International Data Transfers: Requirements for Foreign Businesses in Russia

Can a foreign company transfer personal data from Russia?

A foreign company may transfer personal data from Russia if it complies with the applicable localization rules and completes the required cross-border transfer procedures. Before the transfer, the operator should confirm the legal basis, assess the foreign recipient and destination, and notify Roskomnadzor. The point at which the transfer may begin depends on whether the destination is included in Roskomnadzor’s list of countries providing adequate protection.

Identify the transfer before configuring group systems
A transfer issue can arise without anyone sending a file abroad. A global CRM may synchronize records automatically, or an overseas team may view data held in Russia. Remote access by a foreign recipient may therefore amount to a cross-border personal data transfer even when the database remains on a Russian server.
This affects foreign groups at three common stages:

Market entry

A company forming a Russian subsidiary, branch or representative office must decide where employee and customer data will enter its systems.
Group integration

An existing entity may be connected to a global HRIS, ERP, CRM, cloud platform or support function.
Established operation

Headquarters may already receive data through integrations or user accounts that were never assessed as a separate flow.

Build the Russian data layer first

When an operator collects personal data of Russian citizens, the operations specified in Article 18(5) of Federal Law No. 152-FZ must use databases located in Russia, unless an exception applies. Since 1 July 2025, foreign databases may not be used for those operations.

The Russian collection and storage arrangement should therefore be selected before launching forms, recruitment tools or customer systems. A local replica added after a foreign platform has collected the data does not change the original sequence. A copy may be sent abroad only after the local stage and the transfer procedure are in place.

Assign responsibility for each data flow

The operator is the company that determines why and how personal data is processed. Depending on the arrangement, this may be the Russian entity, the foreign parent or both in relation to their own decisions.

Contracts, system permissions and the notification should describe the same route. Documents naming one recipient will not cover access granted to another group company.

Assemble the filing record before go-live

Controlled international personal data transfer between Russian infrastructure and an overseas office

The cross-border data transfer requirements should be treated as a launch gate. Before opening access, the operator should record:

• the purpose, legal basis, data and groups of individuals;
• the countries and details of the intended recipients;
• recipient safeguards and conditions for ending processing;
• local data law if a country is outside the adequate-protection list;
• the assessment date.

This notification is separate from the general processing notification. Because the transfer filing includes the latter’s date and number, the Article 22 notification should be checked first.

Russian law requires a recipient assessment but does not prescribe a universal document entitled a "transfer impact assessment." The company may choose a format that preserves the underlying information and conclusion.

Consent may provide a legal basis, but it is not an automatic standalone requirement for all international transfers of data and does not replace the procedure.

When overseas access may begin

Country on the adequate-protection list. Access may generally be enabled after the notification is filed. The company must still be able to implement a subsequent restriction or prohibition.

Country outside the adequate-protection list. Access should remain disabled until the ten-business-day review period has ended. If Roskomnadzor requests additional information, the review period is suspended.

Transfer prohibited by Roskomnadzor. The company must block further access, require the recipient to delete the data already received and obtain confirmation of deletion.

Purpose-limited access to personal data with selected records protected by access controls

Purpose and scope of overseas access

A protected connection can still create exposure if the overseas use conflicts with the original collection purpose or the dataset is excessive. Access to payroll totals, for example, does not automatically justify access to every supporting employee document.

The business owner should explain why each data field is needed so legal, HR and IT teams can limit access.

International data transfer policy and change control

The policy should operate as a change-control mechanism. It can identify the approved system, recipient, country, purpose, owner, filing status and evidence for each route.

A new provider, destination, data category or form of headquarters access should return the flow to review. Procurement, HR, sales and IT should use the same approval route.

How we can support

We help foreign businesses map employee, payroll, accounting and corporate data flows between Russian operations, headquarters and providers. We identify the information required from recipients and prepare compliance documentation.

We can also compare contracts, notification data and system settings before overseas access is enabled, so the Russian operation and headquarters work from the same transfer description.

Do you need an expert advice?

Ask questions and make an appointment by phone

+7 (495) 797-10-99

Call back