Russia mandates three-year data retention for Apple and Microsoft
Russia has included Apple and Microsoft in a government register that mandates digital communication providers to retain user communication records for three years and disclose them to Russian security agencies upon request. The move escalates regulatory pressure on global tech companies operating in the country, with non-compliance risking financial penalties or service bans.
Editor, Lazyfounder
TABLE OF CONTENTS
What the new requirements entail
Russia’s communications regulator, Roskomnadzor, added Apple and Microsoft to its official register of digital communication providers on October 2, 2026. The inclusion requires both companies to retain user communication records—including messages, call data, and other exchanges—for up to three years. The data must be stored within Russia and made available to Russian security agencies upon request.
The register already includes other tech companies such as Google (alongside Google Meet), WhatsApp, Telegram, Snapchat, Cloudflare, and Blizzard Entertainment. Google was added in January 2026, signaling a broadening of the Kremlin’s oversight over digital platforms.
Risks for non-compliance
Companies that fail to comply with the data retention requirements face financial penalties or, in cases of persistent violations, a complete ban on their services in Russia. The regulations apply to both Russian and foreign providers, though enforcement has primarily targeted international companies in recent years.
The Kremlin has already restricted access to services like WhatsApp, Telegram, Signal, and Apple’s FaceTime, citing national security concerns. These restrictions followed broader measures introduced after Russia’s 2022 invasion of Ukraine, which included suspending Apple Pay and limiting App Store transactions for Russian users.
Apple’s broader regulatory challenges in Russia
Apple has faced mounting regulatory scrutiny in Russia beyond data retention requirements. In August 2026, Russia’s antitrust regulator initiated proceedings against the company for refusing to preinstall the government-backed MAX messaging service and RuStore, Russia’s state-approved app marketplace, on its devices.
Earlier in 2026, Russian authorities demanded explanations after Apple removed applications developed by VK, a state-controlled technology company, from its App Store. The company also withdrew banking apps tied to Russian financial institutions under international sanctions, further straining its relationship with regulators.
Payment restrictions introduced in April 2026 prevented Russian customers from purchasing new App Store content or renewing subscriptions unless their Apple Accounts held sufficient pre-existing funds. These measures followed Apple’s suspension of product sales and exports in Russia in 2022.
Unanswered questions on compliance
Neither Apple nor Microsoft has publicly addressed how they plan to comply with the new data retention requirements. The companies have not disclosed whether their inclusion in the register will impact existing services or commercial operations in Russia.
Industry observers note that compliance may require significant operational changes, including localized data storage infrastructure and potential adjustments to encryption practices to accommodate government access requests.
What this means
Lazyfounder analysis — our interpretation, not reported fact.
For global tech companies, Russia’s latest regulatory move underscores the growing tension between local compliance and global standards around user privacy and data security. Apple and Microsoft, like their peers, must now navigate a landscape where adherence to local laws may conflict with international expectations—or risk losing access to a market that, despite geopolitical tensions, remains commercially significant.
The developments also signal a broader trend of governments asserting greater control over digital infrastructure, often under the guise of national security. For startups and operators, this serves as a reminder that market entry strategies must account for long-term regulatory risks, particularly in regions where legal frameworks evolve rapidly to favor state oversight. The lack of public response from Apple and Microsoft suggests a cautious approach, but their eventual decisions could set precedents for how multinational tech firms balance compliance with reputational and operational risks.
Related on Lazyfounder
Sources
- TechRadar · 2026-11-04
Russia demands Apple hand over user phone and message records to its security agencies when requested
This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.
About the author
Editor, Lazyfounder
Tarun Mottlia edits LazyFounders, covering Indian startups, funding rounds, AI and product launches. Every story on the site is AI-assisted and checked against its cited sources before publication.
More stories by Tarun MottliaGet the LazyFounder Brief
Startup, funding and AI news in a five-minute read. Join the early-access list.
