Awe CheckPersonal data localisation for Russians: what to check on your site
Russian citizens’ personal data must be stored in Russia. How to tell where your database lives, why CDNs and analytics matter, and the penalty.
Checked against sources: 11 October 2026
- ₽1–6Mcompany fine under Art. 13.11(8)
- 2015localisation has applied since
- 2023notice for cross-border transfers
What the law requires
Article 18(5) of Law 152-FZ obliges an operator collecting Russian citizens’ personal data to record, store and update it in databases located in Russia. The rule has applied since 1 September 2015 and covers lead forms, orders, accounts and subscriptions.
How to tell where your database is
- Ask your host which country the server and database are in. The country of the site’s IP is a hint, not an answer.
- A site behind Cloudflare or another CDN shows the CDN address, not the real server: ask your host for the database country.
- Form submissions may go to a CRM, mailing tool or spreadsheet abroad: that is data collection too, not only the site itself.
Foreign services and cross-border transfer
Since 1 March 2023 an operator must notify Roskomnadzor before transferring personal data abroad. Roskomnadzor counts a Google Analytics counter as such a transfer. List the foreign services that receive visitor data and name them in the policy. Awe Check lists such services in the report.
The penalty
Article 13.11(8) of the Administrative Code provides a fine of ₽1–6M for a company and ₽6–18M for a repeat offence. Verify the amounts against the current text of the code. Offenders can also be listed in the violators register and have site access restricted.
Frequently asked
Must the database be stored only in Russia?
The initial recording and storage of Russians’ data must be in a database in Russia. Afterwards, following the cross-border rules, a copy can also be kept abroad.
Is Russian hosting enough?
For the site, yes, if the database is on it. But forms that send data to a foreign CRM or mailing service break the rule.
How does Awe Check test this?
It determines the server country from the IP and lists foreign services receiving visitor data. Behind a CDN the result is “check manually” with a hint about what to ask your host.
