On December 2, 2019, President Putin signed the law regarding the introduction of administrative fines for failure to comply with personal data localization requirements set by the Law on Personal Data since September 1, 2015.

The bill was actively discussed by the business and regulatory authorities since its origination due to unprecedented high maximum fines set for breach of localization requirements. These amounts have not changed throughout the adoption process and reach up to RUB 6,000,000 (approximately US$ 90,000) for first offense and RUB 18,000,000 (approximately US$ 280,000) for repeated offenses by companies or individual entrepreneurs. The minimum fine for the first offense (typically preferred by the regulator) was slightly lowered from RUB 2,000,000 (approximately US$ 30,000) to RUB 1,000,000 (approximately US$ 15,000).

Localization requirements supported with the above fines consist of the obligation of any operator of personal data pertaining to Russian citizens to record, systemize, accumulate, store, modify or extract such data with the use of databases physically located in Russia. The introduction of severe sanctions is designed to stimulate foreign companies to finally bring their businesses in compliance. Most of all, Russian regulatory authorities have expressed concern with Facebook and Twitter who continue to avoid the requirement despite numerous discussions with the regulator.

The new law came in effect immediately after official publication on December 2, 2019.