UPDATED: This post was first published on December 19, 2014; it is now being updated to reflect President Putin’s signature of the bill discussed below on 31 December, 2014.
In July 2014, Russia enacted Law 242-FZ (the “Localization Law”). The Localization Law amends the Russian Federal Law on Information, Information Technology and Information Protection, and would introduce a new requirement for certain businesses (including in particular those processing data concerning Russian citizens and also maintaining offices in Russia) to ensure that personal data relating to Russian citizens be physically stored and processed in Russian territory, subject to certain exceptions. The exact scope of this requirement and its exceptions — including whether covered data relating to Russian citizens can be “mirrored” in data centers outside Russia or not — remain somewhat unclear at this time.
The Law was scheduled originally to come into effect on 1 September 2016, but on December 17, the Russian State Duma voted to enact a bill to move the implementation date of the Localization Law forwards to 1 September 2015. This move follows an effort earlier this fall to bring the Localization Law’s implementation date forwards to 1 January 2015, which was ultimately set aside.
The “bring forward” bill was signed by the Russian President, Mr. Putin, on 31 December 2014 and is now enacted. This means that the Localization Law is now scheduled to come into effect on 1 September, 2015.