Data operators may collect and process personal data where any of the following conditions are met:

• The data subject consents;
• The processing is required by law or under an international treaty;
• The processing is required for administration of justice, execution of a court order or any other statements of public officers to be executed;
• The processing is required for provision of state or municipal services;
• The data operator needs to process the data to perform or conclude a contract to which the data subject is a party, a beneficiary party or guarantor;
• The processing is carried out for statistical or scientific purposes (except where processing is used also for advertising purposes), provided that it is depersonalized;
• The processing protects the data subject’s vital interests and it is impossible to obtain the data subject’s consent;
• The processing is required for execution of the data operator’s or third parties’ rights or for purposes important for the community, provided the data subject’s rights are not infringed;
• The processing is carried out by a journalist or media organization as a part of its professional activities or for the purposes of scientific, literary or other creative activities, except if the processing would infringe upon the data subject’s rights;
• The personal data is subject to publication or mandatory disclosure under law; or
• The personal data that is processed by participants under the conditions set forth in an experimental regulatory regime (sometimes referred to as a “regulatory sandbox") in depersonalized form.

Consent by the data subject is by far the most common legal basis for data processing in Russia.  In most cases, consent may be given in any form, but it must be in some tangible format, as the data operator bears the burden of proof to show that consent was given, so, it is important to keep careful records of consents.

In some cases, however, DPA requires an explicit written consent:

• where the personal data is allowed by the data subject for dissemination;
• where sensitive or biometrical data is processed;
• where a legally binding decision is made solely on the grounds of the automated processing of personal data; or
• where employee personal data is transferred to third parties.

Consent is deemed to have been given in writing where it is signed by hand or in electronic form with a digital signature.

Written consent (except personal data allowed by the personal data subject for dissemination – there are special rules for this) must contain the following information:

• The identity of the data subject, (which can be made by reference to residential address and passport details);
• Identification of a data representative (if any);
• The identity and address of the data operator or the entity that processes personal data on behalf of the data operator (if any);
• The purpose of the processing;
• The list of personal data which may be collected and processed;
• The authorized types of processing;
• The term for which the consent remains valid;
• Means for revocation of consent; and
• The data subject’s signature.

For personal data allowed by the personal data subject for dissemination there must be a separate form of consent containing following information:

• Full name of the data subject;
• Contact information for the data subject (telephone number, e-mail address or postal address);
• Information on the data operator, including name, registered address, taxpayer identification number, and state registration number (if known to the data subject);
• Information about the information resources of the data operator, through which the processing of the personal data and access to the data will be provided, including identification of the protocol (http or https), server (www), domain, the directory on the server and file name of the web page;
• Purpose(s) of personal data processing;
• Descriptions of the personal data for which the consent is given, including “standard” personal data, any special categories of personal data, and any biometric data;
• Categories and list of personal data, for which the data subject establishes conditions and prohibitions;
• Conditions under which the personal data may be transmitted by the operator only through its internal network, providing access to information only for strictly defined employees, or using information and telecommunication networks, or without transmitting the personal data (to be filled in at the request of the personal data subject);
• The period of validity of the consent.

Consent in any case may be revoked at any time.

A key feature of Russian personal data law involves what is often referred to as the “Data Localization Rule” instituted in 2015. The Data Localization Rule requires all data operators to store and process any personal data of Russian individuals within databases located in Russia (subject to few exceptions). The penalty for violation of this requirement is ultimately the blocking of websites involving unlawful handling of Russian personal data and fines up to ₽6 000 000 and up to ₽18 000 000 for repeated violations.

According to DPA, storing and processing of personal data of Russian individuals outside of Russia can still be compliant with the law as long as the primary (often interpreted as initial) storage and other processing activities prescribed by DPA is done in Russia. As one can imagine, compliance with the Data Localization Rule can be complicated for international data operators.