How Russian Companies Can Legally Transfer Personal Data to Contractors Under 152-FZ

Russian organizations frequently outsource accounting, IT support, and customer service, yet many overlook the specific requirements of 152-FZ when personal data leaves their systems. The core question is whether the contractor acts as a processor following the client’s instructions or as an independent operator pursuing its own legal obligations.

When the client defines the purpose, such as payroll calculation or CRM administration, the contractor remains a processor. In this case a formal data processing instruction must be signed, containing all elements listed in part 3 of Article 6 of 152-FZ, including the list of permitted operations, security measures, and rules for engaging sub-processors.

Conversely, laboratories, banks, and insurers usually qualify as independent operators because they maintain their own records and bear statutory duties toward the data subjects. No processing instruction is appropriate; instead the client must rely on consent or another basis under part 1 of Article 6 and must inform individuals about the transfer in advance.

Employee data triggers an additional layer of protection under Article 88 of the Labor Code. Written consent from each employee is mandatory before salary, passport, or SNILS information may be sent to an external accountant or HR outsourcer. Consent must name the recipient, the exact data categories, and the purpose; general wording is insufficient.

Organizations are advised to ask two practical questions for every contractor: who decides why the data are processed, and would the contractor still have any legal duty toward the individuals if the service contract ended? The answers determine whether a processing instruction, a transfer agreement, or both are required.

Failure to obtain proper documentation can result in fines of 100–300 thousand rubles for officials and 300–700 thousand rubles for legal entities under part 2 of Article 13.11 of the Code of Administrative Offenses. Roskomnadzor treats each monthly transfer as a new violation, so the one-year limitation period restarts with every data exchange.