on changes:

Federal Law No. 261-FZ of July 25, 2011 amended Part 4 of Article 16 of this Federal Law.
The amendments shall extend to the legal relations arising from July 1, 2011
See the text of the Part in the previous wording
4. The operator shall be obligated to consider the objection specified in Part 3 of this
Article within 30 days from the receipt thereof and notify the subject of personal data of theresults of considering that objection.
Article 17. Right to Appeal Actions or Inaction of the Operator
1. When the subject of personal data maintains that the operator is effecting theprocessing of his or her personal data in violation of the requirements of this Federal Law or isotherwise infringing upon his or her rights and liberties, the subject of personal data shall havethe right to appeal the actions or inaction of the operator before the authorised body forprotection of the rights of the subjects of personal data or judicially.
2. The subject of personal data shall be entitled to protection of his or her rights andlegitimate interests, including to reimbursement of damages and/or to compensation of moral
damage judicially.
Chapter 4. Obligations of the Operator
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Article 18 of this Federal Law. The newwording shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wording
Article 18. The Duties of the Operator when Personal Data Are Gathered
1. While gathering personal data the operator shall provide the personal data subject
on his request with the information envisaged by Part 7 of Article 14 of this Federal Law.
2. If the provision of personal data is compulsory under a federal law the operator shall
explain to the personal data subject the legal consequences of his refusal to provide his
personal data.
3. Except in the cases envisaged by Part 4 of this article, if personal data have been
received from a person other than the personal data subject then prior to starting theprocessing of such personal data the operator shall provide the following information to thepersonal data subject:
1) the name or the surname, first name, patronymic and address of the operator or
its/his representative;2) the purpose of processing of the personal data and the legal ground for it;3) the would-be users of the personal data;4) the rights of the personal data subject established by the Federal Law;
5) the source from which the personal data are received.
4. The operator is relieved from the duty to provide the personal data subject with theinformation envisaged by Part 3 of this article if:1) the personal data subject has been notified of his personal data's being processedby the relevant operator;
2) the personal data have been received by the operator under a federal law or inconnection with the performance of a contract to which the personal data subject is either abeneficiary or a surety;3) the personal data have been made available to the general public by the personal
data subject or have been received from a source open to the general public;4) the personal data are processed by the operator for statistical or other research
purposes, for the purpose of pursuing the professional activities of a journalist or scientific,
literary or other creative activity, unless in this case the rights and lawful interests of thepersonal data subject are infringed upon;
5) the provision of the information envisaged by Part 3 of the present article to thepersonal data subject infringes on the rights and lawful interests of third persons.
Information on changes:

Federal Law No. 242-FZ of July 21, 2014 supplemented Article 18 of this Federal Law withpart 5. The part shall enter into force on September 1, 2015
Federal Law No. 261-FZ of July 25, 2011 supplemented this Federal Law with Article 18.1.
The Article shall extend to the legal relations arising from July 1, 2011
Article 18.1. Measures for Ensuring the Operator's Executing the Duties Envisaged byThis Federal Law
1. The operator shall take the measures which are necessary and sufficient for
ensuring the execution of the duties envisaged by the present Federal Law and the normative
legal acts adopted pursuant thereto. The operator shall define on his own the composition of,and a list of, the measures which are necessary and sufficient for the execution of the duties
described by this Federal law and the normative legal acts adopted pursuant thereto, except
as otherwise envisaged by this Federal Law or other federal laws. Such measures may for
instance include the following:
1) the appointment of a person as responsible for organising the processing of
personal data by the operator being a legal entity;2) the promulgation of documents by the operator being a legal entity, defining theoperator's policies in respect of personal data processing, local acts on issues of personal
data processing and also local acts establishing procedures aimed at preventing anddetecting breaches of the legislation of the Russian Federation and the elimination of theconsequences of such breaches;3) the application of legal, organisational and technical measures for ensuring thesecurity of personal data in accordance with Article 19 of this Federal Law;
4) the exercising of internal control and/or audit of the compliance of personal dataprocessing with the present Federal Law and the normative legal acts adopted pursuant
thereof, with the provisions concerning personal data protection, the operator's policies inrespect of personal data processing, local acts of the operator;
5) an assessment of the harm that can be caused to a personal data subject when thisFederal Law is violated, the correlation of said harm and the measures taken by the operator
for ensuring the execution of the duties envisaged by this Federal Law;
6) the acquaintance of the operator's employees who directly process personal datawith the provisions of the legislation of the Russian Federation on personal data, for instancewith the provisions concerning the protection of personal data, the documents defining theoperator's policies in respect of personal data processing, local acts on issues of personal
data processing and/or the training of said employees.
2. The operator shall promulgate or otherwise provide unfettered access to the
document defining the operator's policies in respect of personal data processing and toinformation on implemented provisions governing personal data processing. An operator
gathering personal data by means of information-telecommunication networks shall use therelevant information-telecommunication network to publish a document defining the operator's
policies in respect of personal data processing and information on implemented provisions
governing the protection of personal data and also provide an opportunity for having access to
said document by means of the facilities of the relevant information-telecommunication
network.
3. The Government of the Russian Federation shall establish a list of measures aimed
at ensuring the execution of the duties envisaged by the present Federal Law and thenormative legal acts adopted pursuant thereto by the operators being governmental or
municipal bodies.
4. On an inquiry of the empowered body in charge of protection of the rights ofpersonal data subjects the operator shall provide the documents and the local acts specified
in Part 1 of this article and/or otherwise confirm that the measures mentioned in Part 1 of thisarticle have been taken.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Article 19 of this Federal Law. The newwording shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wording
Article 19. Measures for Ensuring the Security of Personal Data When They Are Being
Processed
1. While processing personal data the operator shall take the necessary legal,organisational and technical measures or make sure they are taken for the purpose ofprotecting the personal data from illegal or accidental access thereto, destruction,
modification, blocking, copying, provision and dissemination of the personal data as well asother illegal actions in respect of the personal data.
2. The security of personal data shall be for instance achieved by means of:1) detecting threats to the security of the personal data when they are being processed
in information systems dedicated to personal data;2) taking the organisational and technical measures for ensuring the security of thepersonal data when they are being processed in information systems dedicated to personal
data which are required to meet the personal data protection requirements whose observancemaintains the personal data protection levels established by the Government of the RussianFederation;3) using the information protection facilities which have in the established procedure
passed a conformity assessment procedure;4) assessing the effectiveness of the measures taken to ensure the security of thepersonal data before the commissioning of a information systems dedicated to personal data;5) keeping record of machine personal data media;
6) detecting the cases of unauthorised access to the personal data and taking
measures;7) restoring the personal data that have been modified or destroyed as the result of
unauthorised access thereto;8) establishing rules for getting access to the personal data processed in information
systems dedicated to personal data and also making sure all the actions involving thepersonal data in the information systems dedicated to personal data get registered andrecorded;9) control over measures taken to ensure the security of the personal data and thelevel of protection of information systems dedicated to personal data.
3. The following shall be established by the Government of the Russian Federation with
due regard to the possible harm to a personal data subject, the scope and content ofprocessed personal data, the type of activity whereby personal data are processed and thesignificance of threats to personal data security:
1) the levels of protection of personal data when they are being processed in
information systems dedicated to personal data depending on the threats to the security of thedata;2) the requirements applicable to the protection of personal data when they areprocessed in information systems dedicated to personal data whose implementation ensuresthe established levels of personal data protection;3) the requirements applicable to biometric personal data material media and thetechnologies used to store such data outside information systems dedicated to personal data.
4. The composition and contents of the organisational and technical measures
ensuring the security of personal data in the course of their processing in information systems
dedicated to personal data required to meet the requirements established by the Governmentof the Russian Federation in accordance with Part 3 of the present article as applicable topersonal data protection for each of the protection levels shall be established by the federal
executive governmental body empowered in the area of security and the federal executive
governmental body empowered in the area of countering technical intelligence and of thetechnical protection of information, within the scope of their powers.
5. The federal executive governmental bodies carrying out the function of state policy
elaboration and normative legal regulation in the established area of activity, thegovernmental bodies of the subjects of the Russian Federation, the Bank of Russia, thebodies of state non-budget funds and other governmental bodies within the scope of theirpowers shall adopt normative legal acts defining the threats to personal data security which
are significant when personal data are being processed in the information systems dedicatedto personal data used to pursue relevant types of activity, with account being taken of thecontents of personal data and the character and methods of processing thereof.
6. Apart from the threats to personal data security defined in the normative legal acts
adopted in accordance with Part 5 of the present article associations, unions and otherentities uniting operators are entitled to issue their decisions to define additional threats topersonal data security which are significant when personal data are being processed in theinformation systems dedicated to personal data used to pursue specific types of activity by themembers of such associations, unions and other entities uniting operators, with account being
taken of the contents of personal data and the character and methods of processing thereof.
7. Approval shall be sought for the draft normative legal acts mentioned in Part 5 of thepresent article from the federal executive governmental body empowered in the area of
security and the federal executive governmental body empowered in the area of countering
technical intelligence and the technical protection of information. Approval shall be sought forthe draft decisions specified in Part 6 of the present article from the federal executive
governmental body empowered in the area of security and the federal executive governmental
body empowered in the area of countering technical intelligence and the technical protectionof information, in the procedure established by the Government of the Russian Federation. A
decision of the federal executive governmental body empowered in the area of security andthe federal executive governmental body empowered in the area of countering technicalintelligence and the technical protection of information on refusal to approve the draft
decisions specified in Part 6 of the present article shall be substantiated.
8. Control and supervision over the implementation of the organisational and technicalmeasures for ensuring personal data security established in accordance with the present
article shall be exercised in the course of personal data processing in state information
systems dedicated to personal data by the federal executive governmental body empoweredin the area of security and the federal executive governmental body empowered in the area ofcountering technical intelligence and the technical protection of information, within the scopeof their powers and without the right of getting acquainted with the personal data processed in
information systems dedicated to personal data.
9. By a decision of the Government of the Russian Federation with due regard to thesignificance and contents of processed personal data the federal executive governmental
body empowered in the area of security and the federal executive governmental body
empowered in the area of countering technical intelligence and the technical protection of
information may be given the powers of control over the observance of the organisational andtechnical measures ensuring personal data security which are established in accordance withthe present article, when they are being processed in the information systems dedicated topersonal data which are used to pursue specific types of activity and are other than state
information systems dedicated to personal data, without the right of getting acquainted withthe personal data processed in information systems dedicated to personal data.
10. Personal data may be used and stored outside information systems dedicated topersonal data only on such material data media and by means of such data storage
technology that ensure the protection of the data from illegal or accidental access thereto or
the destruction, modification, blocking, copying, provision or dissemination thereof.
11. For the purposes of the present article the "threat to personal data security" meansa set of conditions and factors posing a danger of unauthorised, for instance accidental,
access to personal data that can result in the destruction, modification, blocking, copying,provision or dissemination of the personal data as well as other illegal actions in the course of
their being processed in an information system dedicated to personal data. The "level ofprotection of personal data" means a complex indicator characterising the requirements
whose observance ensures the neutralising of specific personal data security threats whendata are being processed in information systems dedicated to personal data.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Article 20 of this Federal Law. The newwording shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wording
Article 20. The Duties of the Operator when a Personal Data Subject Applies Thereto
or when an Inquiry Is Received from a Personal Data Subject or a
Representative Thereof and Also from an Empowered Body Charged withProtecting the Rights of Personal Data Subjects
1. Information shall be provided by the operator in the procedure envisaged by Article
14 of this Federal Law to a personal data subject or a representative thereof about theavailability of personal data relating to the relevant personal data subject as well as anopportunity for getting acquainted with the personal data if the personal data subject or arepresentative thereof applies for it or within 30 days after an inquiry is received from thepersonal data subject or a representative thereof.
2. In the event of refusal to provide information on the availability of personal data
concerning the relevant personal data subject or personal data to the personal data subject ora representative thereof if they have applied or when an inquiry is received from the personal
data subject or a representative thereof the operator shall be given a substantiated reply inwriting including reference to the provision of Part 8 of Article 14 of this Federal Law oranother federal law deemed a ground for such refusal, within 30 days after the application of
the personal data subject or the representative thereof or after the date of receiving the inquiry
from the personal data subject or the representative thereof.
3. The operator shall provide free of charge an opportunity to the personal data subject
or a representative thereof to get acquainted with the personal data concerning that personal
data subject. Within seven working days after the provision of information by the personal
data subject or a representative thereof confirming that the personal data are incomplete,
incorrect or out of date, the operator shall make the necessary amendments thereto. Withinseven working days after the provision of information by the personal data subject or arepresentative thereof confirming that such personal data have been illegally received or are
not necessary for the declared purpose of processing the operator shall destroy such personal
data. The operator shall notify the personal data subject or a representative thereof of theamendments made and the measures taken and shall take reasonable measures for notifying
the third persons to which that subject's personal data have been provided.
4. The operator shall provide the empowered body in charge of the protection of therights of personal data subjects, on that body's inquiry, with the necessary information within
30 days after receiving such inquiry.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Article 21 of this Federal Law. The newwording shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wording
Article 21. The Operator's Duty to Eliminate Breaches of the Legislation That Occurred
when Personal Data Were Being Processed, and to Update, Block and
Destroy Personal Data
1. If it is discovered that personal data have been wrongfully processed when the
personal data subject or a representative thereof applied or on an inquiry of the personal data
subject or a representative thereof or of the empowered body in charge of the protection of
the rights of personal data subjects, the operator shall block the wrongfully processed
personal data relating to that personal data subject or make sure they get blocked (if thepersonal data are processed by another person acting on the operator's assignment) from thetime of such application or of the receipt of said inquiry for the period of verification. If
incorrect personal data have been discovered when the personal data subject or arepresentative thereof applied or on their inquiry or on an inquiry of the empowered body incharge of the protection of the rights of personal data subjects, the operator shall block the
personal data relating to that personal data subject or make sure they get blocked (if thepersonal data are processed by another person acting on the operator's assignment) from thetime of such application or of the receipt of said inquiry for the period of verification, unless theblocking of the personal data infringes on the rights and lawful interest of the personal data
subject or third persons.
2. If the incorrectness of the personal data has been confirmed then on the basis of theinformation provided by the personal data subject or a representative thereof or theempowered body in charge of the protection of the rights of personal data subjects or theother necessary documents the operator shall adjust the personal data or arrange for the
adjustment thereof (if the personal data are processed by another person acting on theoperator's assignment) within seven working days after the provision of such data and shall lift
the blockage of the personal data.

3. If it is discovered that the operator or a person acting on the operator's assignmenthas wrongfully processed personal data then the operator shall within three working days after
the discovery stop the wrongful processing of the personal data or make sure the wrongfulprocessing of the personal data is stopped by another person acting on the operator's
assignment. If the legal processing of personal data cannot be ensured the operator shalldestroy such personal data or make sure they get destroyed within ten working days after the
discovery of wrongful personal data processing. About the elimination of the committed
wrongdoing or the destruction of the personal data the operator shall notify the personal data
subject or a representative thereof, and in the event of an application of the personal data
subject or a representative thereof or an inquiry of the empowered body in charge of theprotection of the rights of personal data subjects have been sent by the empowered body incharge of the protection of the rights of personal data subjects, also that body.
4. Once the purpose of processing of personal data has been achieved the operator
shall stop processing the personal data or make sure it is stopped (if the personal data areprocessed by another person acting on the operator's assignment) and destroy the personal
data or make sure they get destroyed (if the personal data are processed by another person
acting on the operator's assignment) within 30 days after the date of achievement of the
purpose of personal data processing, except as otherwise envisaged by a contract to which
the personal data subject is a beneficiary or surety, another agreement between the operator
and the personal data subject or if the operator is not entitled to process the personal data
without the consent of the personal data subject on the grounds envisaged by the present
Federal Law or other federal laws.
5. If a personal data subject has revoked his consent to his personal data's being
processed the operator shall stop processing them or make sure it is stopped (if the personal
data are processed by another person acting on the operator's assignment), and if the storageof the personal data is no longer needed for the purposes of personal data processing,destroy the personal data or make sure they get destroyed (if the personal data are processedby another person acting on the operator's assignment) within 30 days after the receipt of said
revocation, except as otherwise envisaged by a contract to which the personal data subject isa beneficiary or surety, another agreement between the operator and the personal data
subject or if the operator is not entitled to process the personal data without the consent of thepersonal data subject on the grounds envisaged by this Federal Law or other federal laws.
6. If the personal data cannot be destroyed within the term specified in Parts 3-5 of thisarticle the operator shall block such personal data or make sure they get blocked (if thepersonal data are processed by another person acting on the operator's assignment) andmake sure the personal data are destroyed within six months, except if another term isestablished by federal laws.
Article 22. Notification of Personal Data Processing
1. The operator shall, prior to commencing the processing of personal data, notify the
body duly authorised to protect the rights of the subjects of personal data of its intention tocarry out the processing of personal data, except for instances envisaged under Part 2 of this
Article.
2. The operator shall have the right to effect, without notifying the authorised body forprotection of the rights of the subjects of personal data, processing of personal data:
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Item 1 of Part 2 of Article 22 of thisFederal Law. The new wording shall extend to the legal relations arising from July 1, 2011

See the text of the Item in the previous wording
1) processed in accordance with the labour legislation;2) that were obtained by the operator in connection with making a contract the party towhich is the subject of personal data, unless the personal data are disseminated andfurnished to third persons without the consent thereto of the subject of personal data andprovided those are used by the operator exclusively to execute the said contract and toconclude contracts with the subject of personal data;
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 amended Item 3 of Part 2 Article 22 of this FederalLaw. The amendments shall extend to the legal relations arising from July 1, 2011
See the text of the Item in the previous wording3) that pertain to the members (participants) of a public association or religiousorganisation and are processed by a relevant public association or religious organisation
operating in accordance with the legislation of the Russian Federation, for achieving thelegitimate goals specified under their respective constituent documents, provided that thepersonal data are not disseminated or disclosed to third persons without the consent thereto
in writing of the subjects of personal data;
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Item 4 of Part 2 of Article 22 of thisFederal Law. The new wording shall extend to the legal relations arising from July 1, 2011
See the text of the Item in the previous wording4) made available to the general public by the personal data subject;5) that include only family names, first names and patronymics of the subjects ofpersonal data;6) that are essential for purposes of one-time passage of the subject of personal data
into the territory of location of the operator or for other similar purposes;
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 amended Item 7 of Part 2 of Article 22 of thisFederal Law. The amendments shall extend to the legal relations arising from July 1, 2011
See the text of the Item in the previous wording7) that are incorporated within the personal data informational systems, enjoying inaccordance with the federal laws the status of state automated informational systems andalso within the governmental informational systems of personal data created with the objectiveof protecting the security of the state and public order;8) that are processed without the use of automated means as is envisaged under thefederal laws or other statutory legal acts of the Russian Federation prescribing requirements
for ensuring the security of personal data in processing of same and for observance of therights of the subjects of personal data.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 supplemented Part 2 of Article 22 of this Federal
Law with Item 9. The Item shall extend to the legal relations arising from July 1, 20119) processed in the cases envisaged by the legislation of the Russian Federation ontransport safety, for the purposes of ensuring the steady and safe operation of the transportcomplex, protecting the interests of the individual, society and state in the area of thetransport complex from illegal interference.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 amended Part 3 of Article 22 of this Federal Law.
The amendments shall extend to the legal relations arising from July 1, 2011
See the text of the Part in the previous wording
3. The notice envisaged by part 1 of the present article shall be sent as a paper
document or an electronic document and signed by an empowered person. The notice shallcomprise the following information:1) name (family name, first name, patronymic), address of the operator;
2) the goal of personal data processing;3) categories of personal data;
4) categories of the subjects whose personal data are processed;5) legal grounds for personal data processing;6) a list of actions involving personal data, general description of the methods of
personal data processing used by the operator;
7) a description of the measures envisaged by Articles 18.1 and 19 of the present
Federal Law, for instance information on the availability of encoding (cryptographic) facilities
and a description of such facilities;
7.1) the surname, first name and patronymic of the natural person or the name of thelegal entity responsible for the organisation of personal data processing and their contact
phone numbers, postal and e-mail addresses;8) date of beginning the processing of personal data;9) period or condition for termination of personal data processing.
10) information on the existence or lack of transborder flow of personal data in thecourse of their processing;Information on changes:

Federal Law No. 242-FZ of July 21, 2014 supplemented part 3 of Article 22 of this Federal
Law with Item 10.1. The Item shall enter into force on September 1, 201511) information on personal data security arrangements according to the provisions
governing the protection of personal data established by the Government of the RussianFederation.
4. The authorised body for protection of the rights of the subjects of personal data shall,
within thirty days from receipt of notification of personal data processing, enter the data
specified under Part 3 of this Article and also data on the date of forwarding said notification
into the register of operators. The data found in the register of operators, except for the dataon the means of ensuring the security of personal data in the processing of same, shall be
open to the general public.
5. The operator may be required to bear the costs involved in considering thenotification of personal data processing by the authorised body for protection of the rights of

the subjects of personal data and also in connection with the entering of data into the registerof operators.
6. In case of the submission of incomplete or inaccurate data as stipulated under Part 3of this Article, the authorised body for protection of the rights of the subjects of personal data
shall have the right to demand that the operator specify the data submitted prior to entering
them into the register of operators.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 reworded Part 7 of Article 22 of this Federal Law.
The new wording shall extend to the legal relations arising from July 1, 2011
See the text of the Part in the previous wording
7. If the information mentioned in Part 3 of the present article is modified, and also if
personal data processing is terminated the operator shall notify accordingly the empowered
body in charge of the protection of the rights of personal data subjects within ten working days
after the date of which such modification or the date of termination of personal dataprocessing.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 supplemented Chapter 4 of this Federal Law with
Article 22.1. The Article shall extend to the legal relations arising from July 1, 2011
Article 22.1. The Persons Responsible for Organising Personal Data Processing in
Organisations
1. An operator being a legal entity shall appoint a person as responsible for organising
the processing of personal data.
2. The person responsible for personal data processing shall get directions directlyfrom the executive body of the organisation being the operator and shall report to that body.
3. The operator shall provide the person responsible for personal data processing with
the information mentioned in Part 3 of Article 22 of this Federal Law.
4. Among other things, the person responsible for personal data processing shall:1) exercise internal control over the operator's and its employees' observance of thelegislation of the Russian Federation on personal data, including the requirements to personal
data protection;2) inform the operator's employees of the provisions of the legislation of the RussianFederation on personal data and local acts on issues of personal data processing andrequirements to personal data protection;3) organise the acceptance and processing of applications and inquiries of personal
data subjects or their representatives and/or exercise control over the acceptance andprocessing of such applications and inquiries.
Chapter 5. Control and Supervision over the Processing of Personal Data.
Responsibility in Case of Violation of the Requirements of This Federal Law
Article 23. Body Duly Authorised to Protect the Rights of the Subjects of Personal Data
1. The authorised body for protection of the rights of the subjects of personal data
entrusted with control and supervision over compliance of personal data processing with therequirements of this Federal Law shall be a federal executive body performing the functions ofcontrol and supervision in the sphere of informational technologies and communications.
2. The authorised body for protection of the rights of the subjects of personal data shalldeal with applications of the subject of personal data regarding the conformity of the content
of personal data and methods of their processing with the goals of processing of same andtake relevant decisions.
3. The authorised body for protection of the rights of the subjects of personal data shallbe entitled:
1) to request that individuals and legal entities furnish the information necessary for therealisation of their powers and to receive that information free of charge;2) to carry out verification of data contained in the notification of personal dataprocessing or engage in order to carry out such verification the services of other governmental
bodies within their respective powers;
3) to demand that the operator update, block or destroy inaccurate or illegally obtained
personal data;
Information on changes:

Federal Law No. 242-FZ of July 21, 2014 supplemented part 3 of Article 23 of this Federal
Law with Item 3.1. The Item shall enter into force on September 1, 20154) to take in the procedure established under the legislation of the Russian Federation
measures to suspend or terminate the processing of personal data effected in violation of therequirements of this Federal Law;
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 amended Item 5 of Part 3 of Article 23 of thisFederal Law. The amendments shall extend to the legal relations arising from July 1, 2011
See the text of the Item in the previous wording5) to apply to the court with the statements of claim to protect the rights of the subjectsof personal data for instance for the protection of the rights of an unlimited group of persons,and represent the interests of the subjects of personal data in court;
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 supplemented Part 3 of Article 23 of this Federal
Law with Item 5.1. The Item shall extend to the legal relations arising from July 1, 20115.1) to send to the federal executive governmental body empowered in the area of
security and the federal executive governmental body empowered in the area of countering
technical intelligence and of the technical protection of information, as applicable to the field of
their activities, the information specified in Item 7 of Part 3 of Article 22 of this Federal Law;6) to file applications to the body effecting the licencing of activity of the operator forconsidering the issue of taking measures to suspend or annul a respective licence in theprocedure established under the legislation of the Russian Federation, when the prerequisiteof the licence to conduct that activity is the ban to transfer personal data to third persons
without the consent in writing thereto of the subject of personal data;7) to send to the bodies of prosecution and other law enforcement bodies materials totake decisions on starting legal proceedings on the basis of elements of crime associated withthe violation of rights of the subjects of personal data, in accordance with the relevant
jurisdiction;8) to make to the Government of the Russian Federation proposals on improving thestatutory legal regulation of protection of rights of the subjects of personal data;9) to bring to administrative liability persons guilty of violating this Federal Law.
4. The personal data that became known to the authorised body for protection of therights of the subjects of personal data as it conducts its activity shall be subject toconfidentiality of personal data.
5. The authorised body for protection of the rights of the subjects of personal data shallbe obligated:
1) to organise in accordance with the requirements of this Federal Law and otherfederal laws protection of the rights of the subjects of personal data;2) to consider the complaints and applications of citizens or legal entities on issues
associated with the processing of personal data and also to take within it respective powers
decisions, proceeding from the results of considering said complaints and applications;
3) to keep the register of operators;
4) to implement measures aimed at improving the protection of the rights of thesubjects of personal data;5) to take, in the procedure established under the legislation of the Russian Federation
upon the recommendation of the federal executive body authorised in the field of ensuring thesecurity or the federal executive body authorised in the field of countering technicalintelligence services and technical protection of information, measures to suspend or
terminate the processing of personal data;6) to inform the governmental bodies and also the subjects of personal data at theirapplications or inquiries of the state of affairs in the sphere of protection of rights of thesubjects of personal data;7) to perform other obligations as may be envisaged under the legislation of theRussian Federation.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 supplemented Article 23 of this Federal Law withPart 5.1. The Part shall extend to the legal relations arising from July 1, 20115.1. The empowered body in charge of the protection of the rights of personal data
subjects shall co-operate with bodies empowered to protect the rights of personal data
subjects in foreign states, for instance carry out the international exchange of information on
the protection of personal data subjects, and endorse a list of the foreign states that provide
adequate protection of the rights of personal data subjects.
6. Decisions of the authorised body for protection of the rights of the subjects ofpersonal data may be appealed judicially.
7. The authorised body for protection of the rights of the subjects of personal data shall,on an annual basis, send a report on its activity to the President of the Russian Federation,
the Government of the Russian Federation and the Federal Assembly of the RussianFederation. Said report shall be published in mass media outlets.
8. The financing of the authorised body for protection of the rights of the subjects ofpersonal data shall be effected for account of the federal budget funds.
9. Under the authorised body for protection of the rights of the subjects of personal
data shall be set up on a voluntarily basis a consultative board procedure for the formation
and activity of which shall be determined by the authorised body for protection of the rights ofthe subjects of personal data.

Information on changes:

Federal Law No. 261-FZ of July 25, 2011 amended Article 24 of this Federal Law. The
amendments shall extend to the legal relations arising from July 1, 2011
See the text of the Article in the previous wording
Article 24. Liability for Violation of the Requirements of This Federal Law
1. Persons guilty of violation of the requirements of this Federal Law shall bear theliabilities envisaged by the legislation of the Russian Federation.
2. Moral harm sustained by a personal data subject as the result of an infringement on
his rights, a breach of the personal data processing rules established by this Federal Law andalso provisions concerning personal data protection established in accordance with thisFederal Law is subject to compensation in accordance with the legislation of the RussianFederation. Compensation for moral harm shall be provided irrespectively of compensation forproperty harm and the damages sustained by the personal data subject.
Chapter 6. Final Provisions
Article 25. Final Provisions
1. This Federal Law shall take effect upon the expiration of one hundred and eightydays from its official publication.
2. Following the effective day of this Federal Law, the processing of personal data thatwere incorporated within the personal data informational systems prior to its effective day
shall be carried out in accordance with this Federal Law.
Information on changes:

Federal Law No. 261-FZ of July 25, 2011 supplemented Article 25 of this Federal Law withPart 2.1. The Part shall extend to the legal relations arising from July 1, 2011
2.1. The operators that had been processing personal data before July 1, 2011 shallprovide the empowered body in charge of the protection of the rights of personal data subjects
with the information specified in Items 5, 7.1, 10 and 11 of Part 3 of Article 22 of the present
Federal Law by January 1, 2013.
3. Abrogated from July 1, 2011.
Information on changes:

See the text of Part 3 of Article 25
4. The operators that have been carrying out the processing of personal data prior to
the effective day of this Federal Law and continue effecting that processing following its
effective day shall be obligated to send to the authorised body for protection of the rights ofthe subjects of personal data, except for the instances specified under Part 2 of Article 22 of
this Federal Law, a notification provided under Part 3 of Article 22 of this Federal Law, notlater than January 1, 2008.
Federal Law No. 43-FZ of April 5, 2013 supplemented Article 25 of this Federal Law
with part 5
Information on changes:

5. The relationships that have to do with personal data processing carried out by statebodies, legal entities and natural persons when state and municipal services are being
provided, state and municipal functions are performed in the subject of the RussianFederation that is the federally-significant City of Moscow are regulated by the present
Federal Law, except as otherwise envisaged by the Federal Law on the Details of Regulationof Specific Legal Relationships in Connection with the Joining of Territories to the Subject of
the Russian Federation That Is the Federally-Significant City of Moscow and on Amending
Certain Legislative Acts of the Russian Federation.
President of the Russian Federation
The Kremlin, Moscow

V. Putin