IT Industry in Russia: Legal Regulation Review
Over the recent years, information technology industry has been one of the fastest growing and high-potential sectors of the Russian economy. The turnover and profits of players in this market continued to grow even during the coronavirus pandemic. Russia has become an important software development site in the global IT market and exports more and more Russian software products developed in the country abroad.
Russian IT legislation continues developing actively to cater to the rapidly changing market.
Among the recent changes, I would like to highlight the unprecedented tax incentives introduced for companies operating in the IT sector, which, however, are subject to a number of mandatory conditions.
Foreign companies selling their software products on the Russian market should take into account the specific requirements of Russian legislation within the framework of the import substitution policy. The said requirements relate to both the structure of a Russian company supplying software and contracts entered into thereby, which have to be fulfilled for the supply of developed products in public procurement process.
Ultimately, companies whose employees, counterparties or clients are Russian citizens should take into account the specific requirements of Russian legislation regarding the localization of operations for the collection, processing and storage of personal data on servers located in Russia.
SCHNEIDER GROUP is pleased to present to your attention this brochure, which provides an overview of the current provisions and latest changes in Russian legislation relevant to the IT industry in Russia with comments of our legal and tax experts.
The practice of the Russian offices of SCHNEIDER GROUP shows that there are more and more IT companies, both Russian and foreign, among our clients, to which we provide assistance on issues concerning the search and provision of personnel, entry into the Russian market, structuring and subsequent comprehensive support of their business activities in relation to legal, tax and accounting issues.
We hope that this brochure will help you to structure your IT business in Russia correctly, get all available tax preferences and avoid possible mistakes and losses caused by the lack of knowledge of peculiarities of Russian legislation.
The advisers of SCHNEIDER GROUP will be glad to share their expertise with you and provide comprehensive support on any issues related to doing business in Russia.
With best regards and wishes of success in business development in Russia,
1. Legal Regulations
The use of information technologies in Russia is generally governed by the Federal Law On Information, Information Technologies and Information Protection No. 149 dated July 27, 2006 (hereinafter the "Information Law"). In detail, this law includes definitions relating to the use of the Internet and sets out general restrictions in this regard.
In addition to the Information Law, certain aspects of activities that require the use of information technologies are also governed by specific acts, in particular the RF Civil Code (hereinafter the "Civil Code") and the Federal Laws On Advertising, On Competition Protection, On Personal Data, the Consumer Protection Law, the Communications Law, etc.
The competent authority, which mainly exercises control and supervision in the field of IT technologies, is the Federal Service for Supervision in the Sphere of Communications, Information Technologies and Mass Communications (Roskomnadzor). Recently, however, more and more powers in this area have been granted to the Federal Security Service (FSB).
2. Digital Rights
Digital rights have been regulated by Russian legislation since 2019 when framework article 141.1 of the Civil Code of the Russian Federation entered into force: these rights include contractual and other rights named as such in the law, the contents and conditions for the exercise of which shall be determined in accordance with the information system rules meeting the characteristics established by the law.
Currently, legislation stipulates two types of digital rights: utility digital rights and digital financial assets.The first ones include the right to demand the transfer of an item of property, exclusive rights to intellectual property and (or) rights to use intellectual property or as well as demand performance of work and (or) provision of services.
In their turn, digital financial assets include receivables, the ability to exercise rights pertaining to marketable securities, rights to participate in the capital of a non-public joint-stock company, and the right to demand the transfer of certain marketable securities.
Operators of information systems, within the framework of which the said digital rights are issued and registered and circulate (including investment platforms) shall be included in a special register maintained by the Bank of Russia, which exercises control over the activities of such operators.
3. Cryptocurrency (digital currency)
Russian legislation recognizes the existence of cryptocurrencies (digital currencies) but radically limits the scope of their circulation prohibiting to accept digital currency payments for goods, works and services. At the same time, digital currency is recognized as property, at the expense of which creditors’ claims can be satisfied in case of bankruptcy or enforcement proceedings,
4. Law on Isolation of the Russian Internet (Runet)
On November 1, 2019, Federal Law No. 90-FG of 01.05.2019 entered into force amending the Federal Law "On Communications" and the Information Law, which is intended to ensure the autonomous operation of the Russian Internet segment in the event of external dangers.
In order to counter such threats, the law established the obligation of telecom operators to ensure installation of, and possibility to employ, facilities to counter threats to the integrity, stability and security of the Internet. Such facilities themselves shall be transferred, put into operation and remotely controlled by the radio frequency service of Roskomnadzor.
In addition, if any threats to the functioning of the Internet in the territory of Russia are identified, Roskomnadzor shall exercise centralized control over the relevant networks, including traffic routing by telecom operators via threat countering facilities. Such threats can be determined by the Ministry of Digital Development, Communications and Mass Media of the Russian Federation (“Mintsyfry”), Roskomnadzor and FSB based on the results of training exercise or research conducted.
To date, no threats to the functioning of the Internet have been identified, however, Russian users are worried that the law will be used to restrict the use of information published outside of Russia.
5. Preinstallation of Russian Software
On April 1, 2021 the requirements concerning obligatory preinstallation of Russian software on certain types of technically sophisticated goods (smartphones, tablets, Smart TV sets, etc.) entered into force.
The list of Russian software to be preinstalled was approved by Regulation of the Government of the Russian Federation No. 3704-p dated December 31, 2020 and includes 28 item names that, in their turn, are divided into groups based on the types of goods, on which they are to be installed.
In addition, the Government of the Russian Federation shall determine the requirements for the search engine, which the user must be able to use in the pre-installed software without additional settings (by default). The corresponding requirement will come into force on July 1, 2021.
6. Conclusion of Contracts Via Internet
The conclusion of contracts via the Internet without the use of a digital signature has long not been subject to any specific legal regulation. Formally, there is nothing which opposes to the conclusion of contracts on the basis of the general legal provisions on the form of contracts, however, there may be difficulties in proving the scope of the transaction in case of dispute, as the business terms are not documented.
In view of the rapidly growing number of such transactions (especially in the B2C sector), the procedure for concluding contracts via the Internet was finally regulated by law. On October 1, 2019, amendments to Art. 160 and 434 of the Civil Code on the written form of transactions and the form of contracts entered into force.
Art. 160 of the Civil Code has been supplemented with a provision, according to which the written form of the transaction shall also be considered to be met if the transaction has been concluded with the help of electronic means, provided that the contents of this transaction can be recorded on a physical storage medium. In this case, the requirement of a signature shall be deemed to have been fulfilled if any method has been used, which would allow to identify the signing person with certainty (a specific procedure may be provided for by law or agreement of the parties).
In addition, Art. 434 of the Civil Code was supplemented with a provision that makes it possible to conclude a contract by drawing up an electronic document, or by exchanging electronic documents in accordance with the new provisions in Art. 160 of the Civil Code.
With regard to the conclusion of license agreements with end users of computer software –(EULA), a simplified procedure has been in effect for several years. The procedure allows that license conditions are set forth in an electronic form, where users consent to conclude the agreement by using the software (Art. 1286, Cl 5 of the Civil Code).
7. Restrictions on the Acquisition of Foreign Software
Currently the acquisition of foreign software (except for software that originates from the countries of the Eurasian Economic Union) for state and municipal needs is prohibited in Russia. The said ban currently concerns not only the direct acquisition of software (licenses thereto) but also other types of software distribution, including supplies of equipment on which the software is to be installed pursuant to a respective contract.
The relevant regulation directly applies only to procurements carried out by state and municipal entities and authorities; however, many companies partially owned by the government apply it voluntarily. However, there are two exceptions to the ban when foreign software still may be acquired for state and municipal needs, namely: (1) if the Russian Software Register (or Eurasian Software Register) does not contain information on the software of the required class or (2) the software of this class is included in the respective register but according to its functionality, its technical and operational characteristics it does not meet the requirements set by the customer.
To be included in the Russian software register, the worldwide exclusive right to the respective product must belong to a Russian company without foreign majority participation (below 50%). In addition, the total amount of payments for the use of intellectual property and / or performance of works (provision of services) with regard to the development, modification and adaptation of the software made to foreign persons, their representatives and Russian companies controlled by foreign persons must be less than 30% of the revenues the IP right owner received as compensation for granting the right to use the software for a calendar year.
There are similar requirements for a registration in the Eurasian software register (as adjusted for the affiliation of companies and / or individuals with the member states of the Eurasian Economic Union).
Currently, there are more than 10,000 software products registered in the Russian software register, and over 50 – in the Eurasian software register.
8. Restriction on the Use of Internet-Anonymizing Services and VPN
On November 1, 2017, amendments to the Information Law came into force, obliging owners of anonymization software and VPN services to ensure restriction of access to certain information resources.
Roskomnadzor identifies the owners of VPN and anonymization services and sends them demands that they connect to the register of blacklisted Internet resources. If any owner of VPN and anonymization services refuse to cooperate, Roskomnadzor is entitled to block access to the respective services.
It should be taken into consideration that these requirements only apply to mainstream VPN and anonymization services. The law does not apply to VPN services with a pre-determined circle of users that use the services for their own needs.
Roskomnadzor started applying these regulations in 2019 only. The notifications of the requirement to connect to the register of blacklisted websites have been sent to 10 services: NordVPN, Hide My Ass!, Hola VPN, Openvpn, VyprVPN, ExpressVPN, TorGuard, IPVanish, Kaspersky Secure Connection and VPN Unlimited. Currently, there is no information on foreign services who have agreed to meet Roskomnadzor's requirements.
9. Information Dissemination on the Internet
According to the Information Law, "Organizers of Information Dissemination on the Internet" are persons who ensure the operation of services intended for the receipt, transmission, delivery or processing of electronic communications of Internet users.
Organizers of Information Dissemination shall be included into a special register of Roskomnadzor and shall transmit to the FSB information about users, messages and files sent by them, as well as provide such information on request from the competent bodies, submit encryption keys to the FSB for the purpose of decoding electronic messages and fulfill a number of other duties. Non-compliance with the respective obligations may lead to the blocking of the corresponding source of information.
Although the law was originally focused on messengers and social networks, in practice the definition of Organizer of Information Dissemination applies to all services with the possibility of exchanging messages and other content among users (e.g. websites with forums). Therefore, next to the messengers (WeChat, Threema, Telegram), e.g. a website of a psycho-neurological institution is registered in the register.
Many large Internet resources that fall under the definition of Organizers of Information Dissemination (such as WhatsApp, Facebook, Google services) have not been registered in the relevant register and are currently out of focus of Roskomnadzor.
10. Right to Be Forgotten
Since January of 2016 amendments to the Information Law have been in effect, in accordance with which any individual is entitled to demand that a search engine operator that distributes advertising on the Internet to consumers in Russia should block information about them in the search results, if such information is disclosed in violation of the Russian legislation, is unreliable or outdated. An exception is information on criminal offences where the statutes of limitations have not yet expired, or the conviction has not been removed from records or expunged.
11. Personal Data Localization
Since September 1, 2015, requirements on the localization of personal data have been applied in Russia: Persons collecting personal data of Russian citizens via the Internet or otherwise shall ensure the processing of such data (including their collection, storage, updating and retrieval) by means of databases located in the territory of the Russian Federation. This requirement was enacted to protect personal data of Russian citizens against potential negative acts from abroad.
At the same time, the legal provisions that allow the cross-border transfer of personal data to foreign countries are still valid. According to the clarifications on the website of Mintsyfry, the databases of personal data must be formed, updated and kept on the territory of Russia. Subsequently, however, the database may be transferred abroad. Therefore, instead of the originally stated purpose the localization requirement is in reality aimed to create an appropriate infrastructure for the storage of databases in Russia, and to ensure access to them by Russian state authorities.
Currently, only one large foreign service provider has been affected by non-compliance with localization requirements: Roskomnadzor has restricted access to the LinkedIn social network. Meanwhile, other foreign Internet services (Facebook, Twitter, etc.) have not yet met this requirement but without any negative consequences for themselves as they have too many users in Russia.
In December 2019, Russian legislation was supplemented with provisions on special fines for violation of the requirements for the localization of personal data: for example, the amount of the fine for legal entities amounts to from 1 to 6 million rubles, and for a repeated violation - from 6 to 18 million rubles.
12. Regulation of Social Networks
On February 1, 2021, amendments to the Information Law entered into force to regulate social networks, the daily Russian audience of which exceeds 500,000 users.
Such social networks shall be included in a special register, and their owners shall be obligated to perform a number of functions: to monitor information posted on the respective social network and restrict access to certain information, to publish rules for using the social network, to consider requests from social network users, etc.
Roskomnadzor shall independently recognize a particular information resource as a social network and include it in the register of social networks. This shall not require any action on the part of the owner thereof.
13. Grounds for Blocking Websites
In addition to the above-mentioned cases of access restrictions to websites and services in the event of violation of the regulations by the owners of VPN and anonymization services, Organizers of Information Dissemination and personal data processors, Russian legislation also provides for other grounds for blocking websites., Below is a brief summary of these grounds.
The Information Law provides for the introduction of a unified register of domain names and Internet addresses of websites containing prohibited information. Websites are entered into this register on the basis of a court ruling prohibiting dissemination of the relevant information and, in relation to certain types of information, on the basis of a decision by a competent authority, e.g. based on the decision by the bailiff to restrict access to information that discredits the honor, dignity or business reputation of an individual or the commercial reputation of a legal entity).
Should a website be included in the register (blacklisted), the hosting provider shall notify its owner of the necessity to delete the website containing the respective information. If the website owner fails to delete it, the provider shall be obligated to block access to the website. The website owner has the right to appeal to court against the decision to have website registered.
On March 29, 2019, further amendments to the Information Law came into force setting out the procedure for restricting access to information which shows express disrespect to society, the state, the official state symbols, the Constitution of the Russian Federation or state authorities. Roskomnadzor's information blocking procedure is similar to that described above, however, this procedure may also be initiated by the RF Attorney General or his deputies.
A special procedure is also provided for the restriction of access to information disseminated in violation of copyright or related rights. In this case, Roskomnadzor shall initiate the access restriction procedure only after it has been requested by the IP right owner, on the basis of an effective court ruling (e.g. a preliminary injunction).
If the court establishes that information containing copyrights or neighboring rights, or information required to gain access to copyrights or neighboring rights via the Internet (such as torrent trackers) has been repeatedly and unlawfully published, access to the respective website will be blocked without any possibility to remove the restriction. The operators of search engines will be obligated to stop providing information about the respective domain names and websites on the Internet. Any copies of the blacklisted websites will also be blocked by Roskomnadzor on the basis of a request from IP right owners and state authorities.
14. Cooperation with Foreign Partners
Paternalism and a general orientation towards "import substitution" of amendments to Russian IT legislation in recent years increasingly make foreign companies consider cooperation with Russian partners in order to localize their respective products (services) in Russia. Such cooperation may be maintained both on a contractual basis or by establishing a joint venture company.
In recent years, civil legislation in Russia has been supplemented with numerous provisions which are already well-known to foreign investors and regulate business relations within the legal framework, e.g. corporate agreements (analogous to shareholders agreement), options, warranties and representations, indemnities, etc.
Therefore, foreign investors acting under Russian law can ensure that their interests are respected to the full extent, even in cases where they are minority stakeholders in a project, as well as withdraw from a project in accordance with the pre-agreed scenario.
15. State Support Measures of the IT Industry
There are various mechanisms of state support for IT companies, tax incentive measures being of the main interest.
Unfortunately, tax incentives do not apply to firms that distribute advertising and marketing information, search for clients and enter into transactions using IT technologies.
If a company fulfills certain conditions regarding state accreditation as a company carrying out activities in the IT sphere, receives 90% of the proceeds thereby from certain types of IT activities and has an average headcount of at least 7 employees, the following types of tax incentives can be applied:
- reduction of social insurance, pension and compulsory medical insurance rates (from the maximum total amount of 30% to 7.6%);
- reduction of the rate of corporate profit tax payable to the federal budget to 3%, and that payable to the regional budget – to 0% (the total maximum amount of the rate of this tax without applying tax incentives is 20%).
Also, there is also a number of special VAT benefits (VAT):
- the granting of exclusive rights on any grounds by a Russian company to software and databases and rights thereto included in the register of Russian software is exempted from VAT;
- VAT in respect of exported services and works, in particular with respect to software development contracts can be deducted.
If certain conditions are met, the simplified taxation system can be used by IT companies, which may facilitate tax reporting.
One of the non-tax support measures is that the government co-finances projects of Russian IT companies, which can be granted on a competitive basis. This kind of support is particularly available in the sphere of development of digital platforms and software for high-tech industrial production, as well as to leading companies developing products, services and platforms based on digital end-to-end solutions (including, in particular: big data, neurotechnologies and artificial intelligence, distributed ledger technologies, industrial internet, components for robotics and sensors, virtual and enhanced reality technologies). The conditions of participation in the competition include, inter alia, the activity and experience of the candidate company, as well as the deadlines and amount of investments required for the project implementation.
SCHNEIDER GROUP has been helping businesses to expand to new geographical markets since 2003, offering a full range of business support services: from developing strategy for successful market-entry to helping arrange or optimize accounting, reporting and financial planning processes and establishing efficient IT infrastructures.
500 top experts in 11 countries take care of all resource-consuming non-core business tasks, so our customers can focus on achieving their business goals. We offer services in Armenia, Azerbaijan, Austria, Belarus, Georgia, Germany, Kazakhstan, Kyrgyzstan, Poland, Russia and Uzbekistan, with minor regional variations. Get in touch via our contact form to request details of specific service packages available in your target country.