E.g., administrative fines of up to RUB 15 million for personal data breach (up to RUB 20 million for biometrics breach) and turnover fines of up to 3% of total revenue (which cannot exceed RUB 500 million) for repeated breach are introduced. It will be a criminal offence to illegally store/collect/transmit any illegally obtained personal data. The sanctions include imprisonment of up to 10 years.