Ban enters into force on the use of foreign cloud services by government agencies

On 1 September 2024, a ban entered into force on the use of foreign hosting services for government agencies’ IT systems. Under the new rules, only domestic contractors from among the hosting providers included on the register of Russia’s Digital Ministry that meet the established requirements may be used for such information systems.

In addition, as a rule, state agencies will no longer be allowed to use foreign information systems and cloud services regardless of their type (IaaS, PaaS, or SaaS) when creating and operating such information systems, and when “interacting in an electronic form”.

What is covered by the ban?

Federal Law “On Information, Information Technologies and Information Protection” dated 27 July 2006 No. 149-FZ (“Law”) (as amended and restatedThe amended and restated version means the provisions of the Federal Law “On making amendments to the Federal Law “On Information, Information Technologies and Information Protection” and Federal Law “On Communications” dated 31 July 2023 No. 406-FZ (“Hosting Providers Law”), which entered into force on 1 September 2024.) extends the abovementioned ban to any “information systems” (“ISs”); the Law defines them quite broadly as “the totality of information contained in databases and information technologies and technical facilities for ensuring its processing”.

The Law defines a “hosting provider” as any “person engaged in the activity of providing computing capacity for placing information in an information system permanently connected to the Internet”.

The ban applies to:

• the government (both federal and regional) ISs and municipal ISs
• the ISs of state and municipal enterprises and organisations

Hosting services

The abovementioned categories of customers will only be able to use the services of the hosting providers included on the special register of the Digital Ministry (approved by Government Resolution No. 1144 of 24 August 2024) and meeting the following requirements:

• there is no record of untrue information on the legal entity in the Unified State Register of Legal Entities and such legal entity is under the control of, inter alia, the Russian Federation (constituent entities/municipalities) and/or citizens of the Russian Federation who do not have foreign citizenship (for legal entities);
• the applicable data protection requirements are complied with;
• the server equipment is located within the Russian Federation;
• they are included in Roskomnadzor’s register of hosting providers.

Cloud services

In addition to the restrictions applicable to hosting, article 13(2.4) of the Law restricts government agencies from using any ISs or software owned by foreign legal entities and individuals if they are “operated via the Internet”.

We believe that such relatively broad language used in the Law imposes a ban on any foreign cloud services, regardless of their type (IaaS, PaaS, or SaaS).

Brief note on the previous requirements of the Law

As a reminder, the first part of the restrictions in relation to hosting providers under the Hosting Providers Law already entered into force on 1 December 2023.

The amendments imposed, inter alia, include:

• information security requirements (including the obligation to only store data onshore in Russia;
• the obligation to comply with the requirements of supervisory authorities to eliminate violations of the provisions of the Hosting Providers Law;
• the requirement to cooperate with the Federal Security Service of Russia on the issues of conducting investigations
• the requirement for hosting providers to cooperate with the State System for the Detection, Prevention and Elimination of Consequences of Computer Attacks (GosSOPKA)

In addition, hosting services under the Hosting Providers Law can only be provided to persons who have undergone an identity verification process.

Finally, Roskomnadzor launched a special register of hosting providers. From 1 February 2024, any hosting providers not included on the register are not permitted to operate.