Effective May 30, 2025, key changes introduced by Federal Law No. 420-FZ[1] will affect the processing and protection of personal data. The law will tighten control over the processing of personal data, introducing new types of offenses and record-high fines of up to RUB 500 million, or up to 3% of a company’s annual revenue. As you may remember, criminal penalties[2] for violating Russian personal data protection laws were established effective from December 11, 2024[3]. Criminalized actions include unauthorized access to, destruction, blocking, or modification of data as computer systems. Examples include hacking a database, deleting a file containing personal data, blocking access to them.

The main changes in administrative liability[4] pertain to compliance with personal data processing requirements.

Recently, courts have been allowing lawsuits against website owners/administrators for deletion of disparaging information posted online by anonymous users. Such lawsuits require, among other things, the establishment of legal circumstance, i.e. the availability of defamatory information, and allow the deletion of discrediting feedback about individuals or companies by a single court decision.

The Constitutional Court of Russia finally published its ruling on a case partially validating “parallel” import. This case involved PAG, a Russian company which imported Sony trademarked products into Russia without Sony’s consent and was required to destroy these products as counterfeit