Accounts 
152-FZ and hosting: where to store the data
If a website or service collects personal data of Russian citizens, that data must be recorded and stored in databases located in Russia: this is Part 5 of Article 18 of Federal Law No. 152-FZ. For choosing a VPS, this means the data centre's country matters, not the host's, and copies abroad fall under separate rules. Here is what the law requires, what duties fall on the server owner, how it applies to companies outside Russia and which setups are used in practice.
Federal Law No. 152-FZ "On Personal Data" is Russia's general data protection law. It concerns almost any project with an order form, sign-up, CRM or mailing list whose users include Russian citizens, and it is not limited to Russian companies. Under Article 3 of the law, personal data is any information relating to an identified or identifiable person: a name and phone number, an email address, a delivery address, an order history. Whoever decides why and how it is processed is the operator, the Russian counterpart of a controller. For a company's website that is the company itself, not the host or the developer. Below is what the law requires of where data is hosted. This is an overview of the rules, not legal advice: check your specific processing with a lawyer.
What Part 5 of Article 18 requires
Since 1 July 2025, Part 5 of Article 18 is worded as a direct prohibition: when personal data is collected, including over the internet, recording, systematisation, accumulation, storage, updating and retrieval of data of Russian citizens using databases located outside Russia are not allowed. The exceptions are narrow and listed in Article 6: processing for the purposes of an international treaty or a law, for the administration of justice, for the exercise of powers of state bodies and for the professional activity of journalists and the media. User consent is not on this list, so a "I agree to my data being stored abroad" checkbox does not lift the requirement.
In practice the law is read like this: the first record of a Russian citizen's data must go into a database physically located in Russia, and that database remains the primary one. If the data is later copied abroad, that is a cross-border transfer with its own rules, covered below.
What this means for choosing a VPS
What matters is the country of the data centre where the server with the database stands. The country where the host is registered is irrelevant for this requirement: a British company with a data centre in Moscow is fine, a Russian company with a server in the Netherlands is not. How else the company's country differs from the server's country is covered in the article Hosting provider jurisdiction.
According to the accsly.io catalog as of November 2026, 218 of the 1,934 VPS hosts with a known location, or 11%, have servers in Russia. 78 of them operate only in Russia, while the other 140 also offer locations abroad. So at one host a Moscow plan and a Frankfurt plan can sit side by side: check the country of the specific plan, not the brand. Russian servers are most often in Moscow (149 hosts), followed by Saint Petersburg (33), Novosibirsk (23) and Kazan (11). Plans are collected in the selections VPS in Russia and VPS for 152-FZ.
Besides the main server, check everything else where data is also written:
- the host's backups: in which data centre and country they are kept;
- managed databases and storage: their location may differ from the VPS location;
- external services: CRM, mailing services, forms, support chats and analytics systems that store visitor data themselves;
- logs: if a proxy abroad sits in front of the site and logs request bodies with form contents, the data ends up there too.
The operator's duties
A server in Russia is only one requirement among several. The operator must also:
- Notify Roskomnadzor, the Russian data protection authority, before processing begins, under Article 22. There are few exceptions to this duty. Among other things, the notification states where the database with data of Russian citizens is located, so find out the data centre's address from the host in advance. The notification is filed through the Roskomnadzor personal data portal.
- Take security measures under Article 18.1 and Article 19: a processing policy, a responsible person, an assessment of threats and of the required protection level, access control, an inventory of media, backups. On an ordinary unmanaged VPS, almost all of this is done by the customer, not the host: updates, a firewall, keys instead of passwords, login logs. Where to start is described in the article First 10 steps after buying a VPS: security.
- Put a processing instruction in place if another party carries out the processing. Under Part 3 of Article 6, it lists the operations on the data, the purposes and the security requirements, much like a data processing agreement. The law does not say directly whether a host that only rents out a server and has no access to its contents processes the data. With managed services, such as administration, databases or backups with access to files, an instruction is definitely needed. Many Russian hosts sign one on request.
Cross-border transfer
Transferring data abroad is allowed, but under the rules of Article 12. Before the transfer begins, the operator sends Roskomnadzor a separate notification, having first obtained from the foreign recipient information on its security measures, the conditions for ending the processing and its contact details. Roskomnadzor reviews the notification within ten working days. Data may be transferred to countries on the list of those providing adequate protection immediately after the notification; to other countries only once this period has passed, if the transfer has not been prohibited or restricted.
A cross-border transfer is not only moving the database. A backup copy on a foreign server, exporting orders to a foreign CRM, sending mailings through a foreign service: all of these are transfers of data abroad. Each such chain must be stated in the notification.
If your company is outside Russia
The localisation requirement follows the data of Russian citizens, not the operator's country, so it can also concern a company in the EU, the UK or elsewhere that collects such data from Russian users. Your own law applies on top of it. In the EU this is the GDPR, and in the UK the UK GDPR: neither requires the server to be in a particular country, but both require a data processing agreement with the host and a lawful basis for transfers outside their territory. How these rules apply to renting a server is covered in the article GDPR and choosing a host.
Typical setups
- Everything in Russia. The site, database, backups and mail run on servers in Russian data centres. The simplest setup with the least paperwork. For copies, take a second server from another Russian host, so that one incident does not destroy both the data and the copy; more in the article VPS backups.
- Database in Russia, front end abroad. Static pages and images are served from a foreign server or a content delivery network closer to the audience, while forms, the shopping cart and the account area send data directly to the server in Russia. The setup works but needs discipline: no form may store or log data on the foreign part.
- Primary database in Russia, replica abroad. Suitable for projects with an audience in several countries. The primary record goes to Russia and a replica goes abroad after the cross-border transfer notification.
- A foreign project with Russian users. If the service collects data of Russian citizens, the localisation requirement applies to it as well; one option is a separate server in Russia for those users. For data of EU residents, the European rules are added on top.
Employees' data in accounting and HR systems is personal data too. If a Russian company pays for the server, the documents it receives when paying by invoice are covered on the page VPS paid by invoice.
What to ask the host
- the data centre address for the chosen plan, which is needed for the Roskomnadzor notification;
- where the host keeps its own backups and whether you can choose their location;
- whether the host signs a processing instruction or a confidentiality agreement;
- whether the host holds FSTEC licences (issued by Russia's technical security regulator) and offers a certified secure segment, if your protection level requires certified tools;
- which closing documents it issues to companies.