Personal data in Russia’s digital domain: enforcement, data breaches and algorithmic risks

Abstract

Purpose of the study. The article examines the operation of Russia's personal data regime within digital sovereignty. It argues that digital harm cannot be reduced to a data breach and distinguishes three legally relevant events: compromise of confidentiality; unlawful processing without disclosure, including excessive collection, incompatible secondary use and unfair profiling; and sovereign risk arising from data concentration, foreign access or systemic infrastructural influence. The article analyses political campaigning, automated decision-making, localization, cross-border transfers, incident notification, anonymized state data sets, and the new administrative and criminal liability framework. Russian practice is studied through the Yandex.Eda and VK incidents, the first 2026 enforcement decisions, and the Supreme Court ruling confirming that an operator remains responsible when technical processing is outsourced. Official Roskomnadzor statistics are compared with InfoWatch monitoring and F6 data, with explicit attention to different units and methodologies. The Didi Global Inc. enforcement action and China's 2025 Personal Information Protection Report are used as comparative material. Conclusions. The article concludes that effective sovereignty requires a shift from punishment after disclosure to documented preventive control over purposes, algorithmic inferences, contractors and high-risk projects.