On September 1, 2025, new procedures and methods for anonymizing personal data will come into force under the Order of Roskomnadzor dated June 19, 2025, No. 140 “On the Approval of Requirements for Anonymization of Personal Data and Methods of Anonymization of Personal Data, Except for Cases Specified in Paragraph 9-1, Part 1, Article 6 of the Federal Law of July 27, 2006 No. 152-FZ ‘On Personal Data.’”

The goal is to establish clear rules for anonymization and provide businesses and the state with new opportunities for the safe use of big data and artificial intelligence technologies.

Key Changes

1) Anonymized data may be processed without the individual’s consent.
Previously, the law required consent for almost any type of data processing. Now, properly anonymized data may be used without prior consent of the data subject for research or technological purposes (e.g., AI training) without violating the law.

2) Mandatory transfer of anonymized data to a state information system.
All personal data operators must transmit anonymized information to a geoinformation system (GIS). The Russian Government has designated the Unified Information Platform of the National Data Management System (UIPS NDMS) with a new anonymized data subsystem as such a system.
In practice, when the state needs large datasets for analytics or social projects, it will request anonymized datasets from data holders instead of raw personal data. Importantly, forming “data sets” from biometric personal data is prohibited — the law explicitly excludes anonymization of biometrics for this GIS.

3) Protection of citizens’ rights in data exchange.
A new mechanism requires notifying individuals about the planned transfer of their data even in anonymized form, with the right to object. In other words, a person must be informed that their data (though anonymized) may be transferred, and they can prohibit it — in which case the transfer must be canceled. This approach balances the state’s interest in analyzing big data with the individual’s right to control information about themselves.

4) Restricted access to anonymized data.
Only trusted entities and persons will be granted access to anonymized data in the GIS. Foreign companies, organizations with unclear ownership status, and individuals with criminal records for cybercrimes will be excluded. This measure aims to reduce risks of leaks and misuse of anonymized datasets.

5) New opportunities for urban digital systems.
For example, facial images (CCTV footage) and voice recordings may now be processed without consent if they are properly anonymized. This allows city surveillance cameras and audio sensors to collect and analyze anonymized information (e.g., counting pedestrian flows, detecting events) without breaching personal data laws. However, anonymization methods must remain transparent, and safeguards must ensure that re-identification of individuals is impossible.

Conclusion

By September 1, 2025, Russia will establish a new legal framework for handling large datasets: personal information can be used in aggregated, depersonalized form to advance technology and governance, while maintaining strict confidentiality and individual rights protections.

Sources: Roskomnadzor Order No. 140 dated June 19, 2025; article on Habr.