AKIT Requests Temporary Permission for Russian Companies to Transfer Personal Data Abroad After Data Center Incidents

The Association of Internet Trade Companies (AKIT) has sent a formal letter to Russian Prime Minister Mikhail Mishustin proposing a temporary exemption from strict data localization rules. The measure would allow affected companies to move critical systems and Russian citizens' personal data to data centers in friendly countries when domestic infrastructure is unavailable due to accidents or damage. Members including Ozon, Wildberries, Cooper, and Yandex Market argue that services must continue operating even if Russian facilities are compromised. The proposed special regime would apply only after an officially confirmed incident, require compliance with information security standards, and end no later than March 1, 2028. After recovery, companies would be required to return to normal data processing within Russia. Expert Alexey Muntyan noted that the mechanism activates only after incidents occur and questioned whether countries should be selected based on data protection levels rather than political alignment.

AntiMalwareTranslated from Russian

Read at source

The Association of Internet Trade Companies (AKIT) has proposed allowing Russian companies hit by accidents or damage to data centers to temporarily relocate critical systems and personal data of Russian citizens to facilities in friendly countries.

According to the letter sent to Prime Minister Mikhail Mishustin on October 15, the association seeks a temporary exception from Russia's data localization requirements. The proposal covers members such as Ozon, Wildberries, Cooper, and Yandex Market, which argue that online services must remain operational even when domestic infrastructure is unavailable.

The suggested special regime would be triggered only after an officially confirmed incident that makes it impossible to run systems inside Russia. Companies would still need to meet information security requirements, and the list of permitted countries would be defined by an authorized government body in coordination with the Ministry of Digital Development and Roskomnadzor.

Under the plan, the exception would remain in force only until infrastructure is restored, but no later than March 1, 2028. Once systems are back online in Russia, organizations would be required to revert to standard data processing rules.

Privacy expert Alexey Muntyan pointed out that the proposed mechanism activates only after an incident has already occurred, whereas proper redundancy planning should happen in advance. He also questioned the reliance on political "friendliness" rather than objective assessments of data protection standards in destination countries.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Policy & Regulation

Russian Minister Proposes Blocking All SIM Cards Linked to Fraudsters Banned in MAX Messenger
Russia Ready to Disclose Source Code of Social Networks, Messengers and AI Models
Russia Mulls Mandatory Two-Week IMEI Registration for Foreign Smartphones via Gosuslugi