Russian Ministry of Transport Unveils Draft Rules for Centralized Passenger Data with Unique Per-Trip IDs

The Russian Ministry of Transport has published a draft regulation expanding centralized databases of passenger and crew personal data. Each traveler and crew member will receive a unique identifier generated separately for every flight or trip that cannot be reused or reassigned. The rules add new mandatory data points including cancellations of boarding, online check-ins, and changes to group tickets. Data must be transmitted within 15 minutes for air and rail tickets and 30 minutes for other modes, with crew details submitted at least 24 hours before departure. Retention remains fixed at seven years. The order, if adopted, will replace the 2024 rules and is open for public comment until 29 August with an intended effective date of 1 March 2027.

AntiMalwareTranslated from Russian

Read at source

The Russian Ministry of Transport has released a draft order introducing updated procedures for maintaining centralized databases of personal data belonging to passengers and crew members across all transport modes.

Under the proposed rules, a unique identifier will be generated for every passenger and crew member on each specific trip. This code cannot be reassigned to another individual or reused on a subsequent journey and will accompany all recorded operations involving the ticket and the carriage itself.

The draft significantly broadens the list of operations that must be logged. In addition to existing requirements, authorities will now receive data on boarding cancellations, online check-in events, additions of passengers to group tickets, and removals from such tickets.

The regulation also mandates the inclusion of schedule information for both regular and charter services. This covers planned and actual flight or trip details, cancellations, and any schedule changes.

Personal data retention periods stay unchanged at seven years. Transmission deadlines remain the same: information about ticket purchases for air or rail travel must reach the system within 15 minutes, while data for road, sea, or river transport must arrive within 30 minutes. Crew data must be submitted no later than 24 hours before departure.

The draft includes detailed tables specifying the composition of data fields for each transport type and classifies operations as mandatory, conditionally mandatory, or exempt from transmission. If approved, the new order will supersede the current 2024 rules. Public discussion of the document continues until 29 August.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Policy & Regulation

Russian Minister Proposes Blocking All SIM Cards Linked to Fraudsters Banned in MAX Messenger
Russia Ready to Disclose Source Code of Social Networks, Messengers and AI Models
Russia Mulls Mandatory Two-Week IMEI Registration for Foreign Smartphones via Gosuslugi