Maria Padavan, CEO. Version of 2 November 2026. This is the line Emaylio uses to let a campaign start or to stop it. It is not a lawyer’s opinion, and it is not a way to rename advertising as an introduction.
Two laws, two territories
The Russian personal-data law applies in Russia. It covers an operator in the Russian Federation and processing aimed at people who are in Russia. The GDPR is the regulation of the European Union and the EEA. It can also apply to a company outside Europe when that company offers goods or services to people in the Union or monitors their behaviour there.
One file therefore often sits in both regimes. Russian employee addresses are read under the personal-data law and under Mail.ru and Yandex rules. Addresses of people in the EU are also read under the GDPR and under that country’s rules on electronic messages. Emaylio does not pick “the softer law” for the client. If a campaign touches both territories, both answers have to exist.
What counts as personal data
In both regimes, personal data is information that can single a person out. A name together with a work email meets that test. A mailbox that looks corporate does not take the person out of the law. A role such as info@ or sales@ is set aside on a cold wave for a different reason: it is not a conversation with a specific person, and mailbox providers treat it poorly.
An IP address, a cookie id and a visit record can also be personal data when they can identify a visitor. For the website that is described in the privacy policy. For a campaign the row matters more: who is being written to, and where the row came from.
The ground without which a wave does not start
Article 6 of the Russian law lists grounds. It does not leave the operator a free-floating “legitimate interest” for any cold contact. In practice we ask the client to name a ground we can understand: the person left the address and consent, there is a contract, or another ground their lawyer can show. “We found it on a website” is not a ground for us.
The GDPR is wider. Article 6 includes consent, contract, legal duty, vital interests, a public task and legitimate interests. Legitimate interest does not run by itself. It has to be balanced: the person should reasonably expect the message, and their rights must not be overridden. For direct marketing the person has a separate right to object, and processing for that purpose then stops.
On top of the GDPR, EU countries usually have a rule on electronic advertising. A sales email to a private person more often needs prior consent. The exception for existing customers is narrow and depends on the country. An address from a business card or a team page is not, for us, permission to send a commercial email into Europe.
The personal-data law does not replace the advertising law
Even with a ground to process the address, one commercial text for a whole list in Russia is advertising to us. Advertising under the advertising law needs consent. A discount, a price and a call to buy, in one paragraph for the whole file, is advertising rather than a business note. If that consent is missing, the campaign does not start. The boundary is in the note on identical text.
The GDPR by itself also does not authorise a mass sales email. It answers whether the data may be processed. Whether a marketing message may be sent to that mailbox is a question for the recipient’s country. Mixing the two questions is a common brief.
Rights that cannot wait overnight
In both regimes a person can ask what data is held, correct it, withdraw consent and demand that the mailing stop. The GDPR adds portability in some cases, restriction of processing, and a complaint to the supervisory authority of the country. In Russia the complaint goes to Roskomnadzor or to a court.
For a mailbox the rule is plain. An unsubscribe and any reply stop the series the same day, not “in a night script”. At volumes Gmail treats as bulk, one-click unsubscribe is required. Our working guide for Yandex is about ten minutes, and it is still checked against the current help page. The threshold calculator is in list hygiene.
Retention
Both regimes forbid keeping data “just in case”. The period follows the purpose. A message from the site lasts while that conversation lasts, inside the period in the policy. A campaign file, once stopped, does not remain the working list for the next wave. Contract and accounting periods, where they exist, are longer and come from their own statutes, not from the convenience of a sales team.
Sending data abroad
Before a cross-border transfer, the Russian law requires an assessment of whether the foreign state protects the person’s rights, and a notice to Roskomnadzor where notice is mandatory. GDPR Chapter V allows a transfer under an adequacy decision, standard contractual clauses or another lawful tool. A foreign platform cabinet that received names and emails can already be such a transfer, even if the message itself leaves a Russian SMTP.
That is why a green warmup score in a western cabinet is not copied onto Mail.ru and Yandex, and is not treated as an answer to the transfer question. The split of roles is in platform or SMTP.
What Emaylio checks before the button
- Where the rows came from: a CRM, requests, a data-supply contract. A bought file, or one scraped from other sites, is not uploaded.
- Whether the client can name a ground under the Russian law, and for EU addresses a GDPR ground plus the country’s rule on marketing email.
- Whether one commercial text would go to the whole file without advertising consent.
- Whether an unsubscribe, a stop list and a stop on any reply are in place.
- A separate outreach domain, with SPF, DKIM and DMARC. The company’s everyday mailbox stays out of the wave.
A technical check of an address does not create a ground. Validation answers whether the mailbox exists. The law answers whether this person may be written to.
What this piece does not do
It does not draft a sentence that will “pass” both laws without the client’s lawyer. It does not allow a bought list because the seller promises “GDPR-clean contacts only”. It does not replace a Roskomnadzor notice, and it does not replace a legitimate-interest assessment if a client truly relies on that ground in the EU. A specific campaign stays with the client’s lawyer. We stop the launch when the questions above have no answer.