The Russian data localization law came into effect on 1 September 2015. The key effect of this law is that personal data collected within Russia (including online collection) must be stored and/or processed using databases or servers that are physically located within Russia. This raises concerns for foreign parent companies operating share plans for employees of a Russian subsidiary in contemplating where their data processing will need to take place.

The Russian Ministry of Communications issued some guidance on this in September. In its guidance it stated that data may be transferred and processed outside of Russia provided that the primary database storing the personal data is within Russia – a secondary back-up database in a foreign jurisdiction would be permissible.