Russia regulations for tech companies: 152-FZ, critical infrastructure, e-documents, signatures and the Bank of Russia

This is the fourth article in a series on what a technology company faces in different regions. The earlier ones covered the UAE, the Gulf and Egypt and the CIS. Russia regulations get an article of their own because they are the densest of all and changed faster than any others in 2025–2026. The five questions are the same: personal data, cybersecurity, Bank of Russia requirements, e-invoicing and electronic signatures.

The frame is the same too: primary sources only, meaning federal laws, government resolutions and agency orders on the official legal information portal, plus acts of Roskomnadzor (the data protection and communications regulator), FSTEC (the Federal Service for Technical and Export Control), the FSB (the Federal Security Service), the Federal Tax Service (FNS), the Ministry of Digital Development and the Bank of Russia. Every fact was checked against its primary source, and most were checked twice: when collected, and again by an independent comparison with the same document, as of 27–28 September 2026. I do not give legal opinions: the map shows which act to read, and applying it to your company is a lawyer’s job.

Russia regulations: the essentials in thirty seconds

• Data of Russian citizens is collected only into Russian databases. Since 1 July 2025 this is a direct ban, the person’s consent does not lift it, and the law applies to foreign companies that process Russian citizens’ data under a contract with them or with their consent.
• A breach is reported twice: to Roskomnadzor within 24 and 72 hours and to GosSOPKA, the state system for computer incidents, within 24 hours. A repeat breach costs up to 3% of revenue, but no more than RUB 500 million.
• Significant critical infrastructure objects need a Russian stack: software from the national register, trusted software and hardware systems by 2030, and licences that foreign companies cannot get.
• B2B e-invoicing is voluntary, but an electronic invoice goes only through Russian EDO (electronic document exchange) operators, is signed with a qualified signature, and an employee signs it with a machine-readable power of attorney.
• A bank’s contractor gets the Bank of Russia’s requirements through the contract: system outsourcing, the register of IT suppliers, certified or assessed software and, as the regulator recommends, Russian penetration testers.

Personal data: 152-FZ

Who it applies to. Law No. 152-FZ also applies to foreign companies and individuals who process data of Russian citizens under a contract with them or with their consent. A presence in Russia is not required for that.

Localisation. Since 1 July 2025, part 5 of Article 18 directly forbids recording, storing, accumulating and retrieving data of Russian citizens using databases outside Russia when that data is collected, including over the internet. Before, the rule was worded as a duty to use Russian databases. The exceptions are narrow: purposes set by an international treaty or a law and duties the law places on the operator itself, court proceedings, public services, journalism, science and creative work. Neither the person’s consent nor performance of a contract with them counts as an exception. The fine for a legal entity is RUB 1 to 6 million, and RUB 6 to 18 million for a repeat violation.

Notices. Before processing starts, the operator notifies Roskomnadzor, and the notice states where the database with Russian citizens’ data is located and whether there is cross-border transfer. Only three exemptions remain, and none of them fits an ordinary company. Cross-border transfer also needs its own notice in advance. Data may go to countries on the adequacy list right after the notice, and to all others no sooner than 10 business days later, or later still if Roskomnadzor requests more information. The UAE, Saudi Arabia, Egypt, Bahrain, Oman and Kuwait are not on the list. Since 26 July 2026 a country’s participation in Convention 108 no longer makes it adequate automatically, but as of late September 2026 Roskomnadzor has not revised the list itself, so the status of EU countries, the UK, Turkey, Armenia and others may change at any moment.

Breaches. If a breach violated people’s rights, the operator notifies Roskomnadzor twice: within 24 hours about the incident, its causes and the measures taken, and within 72 hours about the results of the internal investigation. Separately, information about the computer incident goes within 24 hours to NCCCI (the National Coordination Centre for Computer Incidents, which runs GosSOPKA); those not connected to its infrastructure submit it through Roskomnadzor’s form. The fine for failing to notify is RUB 1 to 3 million.

Scale of the breach	Fine for a legal entity
1,000 to 10,000 people or 10,000 to 100,000 identifiers	RUB 3–5 million
10,000 to 100,000 people or 100,000 to 1 million identifiers	RUB 5–10 million
More than 100,000 people or more than 1 million identifiers	RUB 10–15 million
Special categories / biometrics	RUB 10–15 / 15–20 million
Repeat breach	1–3% of revenue, from RUB 20 or 25 million to RUB 500 million

The turnover fine can be reduced only if all three conditions hold: for three years in a row the company spent at least 0.1% of revenue on information security through licensed providers, it documented compliance within the 12 months before the breach was detected, and there are no aggravating circumstances. Criminal liability under Article 272.1 of the Criminal Code for using and transferring illegally obtained personal data goes up to 4 years in prison, and up to 8 for cross-border transfer.

Two more rules from 2025: since 1 September, consent to processing must be given separately from any other documents the person signs, and at the request of the Ministry of Digital Development the operator must anonymise data and hand it over to a state system. Technical protection measures for ordinary systems are still set by Government Resolution No. 1119 and FSTEC Order No. 21.

Cybersecurity: 187-FZ and beyond

Critical infrastructure. KII (critical information infrastructure) entities are government bodies and Russian legal entities that own systems in 14 sectors, from healthcare and communications to banking and industry, as well as legal entities that make these systems work together. Sole proprietors have been excluded since 1 September 2025. In February 2026 the government approved a list of standard industry KII objects (Order No. 360-r, 397 items), and only objects of these types are subject to categorisation. The list includes systems in data centres that provide computing resources to significant healthcare and financial market objects, so a cloud provider can itself become a KII entity.

Incidents. All KII entities, not only owners of significant objects, report computer attacks and incidents to the FSB through NCCCI: within 3 hours for a significant object, within 24 hours for the rest and for attacks. KII entities in the financial market also report to the Bank of Russia within the same deadlines.

Russian stack. Since 1 September 2025, owners of significant objects must use software from the unified register of Russian software (since 1 March 2026 software from the list of programs built for own needs also counts) and meet the requirements for software and hardware systems, but as of late September 2026 the government has approved neither those requirements nor the procedure and deadlines for the switch. For government bodies and customers under 223-FZ (the procurement law for state companies), foreign software on significant objects has been banned since 1 January 2025. Significant objects must finish moving to predominant use of trusted software and hardware systems by 1 January 2030.

What this means for a contractor. Remote access to a significant object to update or manage software is not allowed for people who do not work for the entity or its subsidiaries and dependent companies, and where it cannot be ruled out technically, protective measures are needed. From 1 March 2027, a contractor with access to a significant object calculates a maturity-level indicator (Uzi) before getting access and then at least once every three years. FSTEC licences for technical protection and FSB licences for encryption tools are not available to foreign legal entities, and since 2025 organisations covered by Presidential Decree No. 250 may not use security tools and information security services from unfriendly states.

Hosting and messengers. A hosting provider may operate only if it is on Roskomnadzor’s register, and it reports incidents to NCCCI within 24 hours. An organiser of information distribution (ORI), meaning in practice any service that receives and processes users’ messages (state systems and licensed telecom operators are exempt for their licensed activity), since 1 January 2026 has had to store metadata and user information in Russia for 3 years and message content for 6 months, and if it uses encryption, give the FSB the information needed to decode it. Since September 2025, breaching the requirements for equipment used in law-enforcement surveillance carries a turnover fine.

Bank of Russia: what ends up in the contract

Bank of Russia rules almost never address an IT contractor directly, except providers of payment applications under Regulation 821-P. The requirements come through the bank:

• Cloud as outsourcing. Since 1 October 2025, Chapter 8¹ of Regulation 716-P treats hosting and processing information in third parties’ systems as “information system outsourcing”. For critical processes the bank writes into the contract the contractor’s duties on confidentiality, operational resilience, cross-border transfer and providing information for supervision, sets penalties and prepares an exit strategy.
• Register of IT suppliers. The bank keeps it under Regulation 850-P, and supplier staff with access count as an internal threat. From 1 January 2028 the bank will record, for each component of its systems, the developer’s INN (Russian taxpayer number) or foreign tax number and country, so in practice it is likely to ask vendors for this information.
• Certified software. Applications the bank gives its customers go through FSTEC certification or an assessment at assurance level OUD4 (EAL4) or higher.
• Checks. A penetration test every year, an external assessment under GOST R 57580 at least every two years. Bank of Russia recommendations advise hiring a penetration tester with an FSTEC licence and keeping the specialists and testing tools in Russia.
• Incidents. The bank reports an information security incident to the Bank of Russia within 3 hours.

E-invoicing: EDO, UPD and traceability

Unlike Saudi Arabia and the CIS, Russia works on a post-audit model. In B2B an electronic VAT invoice is voluntary: the parties agree on it themselves. But if it is electronic, it goes only through Russian EDO operators on the FNS register, which must set up roaming with each other, in the FNS format (UPD, the universal transfer document, version 5.03) and with a qualified signature. The FNS sees the data later, through the VAT return (for traceable goods, on the next business day).

The electronic form is mandatory only in narrow areas: for imported goods under traceability, for acceptance under 44-FZ government contracts through EIS (the unified procurement information system), in B2C through online cash registers and, since 1 September 2026, in freight, where transport documents became electronic by default. Since 1 January 2026 the VAT rate is 22%, and the formats have been updated. Since 2025, companies on the simplified tax regime have also become VAT payers: at first those with income above RUB 60 million, and since 2026 those above RUB 20 million (the threshold will later fall to RUB 15 and 10 million), so small IT companies issue VAT invoices too.

Electronic signatures: 63-FZ and MChD

Only a qualified electronic signature (KEP) is equal to a handwritten one without reservation. Simple and non-qualified signatures work where a law or an agreement between the parties provides for them. A company’s head gets a KEP free of charge from the FNS certification centre, and an employee signs with their own KEP and attaches a machine-readable power of attorney (MChD) signed with the company’s KEP; since 2026 it must include the representative’s SNILS (individual insurance account number) and INN. Server-side signing is legal, but if a KEP signs automatically in a company’s information system, it must be the KEP of the company itself as the system operator.

For foreigners the barriers are high. Right now only Russian citizens can get a KEP remotely using biometrics; everyone else must appear in person for their first certificate (renewal is possible with a valid KEP), and the certificate must include SNILS and INN. From 1 September 2027, Law 315-FZ gives remote identification at the FNS certification centre through ESIA (the Gosuslugi public services login) and biometrics to foreigners who head a company or are registered as sole traders. Foreign enhanced signatures are recognised only under an international treaty (I found one, with Belarus) or by agreement between the parties; signatures recognised by agreement cannot be used in state systems. From 1 March 2027 a national certification centre will issue security certificates to websites and Russian software.

Calendar

• 01.10.2026 (already in force): the DOPP regime for importing traceable goods from the EAEU; new deadlines for notifying the Bank of Russia on money transfers.
• 01.01.2027: branches of foreign banks move to the standard level of information protection; new notification deadlines for non-bank financial organisations.
• 01.03.2027: the national certification centre; contractors with access to significant KII objects calculate the maturity-level indicator (Uzi).
• 01.04.2027: only the new format of the corrective VAT invoice.
• 01.09.2027: foreigners who head a company or are registered as sole traders can get a KEP from the FNS certification centre remotely, via Gosuslugi and biometrics; a single MChD form on Gosuslugi.
• 01.01.2028: banks record the developer country of each component of their systems.
• 01.01.2030: deadline for KII entities to move to predominant use of trusted software and hardware systems on significant objects.
• No date announced: revision of the adequacy list after 265-FZ; the procedure for moving significant objects to Russian software.

Where a tech company should start

1. Collect Russian citizens’ data into a Russian database. This applies to a foreign service too if it processes Russian citizens’ data under a contract with them or with their consent, and consent itself does not lift the ban.
2. File notices with Roskomnadzor in advance. Both on starting processing and on cross-border transfer; for countries not on the list, allow 10 business days.
3. Set up two breach reporting channels. Roskomnadzor within 24 and 72 hours and GosSOPKA within 24 hours.
4. Find out whether you have become a KII entity or an ORI. Cloud for significant objects, a messenger or hosting carry obligations of their own, not only contractual ones.
5. For work with banks, prepare software certification, penetration testing (the Bank of Russia recommends Russian testers) and, by 2028, information on the country where each component was developed.
6. For document exchange, connect an EDO operator, get a KEP and issue MChDs to employees.

What I do not do

• I do not give legal opinions. The map shows acts and articles; how they apply to a specific company is for a lawyer to judge.
• I do not pass off drafts as law in force. Where an act is only under discussion or has not come into force yet, the text says so.
• I do not promise the map will not age. Russian rules in this area change several times a year; reread it before you decide anything.

Frequently asked questions

Can data of Russian citizens be stored abroad with their consent?

No. Since 1 July 2025, part 5 of Article 18 of 152-FZ forbids using databases outside Russia when collecting data of Russian citizens, and the person’s consent is not an exception. Once the data has been collected into a Russian database, it may be transferred abroad under the cross-border transfer rules.

Where and how quickly must a personal data breach be reported?

To Roskomnadzor within 24 hours about the incident and within 72 hours about the results of the investigation. Separately, within 24 hours to NCCCI (GosSOPKA), or through Roskomnadzor’s form if the company is not connected to its infrastructure.

What is the maximum fine for a breach?

Up to RUB 15 million for a first breach, and up to RUB 20 million for a breach of biometric data. For a repeat breach, 1 to 3% of the previous year’s revenue, no less than RUB 20 or 25 million and no more than RUB 500 million.

Is e-invoicing mandatory in Russia?

In B2B, generally not: the parties agree on it themselves. The electronic form is mandatory for imported goods under traceability, for acceptance under government contracts through EIS, in B2C through online cash registers and, since 1 September 2026, for transport documents in freight. An electronic invoice goes only through a Russian EDO operator with a qualified signature.

Can a foreigner get a qualified electronic signature?

Yes, but for now the first KEP is issued only in person, and the certificate needs SNILS and INN. So far only Russian citizens can get one remotely using biometrics. From 1 September 2027 this becomes possible for foreigners who head a company or are registered as sole traders: at the FNS certification centre (remote only there) and at the Bank of Russia and Treasury centres. Commercial certification centres are unchanged.

Sources

• Federal Law No. 152-FZ “On Personal Data”.
• Roskomnadzor Order No. 128: list of countries with adequate protection.
• Federal Law No. 265-FZ amending Article 12 of 152-FZ.
• Federal Law No. 187-FZ “On the Security of Critical Information Infrastructure”.
• FSB Order No. 547 on reporting incidents.
• FSTEC Order No. 239 on requirements for significant KII objects.
• Federal Law No. 63-FZ “On Electronic Signatures”.
• Federal Law No. 315-FZ amending 63-FZ.
• Ministry of Finance Order No. 14n on the procedure for exchanging electronic VAT invoices.
• Bank of Russia Regulation No. 851-P.
• Bank of Russia Regulation No. 850-P.
• Bank of Russia Directive No. 6906-U (outsourcing in 716-P).

Need a consultation?

If your product works with users or customers in Russia, book a call. We will work out where the data must be kept, which notices you need and which requirements will reach you through your customers.