On October 30, a new list of countries took effect. Russian organizations can transfer personal data to these countries without waiting for a review. The list now has one fewer country: Ukraine was removed. The United States is not on the list and never was, but Burkina Faso, Mali, and Chad are. We look at how this list works, what it means for NGOs and media outlets, and why it belongs in the same category as allowlists and the registry of domain registrars.

What happened

Roskomnadzor (RKN, Russia’s federal regulator for media, telecom, and the internet) approved a new list of foreign countries that, in its view, provide adequate protection of the rights of personal data subjects. The previous list, adopted in August 2022, is no longer in force.

The list has changed in only one way: Ukraine is no longer on it. The number of countries dropped from 89 to 88.

However, removal from the list (or absence from it) does not ban data transfers to a country. Roskomnadzor has to impose a ban through a separate decision.

How it works in practice

Under Article 12 of the Law on Personal Data, any organization that plans to transfer data abroad must notify Roskomnadzor in advance.

• If the country is on the list, the transfer can start immediately after the notification is sent. There is no need to wait for the agency’s decision.
• If the country is not on the list, the organization has to wait until the ten-business-day review period ends. If the agency requests additional information, the countdown stops until the organization responds.
• In both cases, the regulator retains the right to ban or restrict the transfer later.
• Before filing the notification, the operator must find out what protection measures the foreign recipient uses, under what conditions the recipient will stop processing the data, and who is responsible for the information received.
• For countries outside the list, the operator must also study the local personal data legislation. Roskomnadzor has the right to request the results of this review.
• At the same time, there is no list of countries where sending data is prohibited. Roskomnadzor reviews each organization’s notification and can ban or restrict that specific organization’s transfer. Article 12 lists the grounds: protecting the constitutional order, morality, health, citizens’ rights, national defense, and state security.
• However, being on the list does not grant immunity either: transfers to listed countries can also be banned.
• If a transfer is banned, the operator must make sure the foreign recipient destroys the data already transferred. In other words, the operator has to get the foreign company to delete what it received and prove this to the regulator.

Roskomnadzor has already banned or restricted data exports in 7 out of 589 notifications. The grounds were that the purpose of the transfer did not match the purposes stated when the data was collected, or did not match the volume and content of the data. The agency did not disclose which countries the transfers were planned for.

How violators are found

Violations used to be detected through complaints or inspections. Now an automated monitoring system scans websites only in the .RU, .РФ, and .SU domain zones, around the clock and without human involvement.

The bot behaves like a regular visitor: it opens pages, finds forms, and loads scripts. The site owner receives no notice, because formally this counts as information gathering rather than an inspection.

What the bot can see without access to your admin panel:

• installed counters and scripts,
• whether there is a data processing policy and a link to it,
• the markup of forms and checkboxes.

At the same time, the system checks the site’s data against public registries. It looks at who owns the site and where the hosting is located (based on WHOIS data and IP geolocation). It checks whether this matches what the organization stated in its notifications and whether the organization is in the registry of data operators. The bot’s findings go to an inspector, and the organization receives a demand to fix the violations within ten days.

Over the year, the system checked about 78,000 websites and found discrepancies in 80% of them. A single indicator is enough to land on the list of violators.

Who is on the list of “good” countries

China, Belarus, Kazakhstan, India, Turkey, Japan, South Korea, Israel, Qatar, the United Kingdom, Canada, Australia, New Zealand, and all EU member states (including Lithuania, Latvia, Estonia, Poland, and the Netherlands), as well as Burkina Faso, Mali, Niger, Chad, Togo, Senegal, and Côte d’Ivoire. The list includes NATO members, Kremlin allies, Western democracies, and authoritarian states alike.

A country can make the list if it has a comprehensive personal data law, an authority that protects the rights of data subjects, and a system of penalties for violations. In other words, the assessment looks at whether the formal framework exists and ignores how it works.

The United States has no federal personal data law in the European sense. Instead, it has sector-specific regulation and state laws. So formally, the US does not meet the criterion and is not on the list. Burkina Faso has such a law and is on the list.

A significant share of the cloud infrastructure used worldwide is American. This includes storage, mailing systems, collaboration services, video call platforms, and code repositories. Transferring data to any of them requires the full procedure with a waiting period.

Where Russian websites are actually hosted

We downloaded the “Hosting Geography” report for all three domain zones and compared it with the order. The report covers 3,633,629 web hosts in total. Of these, 84.24% are located in Russia. The service classifies another 5.48% as undetermined. Abroad, there are 373,781 hosts, or 10.29%.

Of these 300,000-plus foreign hosts, 102,798 are in countries that are not on the list. That is 27.5%, or almost one in three Russian websites hosted abroad.

Two of the top 5 destinations are not on the list:

• United States: 51,596 hosts
• United Arab Emirates: 44,451 hosts

The Emirates have their own story. After 2022, the country became a popular destination for those who left European hosting but did not want to move back to Russia. By the number of hosts, the UAE has almost caught up with the US. The Emirates are not on the list.

The owners of these hundred thousand websites chose their hosting based on price, speed, and reliability, not on a regulatory decree. Now every data transfer to such a server requires a ten-business-day wait and a prior review of another country’s legislation. Of course, not everyone falls under this requirement, and not everyone will comply. Still, the burden is real.

Roskomnadzor now decides which countries make the list

The law used to give separate weight to a country’s participation in the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. The list was split into two groups: parties to the Convention and other countries whose legislation was recognized as adequate.

Federal Law No. 265-FZ of July 26, 2026 removed this link. What matters now is national legislation and protection measures, which must comply with the principles of the Convention. Roskomnadzor assesses them.

Why is this bad?

Participation in an international treaty is an external, verifiable criterion: a country has either signed it or not. Compliance with the treaty’s principles as judged by an agency is an internal criterion. Its content is defined by the same agency that maintains the list. The domain registration rules follow the same pattern: for 15 years, an industry organization wrote them, and now the government sets them.

When drafting the amendments, the authorities cited the growth of cross-border cybercrime. They also argued that foreign regulators do not always protect the rights of Russian citizens well enough. Nothing new here: such justifications migrate from one restrictive act to the next.

The theory became practice even before the new list appeared. In 2025, Roskomnadzor began requiring notifications from owners of Russian websites that use a foreign web analytics system. The agency treated the transfer of visitor information to a foreign service as an operation covered by personal data law. This was about an analytics counter that tens of thousands of organizations have on their websites (not about handing a customer database to a partner). Previously, nobody had thought this could be considered a cross-border transfer. Now everything is under scrutiny: CRM systems, cloud storage, mailing services, analytics, and any other tool that receives user data and is located abroad.

What should worry NGOs and media

Cross-border transfer, as Roskomnadzor interprets it, is part of any organization’s routine work. This includes newsletters sent through a foreign service, a spreadsheet of volunteer contacts in the cloud, a donation form, analytics, a visitor counter, and backups.

If an organization is registered in Russia and processes data of Russian citizens, each of these operations requires a notification. For countries outside the list, it also requires a waiting period and a prior review of foreign law.

Check where the services you use are physically located. The country where a company is registered and the country where its servers are hosted are different things. The law cares about where the equipment is located. American infrastructure requires the full procedure, and this applies to most familiar tools.

This does not lift the requirement to store data in Russia

A common misconception: if a country is on the list, you can store data there.

You cannot. The law requires that the initial recording, systematization, accumulation, storage, updating, and retrieval of Russian citizens’ personal data take place in a database located in Russia. The list governs the conditions for subsequent transfers. It does not allow organizations to collect and store data in foreign databases from the start.

A proxy server will not help here. It does not create the initial record: data is first recorded wherever the actual database is. That said, this still has to be detected somehow.

The requirement to keep the primary database in Russia has collided with the fact that in fall 2026, Russian data centers turned out to be physically vulnerable: drone (UAV) attacks hit facilities in several regions and caused service outages. The only insurance against physical destruction is a backup stored far away. That is exactly a cross-border transfer, and the procedure for it is now stricter. Tightening data storage rules is a paradoxical response to drone attacks.

This is “international practice,” but there is a catch

The mechanism of a list of approved countries is not a Russian invention. Officials, as usual, borrow from their foreign colleagues.

For example, the European Union has a direct counterpart: the European Commission adopts adequacy decisions on the level of data protection in third countries. If a country is on the list, data flows freely. If not, additional safeguards are needed, such as standard contractual clauses or binding corporate rules.

The devil is in the details

Transparent criteria. The European Commission publishes its decisions with a detailed justification. It analyzes the country’s legislation, the powers of its supervisory authority, and available legal remedies.

Judicial review. These decisions can be challenged before the Court of Justice of the European Union, and the court has overturned them. It struck down the EU–US data transfer agreements twice, in 2015 and 2020, following lawsuits filed by a private individual.

Independent oversight. In the EU, data protection authorities are independent from the government by design.

In the Russian version, the list is drawn up by the same body that enforces compliance. The justification is not published, and there is no mechanism to challenge the list’s composition. On the whole, the wrapper is European, but the contents are not.

How this relates to censorship

An allowlist. There is a list of destinations available right away, and everything else requires a procedure and a wait. This works exactly like the allowlists of services, the list of domain registrars, and the device registry. Accordingly, violations can be punished and resources can be restricted.

A criterion set inside the agency. An external criterion has been replaced by an assessment from the same body that maintains the list.

The harder it is to use foreign infrastructure, the more firmly an organization is tied to Russian infrastructure. And Russian infrastructure means SORM (the System for Operative Investigative Activities, Russia’s lawful interception system), filtering equipment, requirements for hosting providers, and everything else we described in our article on the telecom reform.

Nobody can force a foreign service to install SORM, because Russia has no jurisdiction over it. But the authorities can make sure that a Russian organization stops using it. Then the data stays where it can be accessed, and no equipment abroad is needed. Alternatively, a Russian organization keeps its foreign servers, but its website gets blocked in Russia.

As with most such cases where security is used to justify restrictions, the authorities force online resources to choose: play by the rules or face censorship.

What we don’t know

How the requirement to study the recipient country’s legislation is enforced. Formally, it is mandatory. In practice, it looks impossible for a small organization to meet.

What will happen to data transfers to Ukraine after October 30. The procedure is changing, but there is no ban, and it is unknown whether one will appear.

How many ban decisions have been issued in recent years, and for which destinations. Only the first seven cases are known. The agency does not publish recent statistics.