Yandex Cloud and Federal Law № 152-FZ

No. Only the databases with Russian citizens' personal data and the infrastructure components responsible for processing this data must be located in Russia.

Yandex Cloud data centers are located in Russia and their infrastructure fully meets the requirements of Federal Law No. 152-FZ. All you have to do is ensure the application side is compliant, build a number of processes, and create the relevant documentation. You can assign these tasks to our partners.

The provider’s responsibility varies depending on the cloud service model used by the customer — Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS) — and the security mechanisms and policies available to the cloud provider.

For IaaS: The provider is responsible for the physical security and fault tolerance of the platform itself, network security, and the collection and analysis of security events from hypervisors and other infrastructure components.

For PaaS/SaaS: The provider ensures the security of PaaS/SaaS components. This includes VM protection, DB backups, and encryption of user data hosted in the cloud under Federal Law № 152-FZ.

The customer is responsible for managing access rights to resources and preventing unauthorized access to data. In both private infrastructure and cloud service models, companies are solely responsible for ensuring that data is labeled and properly classified to fulfill any regulatory compliance requirements.

The customer’s responsibility also varies depending on the cloud service model chosen: IaaS, PaaS, or SaaS. Companies that use the IaaS model should be responsible for the security of guest VMs, back up VMs, protect the virtual network, control access to resources, and secure cloud user accounts.

When using managed services (PaaS/SaaS), it is the responsibility of the customer to classify data, ensure access control, set up data protection, and manage their users and end devices.

While storing personal data in the cloud under Federal Law № 152-FZ, you continue to be the owner of the data and must fulfill all the duties as the data operator. This includes acquiring consent to process personal data, notifying Roskomnadzor about data processing, and modeling threats to your information systems.

You can do this yourself or with the help of one of Yandex Cloud’s trusted information security partners.