Russia May Let Firms Store Data Abroad After Drone Strikes
In short: The Association of Internet Trade Companies (AKIT) has asked the Russian government to temporarily allow businesses to store citizens' personal data in data centers of "friendly" foreign countries if Russian facilities are damaged in drone strikes. The proposal would carve out a temporary exemption from the "On Personal Data" law, which otherwise requires the initial processing of Russian citizens' personal data to happen on servers located in Russia. AKIT suggests capping the regime at March 1, 2028, and only for companies that can document an incident and an inability to keep critical systems running domestically. It's a reminder that data-localization rules exist for a reason — and that the rules themselves can bend once the physical infrastructure behind them is under threat. For more on how to check whether your own data has already leaked, see our personal data leak check guide.
What AKIT is asking for
According to multiple Russian business outlets, AKIT has submitted a package of support measures to the government following a wave of drone strikes on trade and digital infrastructure. One proposal is a special legal regime for companies whose data centers are damaged in large-scale incidents: for the duration of the recovery period, and no later than March 1, 2028, affected businesses could temporarily place systems containing personal data in backup facilities abroad — specifically in countries considered "friendly" to Russia. AKIT wants the Ministry of Digital Development and Roskomnadzor to jointly design the procedure for issuing these temporary permits.
Why this is coming up now
Russia's "On Personal Data" law has required local processing of citizens' personal data since 2015 — a rule often summarized as "data localization." The request for a temporary exemption follows a string of drone attacks that damaged data center infrastructure in 2026, leaving some companies unable to guarantee continuous operation of systems that by law must stay on Russian soil. AKIT frames the proposal narrowly: a time-limited emergency measure tied to documented physical infrastructure damage, not a general loosening of localization requirements.
What this means for your data
If adopted, the measure would only apply to companies that can prove an incident and get an official permit — it is not a blanket rule change, and for most services your data would keep being processed inside Russia exactly as before. But it does highlight something worth remembering regardless of where this specific proposal lands: data-localization laws tell you where a company is legally required to process your data, not what actually happens to it during an outage, a breach, or now, a physical attack on the building that houses the servers. Where your personal information sits has real consequences for which country's courts, regulators, and law-enforcement requests can reach it.
How to reduce your own exposure regardless of where data sits
You can't control where a company's backend servers are hosted, but you can control two things that matter most in practice. First, limit how much personal data you hand to services that don't need it — fewer accounts with your real name, address, and documents means fewer places that data can leak from, wherever the server is. Second, protect your own connection: encrypting your traffic with the LiMP VPN app keeps your network provider and local observers from seeing which services you use or intercepting data in transit, and its no-logs policy means the service itself doesn't keep a record to leak in the first place. Neither step changes where a company's database physically lives, but both reduce what an attacker — or an outage — can actually get their hands on.
Sources
Frequently asked questions
Is this already law, or just a proposal?
So far it's only AKIT's proposal to the government. The association suggests the Ministry of Digital Development and Roskomnadzor jointly design the permit procedure — no decision had been made as of publication.
For how long would storing data abroad be allowed?
AKIT proposes limiting the regime to the infrastructure-recovery period, no later than March 1, 2028, and only for companies with a documented incident.
How is this proposal related to VPN and privacy?
Not directly, but it's a reminder that the jurisdiction where your data is stored affects who can access it. The same principle is why a VPN's no-logs policy matters — where and how long activity logs are kept.