152-FZ personal data law compliance for mobile app

Ensuring 152-FZ Compliance in Mobile Applications

Since 2023, Roskomnadzor actively fines for 152-FZ violations — not just large corporations. Mobile apps with Russian users fall under this law regardless of developer jurisdiction. Key requirement most often violated technically: personal data of Russian citizens must be processed first on servers within Russia.

Data Localization — Technical Aspect

"Primary processing on Russian servers" means: recording, storage, systematization, accumulation, clarification, extraction of PD must happen in Russian data center. Cross-border transfer after primary processing is allowed — but only to countries with "adequate protection level" or special grounds (Article 12, 152-FZ).

For mobile app this means:

• Firebase Realtime Database / Firestore with europe-west region — doesn't comply. Google Cloud Platform in Finland — not Russia. Need Firebase + GCP us-central1 through VPN won't help — server physical location matters
• AWS eu-central-1 (Frankfurt) — also no
• Suitable: Yandex.Cloud, VK Cloud, Sber Cloud, own servers in Russian data centers (Tier III and above)

In practice many teams do data routing: on registration check phone_number (7xx) or geolocation and route request to Russian instance. Workable scheme but requires careful implementation — data shouldn't temporarily settle on foreign servers even during routing.

Personal Data Subject Consent

152-FZ requires explicit written consent to PD processing. In mobile app "written form" means electronic consent with revocation ability. Technical requirements:

• Specific list of processed PD (not "and other data")
• Processing purpose for each category
• Storage period
• List of third parties data goes to
• Method to revoke consent

Typical error: one big consent for everything. Roskomnadzor considers consent should be specific. For advanced analytics and advertising — separate consent, separate button.

data class ConsentItem(
    val purposeCode: String,      // "analytics", "marketing", "profiling"
    val purposeDescription: String,
    val dataCategories: List<String>,
    val retentionDays: Int,
    val thirdParties: List<String>
)

Consent stored with timestamp and document version. When conditions change — repeat consent request.

Special PD Categories

152-FZ highlights special categories requiring separate (explicit) consent: medical data, biometrics, religious and political views, race, criminal record.

For apps with biometric auth (Face ID, fingerprint scanner) — biometrics use locally via iOS LocalAuthentication / Android BiometricPrompt. Biometric templates don't go to server. Important to document in Privacy Policy and verify technically: LAContext.evaluatePolicy() and BiometricManager work with data stored in Secure Enclave / StrongBox — physically never leaves device.

Roskomnadzor Notification

Since September 2022, PD operators must notify Roskomnadzor before processing personal data begins (Article 22, 152-FZ). Exceptions exist (data only for contract performance with subject) but narrow. Submission via Roskomnadzor portal — one-time action, but when processing goals change must update notification.

Third-Party SDKs and Data Transfer

Each analytics or ad SDK is third party — "entity processing PD by operator's order" (Article 6 p. 3). Need processing order contract with each such partner, containing:

• Processing goals
• Obligation to store PD in Russia (if SDK transfers data abroad — separate basis needed)
• Confidentiality obligation

AppMetrica from Yandex stores data in Russia — suitable. Amplitude, Mixpanel — data in US, need either separate consent with cross-border transfer indication or EU instance with additional justification.

Data Subject Rights

Subject has right to:

• Get information about processed data — "My Data" screen with 30-day response SLA
• Correct or delete data — request form + 7 working days SLA
• Revoke consent — immediately, without explanation

In app: "Personal Data" section in profile settings with "Request Data", "Correct Data", "Delete Account" buttons.

Technical and Organizational Protection Measures

FSTEC Order #21 and Roskomnadzor recommendations require:

• PD encryption at rest (AES-256) and in transit (TLS 1.2+)
• Access rights separation (RBAC at API level)
• Access logging to PD
• Regular backups with restoration verification
• Incident response procedure (breach → notify Roskomnadzor within 24 hours since 2022)

In mobile app encrypt sensitive data in local storage — EncryptedSharedPreferences (Android) and kSecAttrAccessibleWhenUnlockedThisDeviceOnly in Keychain (iOS).

Timeline

Cost calculated individually after analyzing current architecture and processed data composition.