It said that a working party will meet on 15th October to discuss the implications of the rejection of the Safe Harbour scheme and that in the meantime market research agencies relying on Safe Harbour to justify personal data transfers to the US needed to make alternative arrangements.

To be compliant Efamro recommends agencies first check which data transfers are affected and then finding alternative ways of ensuring protection.

Meanwhile, the Russia Data Localisation Law which came into effect on September 1, 2015 states that organisations collecting data from Russian citizens must store that it on databases located within Russia itself. It only applies to data collected after September 1, 2015.

Efamro’s guidance notes point out that “the obligation to store personal data in Russia applies to seven types of data processing and is summed up in the law as follows: recording, systematisation, accumulation, storage, updating, changing or retrieval of personal data of citizens of the Russian Federation.”

Personal data means any information directly or indirectly related to any identified or potentially identifiable person and is likely to include name, date and place of birth and address.