Abstract
The paper analyses amendments to the Federal Law «On Personal Data» that entered into force in 2025. It notes that the reform is systemic in nature and is aimed at substantially tightening the requirements imposed on personal data operators. The principal innovations include the introduction of differentiated administrative fines for data breaches, the amount of which depends on the number of affected data subjects, as well as stricter criminal liability. The paper examines in detail the new requirements for obtaining valid consent to personal data processing: from 1 September 2025, such consent must be executed as a separate document. It also addresses the regulation of data anonymization and the prohibition on cross‑border data transfers prior to the initial storage of data in Russia. The article concludes that the amendments significantly increase legal and financial risks for personal data operators, requiring them to adopt without delay comprehensive organizational and technical measures to bring their activities into compliance with the updated legislation.