Russia

Art. 22.1 requires an operator that is an organisation to appoint a person responsible for organising personal data processing. That person answers to the organisation's executive body, oversees internal compliance, informs staff of the personal data rules and organises the handling of data subjects' requests.

Art. 21 Part 3.1: on an incident of unlawful or accidental transfer of, or access to, personal data that breaches data subjects' rights, the operator must notify the authorised body within 24 hours of the incident, its suspected causes, suspected harm, remedial steps and a liaison contact, and within 72 hours of the results of the internal investigation and the persons whose actions caused it.

Art. 7 para 1 item 1 requires identifying the client, its representative and the beneficiary before taking the client on; item 1.1 requires information on the purpose and intended nature of the relationship and reasonable measures to understand the client's activities, financial position and business reputation; item 2 requires reasonable and available measures to identify beneficial owners, and lets the sole executive body be treated as beneficial owner if none is found; item 3 requires client data to be updated at least every three years for low-risk clients and at least yearly for others.

Art. 7 para 1 item 6 requires freezing within 24 hours of the official publication of a listing and notice to the authorised body no later than one working day after freezing; item 6.1 requires lifting within one working day of a delisting; item 7 requires checking clients against the lists at least once every three months and reporting the results to the authorised body.

Only Russian legal entities on the Bank of Russia register may operate DFA information systems or DFA exchanges, and their rules must be approved by the Bank. Exchange operators need at least RUB 50 million of charter capital and RUB 50 million of net assets.