How Russian Companies Can Legally Transfer Personal Data to Contractors Under 152-FZ
Russian organizations frequently outsource accounting, IT support, and customer service, yet many overlook the specific requirements of 152-FZ when personal data leaves their systems. The core question is whether the contractor acts as a processor following the client’s instructions or as an independent operator pursuing its own legal obligations.
When the client defines the purpose, such as payroll calculation or CRM administration, the contractor remains a processor. In this case a formal data processing instruction must be signed, containing all elements listed in part 3 of Article 6 of 152-FZ, including the list of permitted operations, security measures, and rules for engaging sub-processors.
Conversely, laboratories, banks, and insurers usually qualify as independent operators because they maintain their own records and bear statutory duties toward the data subjects. No processing instruction is appropriate; instead the client must rely on consent or another basis under part 1 of Article 6 and must inform individuals about the transfer in advance.
Employee data triggers an additional layer of protection under Article 88 of the Labor Code. Written consent from each employee is mandatory before salary, passport, or SNILS information may be sent to an external accountant or HR outsourcer. Consent must name the recipient, the exact data categories, and the purpose; general wording is insufficient.
Organizations are advised to ask two practical questions for every contractor: who decides why the data are processed, and would the contractor still have any legal duty toward the individuals if the service contract ended? The answers determine whether a processing instruction, a transfer agreement, or both are required.
Failure to obtain proper documentation can result in fines of 100–300 thousand rubles for officials and 300–700 thousand rubles for legal entities under part 2 of Article 13.11 of the Code of Administrative Offenses. Roskomnadzor treats each monthly transfer as a new violation, so the one-year limitation period restarts with every data exchange.
Related articles
Rostelecom Calls for 'Doomsday' Data Centers to Counter Drone Attacks and Infrastructure Risks
Rostelecom executive Valery Ermakov has urged Russian companies to build geographically distributed backup data centers, dubbed 'doomsday' facilities, to ensure service recovery after site losses. The recommendation follows drone strikes that disabled three Yandex data centers in Sasovo, Kaluga, and Vladimir, disrupting both internal services and Yandex Cloud clients. Ermakov explained that previous centralized infrastructure, built for economic efficiency, is no longer viable under changed threat models that now include physical attacks previously considered unthinkable. He advocated a micro-cellular architecture with services spread across many sites connected by high-speed links, while warning that Russian backbone networks are overloaded and much fiber optic infrastructure dates back 20-30 years. Rostelecom positioned its TEA NEXT line running from Kaliningrad to Mongolia as a source of additional capacity to address potential backbone shortages. Yandex responded to the incidents by accelerating client data migration to partner cloud providers.
Russian Firms Accelerate Cybersecurity Strategy Adoption as Risk Reduction Emerges as Top Priority
A recent AM Live broadcast survey reveals that Russian small, medium, and large companies are increasingly developing information security strategies, with the share of organizations actively working on them rising from 9% to 28% year-over-year. The primary goal cited for 2027 is risk reduction and financial loss mitigation, selected by 78% of respondents compared to 55% previously. Key barriers have shifted, with insufficient source data now affecting 64% of companies and lack of top-management buy-in rising to 43%. Experts including Yaroslav Napalkov from MTS Bank and Nikolay Kazantsev from Securitm emphasized the need for risk-oriented approaches, three-year planning horizons with annual reviews, and early engagement with CEOs and stakeholders. Only 16% of firms have fully operationalized their strategies with metrics and cyber exercises, while personnel shortages remain the leading constraint at 59%.
VK Shares Rise 7.62% as Market Assesses Data Center Developments and Yandex Cloud Challenges
VK shares climbed sharply on October 12, reaching a peak increase of 7.62% to 134.2 rubles before moderating to a 6.6% gain at 132.95 rubles by evening. Analysts from Freedom Global linked the movement partly to the Ministry of Digital Development's announcement of joint measures with the Ministry of Defense to protect Russian data centers. Other observers at Finam suggested investors were pricing in potential client shifts from Yandex Cloud to competitors such as VK Cloud, which has already begun accelerated infrastructure placement for affected Yandex customers. The surge was also attributed to broader capital rotation away from the energy sector toward previously lagging technology stocks. While the confirmed price movement is clear, the exact drivers remain analytical interpretations rather than verified revenue impacts. The episode highlights how regulatory and infrastructure news can quickly influence valuations in the Russian cloud services market.
Passphrases vs. Leetspeak Passwords: Why Four Random Words Outperform P@ssw0rd!2026
The article explains why a passphrase made of four randomly selected words provides far greater resistance to offline attacks than a complex-looking password constructed with substitutions and appended symbols. It details how password strength is measured in bits of entropy rather than visual complexity, showing that four words drawn from a 50,000-word list yield approximately 62 bits while common leetspeak transformations add almost none. The piece contrasts fast legacy hashing with modern slow algorithms such as Argon2 and emphasizes the protective effect of per-password salting. It criticizes registration forms that reward predictable patterns and highlights NIST guidance favoring length over mandatory character rotation. The author recommends diceware-style generation for master passwords and password managers for everything else, noting that passkeys ultimately eliminate the need for memorizable secrets altogether.