From September 1, 2025, personal data operators will be obliged to provide depersonalized personal data at the request of the Ministry of Digital Development: Federal Law No. 233-FZ of 08.08.2024 entered into force in August. Acsour experts reviewed the upcoming changes in the field of personal data processing in the article.
How does the exchange of depersonalized personal data between companies take place?
According to Article 3 of the Law No. 152-FZ dated 07/27/2006, depersonalization of personal data is an action that makes it impossible to determine whether information belongs to a specific subject without additional information. Until now, companies could not depersonalize personal data and exchange them: the mechanism for exchanging depersonalized information between organizations was not provided for by law.
However, in July 2020, Draft Law No. 992 331−7 "On Amendments to the Federal Law On Personal Data (in terms of clarifying the Procedure for Processing Personal Data)" was proposed: the amendments provided an opportunity for companies to use depersonalized user data when obtaining their consent. The draft passed the first reading, but the second did not take place: the Ministry of Digital Development has repeatedly made adjustments.
In July 2024, the amended bill passed the second and third readings, and in August it was considered and adopted by the Federation Council. 08.08.2024 Federal Law No. 233-FZ entered into force.
What will change from September 1, 2025?
Federal law obliges companies to transfer personal data at the request of the Ministry of Digital Development to the State Information System (GIS). Acsour experts note that personal data must be depersonalized before transfer: the depersonalization procedure will be established by the Government. The consent of the data subject is not provided.
After collecting the data, the Ministry of Digital Development will form their compositions. Domestic operators will be given access to them if a number of conditions are met:
Operators will be able to process such trains only in the Ministry’s special system. You cannot record, extract or transfer them to third parties. As a general rule, processing results will be prohibited from being provided, in particular, to foreigners and foreign companies.
Legislation in the field of personal data processing and storage is changing rapidly: new laws are being adopted, liability for employers is becoming tougher and the risks of fines are increasing. Acsour experts are pleased to help you set up the correct work with personal data in your company and prevent possible risks.
How does the exchange of depersonalized personal data between companies take place?
According to Article 3 of the Law No. 152-FZ dated 07/27/2006, depersonalization of personal data is an action that makes it impossible to determine whether information belongs to a specific subject without additional information. Until now, companies could not depersonalize personal data and exchange them: the mechanism for exchanging depersonalized information between organizations was not provided for by law.
However, in July 2020, Draft Law No. 992 331−7 "On Amendments to the Federal Law On Personal Data (in terms of clarifying the Procedure for Processing Personal Data)" was proposed: the amendments provided an opportunity for companies to use depersonalized user data when obtaining their consent. The draft passed the first reading, but the second did not take place: the Ministry of Digital Development has repeatedly made adjustments.
In July 2024, the amended bill passed the second and third readings, and in August it was considered and adopted by the Federation Council. 08.08.2024 Federal Law No. 233-FZ entered into force.
What will change from September 1, 2025?
Federal law obliges companies to transfer personal data at the request of the Ministry of Digital Development to the State Information System (GIS). Acsour experts note that personal data must be depersonalized before transfer: the depersonalization procedure will be established by the Government. The consent of the data subject is not provided.
After collecting the data, the Ministry of Digital Development will form their compositions. Domestic operators will be given access to them if a number of conditions are met:
- there is no record of unreliability of information about the organization in the Unified State Register of Legal Entities
- the director of the company has only Russian citizenship
Operators will be able to process such trains only in the Ministry’s special system. You cannot record, extract or transfer them to third parties. As a general rule, processing results will be prohibited from being provided, in particular, to foreigners and foreign companies.
Legislation in the field of personal data processing and storage is changing rapidly: new laws are being adopted, liability for employers is becoming tougher and the risks of fines are increasing. Acsour experts are pleased to help you set up the correct work with personal data in your company and prevent possible risks.
