Russia Federal Law on Personal Data (152-FZ): every control, and what you already have

28 controls 103 frameworks share controls with it Russia verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

Russia 152-FZ Evidence & Implementation Kit

28 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
FedRAMP Rev 5	3	measure it →
Florida Digital Bill of Rights (FDBR)	3	measure it →
FTC GLBA Safeguards Rule (16 CFR Part 314)	3	measure it →
ITU-T X.805	3	measure it →
MARS-E	3	measure it →
NAIC Insurance Data Security Model Law (MDL-668)	3	measure it →
NIST Privacy Framework	3	measure it →
Oman National Cybersecurity Framework	3	measure it →
OWASP Top 10 for LLM Applications 2025	3	measure it →
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)	2	measure it →
Family Educational Rights and Privacy Act (FERPA)	2	measure it →
Global Cross-Border Privacy Rules (Global CBPR) Forum	2	measure it →

Every control

Code	Control	Also in
`RU-152FZ-001`	Notification of Personal Data Processing to Roskomnadzor	0
`RU-152FZ-002`	Data Localisation of Russian Citizens Personal Data	0
`RU-152FZ-003`	Consent of the Data Subject	0
`RU-152FZ-004`	Consent for Dissemination of Personal Data	0
`RU-152FZ-005`	Cross Border Transfer Notification and Assessment	0
`RU-152FZ-006`	Technical and Organisational Protection Measures	0
`RU-152FZ-007`	Designation of Person Responsible for Personal Data	0
`RU-152FZ-008`	Internal Personal Data Documents	0
`RU-152FZ-009`	Personal Data Breach Notification	0
`RU-152FZ-010`	Data Subject Rights and Requests	0
`RU-152FZ-011`	Processing on Behalf of Another Operator	0
`RU-152FZ-012`	Special Categories of Personal Data	0
`RU-152FZ-013`	Biometric Personal Data	0
`RU-152FZ-014`	Retention and Destruction of Personal Data	0
`RU-152FZ-015`	Internal Control and Audit	0
`RU-152FZ-016`	Levels of Protection for Information Systems	0
`RU-152FZ-017`	Roskomnadzor Inspections and Enforcement	0
`RU-152FZ-018`	Privacy Notices and Transparency	0
`RU-152FZ-019`	Liability and Penalties	0
`RU-152FZ-020`	Records of Provision of Personal Data to Third Parties	0
`RUSPD-1`	Scope, Definitions, Principles under 152-FZ	60
`RUSPD-2`	Lawful Basis, Consent, Notice	45
`RUSPD-3`	Data Subject Rights (Access, Correction, Object, Block/Destroy)	0
`RUSPD-4`	Special Categories, Biometric Data	76
`RUSPD-5`	Security of Processing, Confidentiality, FSB/FSTEC Requirements	0
`RUSPD-6`	Cross-Border Transfer and Data Localization (Article 18.5)	0
`RUSPD-7`	Roskomnadzor Registration, Operator Notification, Governance	0
`RUSPD-8`	Breach Notification, RKN Inspections, Sanctions	0

Tell me when Russia Federal Law on Personal Data (152-FZ) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Documentation portal or repository accessible to relevant workforce
Access records demonstrating workforce can retrieve relevant policies
Communication evidence (intranet posts, training references)
Role-based mapping of documentation to responsibility
Workforce acknowledgement of access
Procedure for distributing updates
Preliminary risk-classification assessment per AI system
Documentation supporting the risk classification
AI system inventory
High-impact classification log

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Updates not communicated named by 3 frameworks
Classification not documented named by 3 frameworks

What this page is

A control-level reference for Russia Federal Law on Personal Data (152-FZ), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition