Appendix No. 2 to the Decision of the Board of the Eurasian Economic Commission No. 30 of 21 April 2015 (“On Measures of Non-Tariff Regulation”) sets out the Union-wide list of goods restricted for import into the customs territory of the Eurasian Economic Union (EAEU), including Russia. The list includes, among others, (i) radio-electronic and high-frequency equipment for civilian use—devices for transmitting or receiving voice, images, or data (e.g., headings in HS 8471, 8517–8519, 8521, 8525–8528, 8531, and certain Chapter 90 items); (ii) systems and receivers for technical radio monitoring and for detecting sources of electromagnetic emissions (e.g., HS 8526–8527); and (iii) encryption (cryptographic) means, including computing machines and parts with cryptographic functions, computer devices incorporating encryption, and standalone cryptographic software (selected subheadings of HS 8471/8473 and 8523).

It is reported that foreign stakeholders have indicated that the Russian Government does not consistently publish all regulations, judicial decisions, and administrative rulings of general application relating to customs matters. In addition, foreign exporters report that the enforcement of customs regulations varies considerably across regions and ports of entry, and that regulatory changes are often frequent and unpredictable, thereby increasing costs and causing delays at the border.

Federal Law No. 374-FZ provides that Internet and telecommunications companies are required to disclose communications and metadata, as well as “all other information necessary,” to authorities on request and without a court order. The law penalises companies that fail to disclose requested information with fines of up to one million rubles (approx. USD 16,500) (Arts. 11, 13, 15).

The Federal Law on Trade Secrets establishes a formal framework for the protection of confidential business information. Nevertheless, stakeholders report that, in practice, the Russian trade secret regime imposes disproportionate burdens on rights holders, particularly through the requirement to satisfy specific preconditions for protection that do not adequately reflect the commercial realities faced by most enterprises. With respect to enforcement, stakeholders further observe that, although deterrent‑level sanctions and preliminary measures are formally available, courts rarely impose such remedies in cases of trade secret misappropriation.

The so-called “Anti-Piracy Law” establishes a safe harbour for Internet Service Providers (ISPs) in certain cases. According to Art. 1253.1 introduced by this Law to Part IV of the Civil Code, an information intermediary transferring material in an information and telecommunication network is not responsible for the violation of IP rights resulting from this transfer, provided that the following conditions simultaneously exist: (i) he is not the initiator of this transfer and does not determine the recipient of the specified material; (ii) he does not change the specified material when providing communication services, with the exception of changes made to ensure the technological process of transferring the material; (iii) he did not know and should not have known that the use of the corresponding result of intellectual activity or means of individualisation by the person who initiated the transfer of material containing the corresponding result of intellectual activity or means of individualisation is illegal.
In addition, according to the Article, an information intermediary providing the possibility of posting material in an information and telecommunications network is not responsible for the violation of IP rights that occurred as a result of the posting of materials in the network by a third party or at his direction, while the intermediary observes the following conditions: (i) he did not know and should not have known that the use of the corresponding result of intellectual activity or means of individualisation contained in such material is illegal; (ii) in case of receiving in writing a statement of the copyright holder about the infringement of intellectual rights with an indication of the website page and (or) the network address on the Internet on which such material is posted, he took the necessary and sufficient measures in a timely manner to stop the infringement of intellectual rights. (the so-called "Notice and takedown" rule).
The information intermediary, who is not held responsible for the violation of IP rights accordingly, may be subject to claims for the protection of IP rights, including the removal of information that violates exclusive rights or restricting access to it.

It is reported that there is no obligation for passive infrastructure sharing in Russia to deliver telecom services to end users. However, it is practised in both the mobile and fixed sectors based on commercial agreements.

It is reported that the Russian Government holds a 38% stake in Rostelecom, a major telecommunications company and one of the largest operators in Russia and Eastern Europe. Rostelecom provides extensive services such as fixed-line telecommunications, broadband internet, digital television, and mobile services, alongside IT solutions, cloud services, and data centre operations. As a state-owned enterprise, Rostelecom plays a crucial role in shaping Russia's telecommunications infrastructure and digital economy.

Russia lacks rules for functional separations for operators with significant market power, although there are rules in place for accounting separation. Under Ministry for Digital Development, Connection, and Mass Communications Order 54, dated May 2006, operators that hold substantial positions in publicly available networks and operators of universal services and natural telecoms monopolies must keep separate accounts for different types of activity; provided services; and different sections of the telecoms network used for the provision of such services. In addition, Russian competition laws also provide for forced separation as a last resort measure that may be implemented by a court at the request of antitrust authorities with respect to a dominant market player that systematically abuses its dominant position.

In 2017, the Russian State Commission for Radio Frequencies issued a decision requiring telecommunications operators seeking to rent capacity from a foreign satellite operator to demonstrate that Russian satellite providers do not have such capacity.

Russia has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

Russia has a national telecommunications regulator, the Federal Service for Supervision of Communications, Information Technology, and the Mass Media (Roskomnadzor). Nonetheless, available reporting suggests that its decision-making autonomy is constrained. Roskomnadzor is institutionally subordinate to the Ministry of Digital Development, Communications, and Mass Media, a relationship that significantly limits its independence from executive authority.

Art. 18.5 of Federal Law No. 152-FZ provides that during personal data collection, including through the Internet, the data operator shall ensure that databases located within the Russian Federation are used to record, systematise, accumulate, store, update, modify and retrieve personal data of Russian citizens. However, the requirements do not apply to companies that do not receive the data directly from either data subjects or such third parties or inadvertently in the course of normal business activity. Moreover, provided that personal data, when initially collected, is placed in a primary database located and maintained in Russia, personal data contained in the database may then be transferred abroad and placed in other secondary databases, provided the requirements for data transfers are complied with. As a result, once personal data is collected, it shall be placed in the database located in Russia (i.e., the primary database). All mentioned operations on the data should be carried out locally. Afterwards, the data can be transferred abroad for further processing (i.e., to the secondary database).
It is reported that since 2015, the Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor) has been active in enforcing the above-mentioned measure. For instance, in November 2016, subject to the claim from Roskomnadzor, the court in Moscow restricted access to the LinkedIn social network due to the breach of the measure. Further cases mostly included administrative fines, which were also issued to major multinational companies, including Meta Platforms, Inc. (formerly Facebook, Inc.), Twitter, Inc. and later WhatsApp LLC, Google LLC, Airbnb, Inc., Apple, Inc., Twitch Interactive, Inc., United Parcel Service, Inc., Pinterest, Inc., Likeme Pte. Ltd., Ookla, LLC., Snap Inc., Match Group, LLC, Hotels.com, L.P., Spotify AB, and Zoom Video Communications, Inc. Some companies also faced repeated higher fines.
The Code of Administrative Offences establishes fines of up to RUB 6 million (approx. USD 64,620) for the first offence and up to RUB 18 million (approx. USD 193,860) for the subsequent offence.

Art. 30.6.4 of Federal Law No. 161-FZ requires that foreign-based credit card companies transmit data for all transactions within Russia through state-owned operators: the National System of Payment Cards. It is reported that this affects the possibility for financial supplies to use their processing facilities located outside of Russia.

Art. 64 of Federal Law No. 126-FZ requires telecom operators to store in the territory of the Russian Federation the following information:
- Information on the facts of reception, transmission, delivery and (or) processing of voice information, text messages, images, sounds, video or other messages of users of communication services - within three years from the moment of the end of such actions;
- Text messages of users of communication services, voice information, images, sounds, video or other messages of users of communication services - up to six months from the moment of termination of their reception, transmission, delivery and (or) processing.
In addition, Art. 10.1 of Law No. 149-FZ requires distributors of information, such as internet and telecom companies, messengers, email services, forums and other platforms that allow the exchange of information on the internet, to store in the territory of the Russian Federation the following information:
- Information on the facts of reception, transmission, delivery and/or processing of voice information, written text, images, sounds, video or other electronic messages of internet users and information about these users for one year after the end of such actions;
- Text messages of internet users, voice information, images, sounds, video and other electronic messages of internet users up to six months from the end of their reception, transmission, delivery and/or processing.

Art. 12 of Federal Law No. 152-FZ prohibits the cross-border transfer of data to countries that do not provide adequate protection of data subjects. However, cross-border transfers of personal data are permitted in the following circumstances: (i) approved by the Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor) as providing adequate protection, which will include countries party to Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108); or (ii) in cases where such transfer is necessary to protect the life, health, or other vital interests of the data subject or other persons. Starting from 1 March 2023, operators have to notify any cross-border transfers of personal data before such transfers and, for transfers to countries which are not 'adequate', obtain permission from the Roskomnadzor for the transfer, with limited exceptions.