Russia Federal Law 152-FZ on Personal Data

National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.


Short name	RU 152-FZ
Region	Europe
Country or scope	Russia
Sector	Privacy
In your workspace	Off until you switch it on in Compliance › Manage.

How Safeguard covers RU 152-FZ

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`RU-152FZ-19` Security of Personal Data	Operators must take technical measures to prevent unauthorized access to, destruction, modification or copying of personal data, including protection against malicious software; integrity hashes on components evidence tamper protection (152-FZ Art. 19)	Scan
`RU-152FZ-19-2` Accounting of Information Systems and Carriers	Security measures include keeping account of the machine media and information systems that process personal data, which for software means an inventory of components with known versions (152-FZ Art. 19(2))	Scan
`RU-152FZ-18-1` Internal Accountability Measures	Operators must adopt and document internal measures ensuring compliance, including internal audit and documentation of processing systems; a machine-readable software inventory supports this accountability duty (152-FZ Art. 18.1)	Scan
`RU-152FZ-6-3` Entrusted Processing Obligations	Processing may be entrusted to a third party only under an instruction obliging that party to observe data security requirements, requiring visibility into which suppliers stand behind the software in use (152-FZ Art. 6(3))	Scan
`RU-152FZ-21` Incident Notification Readiness	Since the 2022 amendments operators must notify Roskomnadzor of personal data incidents within 24 hours, which requires immediately identifying the affected software components (152-FZ Art. 21, as amended by Law No. 266-FZ of 2022)	Scan

All 22 from the standard set, adapted to RU 152-FZ.