A Russian group with an Indian subsidiary handles personal data under two regimes. Russia's Federal Law No. 152-FZ requires, among other things, that the initial recording and storage of Russian citizens' personal data be done in databases located in Russia, and requires notification of the regulator before cross-border transfers; fines have been raised in recent years. India's Digital Personal Data Protection Act, 2023, with Rules notified on 13 November 2025 and main duties from 13 May 2027, uses consent and legitimate-use grounds, gives individuals rights, requires reasonable security and breach intimation, and allows penalties up to INR 250 crore. Map data flows between Russia and India, decide where data lives, and put agreements in place. Confirm the current Russian rules with Russian counsel.
← Back to the complete guide: How to Set Up a Subsidiary in India from Russia
Key facts
| Russian law | Federal Law No. 152-FZ on personal data; regulator Roskomnadzor |
|---|---|
| Localisation | Initial collection and storage of Russian citizens' personal data in databases in Russia |
| Cross-border transfer | Notify the regulator before transfer; assess the recipient country's protection; the regulator can restrict transfers |
| Indian law | Digital Personal Data Protection Act, 2023; Rules notified 13 November 2025 |
| Timeline | Main Indian duties apply from 13 May 2027 under the staged commencement |
| Penalties | India: up to INR 250 crore for failure to take reasonable security safeguards; Russia: fines raised in recent years |
| Transfers from India | Permitted except to restricted countries notified by the government; sector laws may be stricter |
| Processors | Written contract; the data fiduciary or operator stays accountable |
Side-by-side
| Topic | Russia (152-FZ) | India (DPDP Act) |
|---|---|---|
| Base of processing | Consent or other listed legal grounds; notice and purpose limitation | Consent or specified legitimate uses; notice in clear language |
| Individual rights | Access, correction, deletion and objection | Access, correction, erasure, grievance redressal, nomination |
| Security | Organisational and technical measures | Reasonable security safeguards; breach intimation |
| Localisation | Initial storage of Russian citizens' data in Russia | No general localisation; sector rules may apply |
| Cross-border | Prior notification and assessment of the recipient country | Allowed except to notified restricted countries |
| Regulator | Roskomnadzor | Data Protection Board of India |
Typical data flows in a Russia-India group
- Employee data of Russian secondees held by the Russian parent and shared with the Indian subsidiary.
- Indian employee and customer data sent to Russian group systems for payroll, CRM or analytics.
- Shared services (engineering, IT, support) in India handling Russian customer data, making the Indian company a processor.
- Cloud hosting that moves data between regions.
Practical steps
- Map what data moves between Russia and India, who controls it and who processes it.
- Keep the primary copy of Russian citizens' data in Russia where the law requires it, and review what is copied to India.
- File the notifications and carry out the assessment for cross-border transfers under Russian law.
- Update notices and consent flows for the Indian rules before May 2027.
- Put processor and intra-group data transfer agreements in place with security, breach and audit terms.
- Set up a breach response plan covering both regulators.
Sector rules
Financial, health, telecom and government-linked data may be subject to sector rules, including localisation requirements in some regulated sectors in both countries. Check your sector regulator's directions before moving data.
Official sources
Check the rules at the primary sources: Income Tax Department (India), Reserve Bank of India, Ministry of Corporate Affairs, Federal Tax Service (Russia), Bank of Russia and the Ministry of External Affairs (India).
Frequently asked questions
Does Russian data localisation affect an Indian subsidiary?
It can, if the group handles personal data of Russian citizens. The initial collection and storage must be in Russia, so India should receive copies only as the law permits. Confirm with Russian counsel.
Must I notify the Russian regulator before sending data to India?
Russian rules require notification of the regulator before cross-border transfers and an assessment of the recipient country's protection. Confirm the current procedure.
When do the Indian data protection duties start?
The Rules were notified on 13 November 2025 and the main duties apply from 13 May 2027.
Can I send Indian personal data to Russia?
Generally yes, because the Act restricts transfers only to countries the government notifies. Sector rules can be stricter.
What is the maximum penalty in India?
Up to INR 250 crore for failing to take reasonable security safeguards to prevent a personal data breach.
Do I need a data processing agreement?
Yes. A written contract with the processor covers purpose, security, breach and return or deletion of data.
Who regulates data protection?
Roskomnadzor in Russia and the Data Protection Board of India.
Related guides
Hiring Staff in India as a Russian-Owned Company: Employment Contracts, Provident Fund, ESI, Gratuity and Labour Codes
How a Russian-owned Indian subsidiary hires locally: offer and employment contracts, payroll taxes, provident fund, ESI, gratuity, labour codes, shops and establishments law, notice periods, POSH and differences from Russian labour practice.
Read the guide →Contracts and Dispute Resolution for Russian Companies in India: Governing Law, Arbitration Seats, Enforcing Awards and Court Judgments
How to draft and enforce contracts between a Russian company and Indian counterparties: governing law, arbitration seat and institution, enforcing awards under the New York Convention, the position on court judgments, Russian courts' jurisdiction over sanctions disputes, stamp duty and interim relief.
Read the guide →Compliance Calendar: Indian Deadlines and the Russian Filings They Feed
A month-by-month compliance calendar for an Indian subsidiary of a Russian parent: TDS, GST, PF and ESI, advance tax, AGM, AOC-4, MGT-7, FLA return, sanctions reviews and the Russian-side reporting that depends on Indian numbers.
Read the guide →Twelve Common Mistakes Russian Companies Make in India and How to Avoid Them
The most common mistakes of Russian companies entering India: ignoring banking and sanctions, skipping Russian clearance, late FEMA filings, weak treaty paperwork, secondment tax errors, unauthenticated documents, unstamped contracts and ignoring the Indian calendar.
Read the guide →Sources
Last updated 26 October 2026. General information only, not legal or tax advice. Indian and Russian rules change often; confirm current requirements before acting.