# Standards and Regulatory References

## Russia
- **Federal Law No. 152-FZ** on Personal Data (27 July 2006, as amended)
- **Federal Law No. 242-FZ** (21 July 2014) amending 152-FZ to require localization
- **Roskomnadzor Order No. 274** listing countries providing adequate protection
- **2023 Amendments**: Increased fines for localization violations to RUB 18 million for repeated offences

## China
- **Personal Information Protection Law (PIPL)** (effective 1 November 2021), particularly Art. 38-43 (cross-border transfer) and Art. 40 (CIIO/volume threshold localization)
- **CAC Measures on Security Assessment of Outbound Data Transfers** (effective 1 September 2022)
- **CAC Standard Contract Measures for Outbound Personal Information Transfers** (effective 1 June 2023)
- **Data Security Law (DSL)** (effective 1 September 2021), Art. 31 (CIIO important data localization)
- **Cybersecurity Law (CSL)** (effective 1 June 2017), Art. 37 (CIIO data localization)
- **GB/T 35273-2020** Information Security Technology — Personal Information Security Specification

## India
- **Digital Personal Data Protection Act 2023** (DPDP Act), Section 16 (cross-border transfer restrictions)
- **RBI Circular DPSS.CO.OD.No.2785** (April 2018) on storage of payment system data in India
- **SEBI Circular SEBI/HO/MRD/DOP1/CIR/P/2019/15** on data localization for stock exchanges and depositories

## Turkey
- **Law No. 6698 on the Protection of Personal Data (KVKK)**, Art. 9 (cross-border transfer)
- **KVKK Board Decision 2019/78** on adequate countries
- **KVKK Regulation on Data Transfer Abroad (2024 amendment)**

## Vietnam
- **Decree 13/2023/ND-CP** on Personal Data Protection (effective 1 July 2023)
- **Cybersecurity Law 2018**, Art. 26(3) (localization for certain data)
- **Decree 53/2022/ND-CP** detailing the Cybersecurity Law

## Indonesia
- **Government Regulation No. 71/2019** (GR 71) on electronic system and transaction operation
- **Personal Data Protection Law (UU PDP)** (effective 17 October 2024)
- **Minister of Communication Regulation No. 20/2016** on data protection in electronic systems

## ISO/IEC Standards
- **ISO/IEC 27001:2022**: Provides the security framework for localized data storage implementations
- **ISO/IEC 27018:2019**: Cloud PII protection applicable to localized cloud deployments
- **ISO/IEC 27701:2019**: Privacy information management supporting localization documentation