Fines for personal data leaks: why Russia is still paying pennies, but everything will change soon.
A fresh report by the InfoWatch analytical center has been published on fines for personal data leaks for 2025 - the first half of 2026. Around the world the fines amount to hundreds of millions of dollars, but here the amounts seem very modest, but that's only for now.
First, Russia's numbers.
For a year and a half - 35 fines according to Section 13.11 of the Administrative Offenses Law. Of these, 13 occurred in the first half of 2026. In total, the Russians paid 2 million 195 thousand rubles for this half year. It sounds frivolous against the background of the 557 million global dollars, but there is a nuance: it is one and a half times more than in the whole of 2025 (then it was 1.385 million). A year ago, in the first half of the year there were only 725 thousand.
Who came to the attention of the courts?
Most of the fines are in the field of IT/IS, industry and commerce (23.1% and 15.3% respectively). They are followed by banks, medicine, education and transportation.
The loudest cases.
Taobao - one million rubles. This is the first case where a foreign company in Russia was punished precisely for leaking Russian data, and not for refusing localization. The profiles of the candidates and employees were leaked: full names, passports, SNILS.
Gasker integration is generally interesting. One leak from the general pool and seven related companies were fined at once. True, according to the old rules: from 30 to 150 thousand rubles. In total - 615 thousand.
Ukids (online school for children) - 400 thousand rubles. The first fine under the new rules, which came into effect on May 30, 2025. According to the article, the legal entity was threatened with 10 million, but the court took into account that the company is a micro-enterprise and reduced the amount. By the way, the database was leaked from the CRM: about 500 thousand rows, including internal notes on customer statuses.
TBank - 150 thousand rubles for an accidental leak of one customer's data.
TsAM (Tsentraviamed) - 30 thousand rubles. Medical data of customers was leaked, including passports and SNILS. They punished me according to the old version of the Law on Administrative Offenses, because the violation occurred on May 1, 2025.
The main thing you need to understand is that starting May 30, 2025, the rules of the game have changed.