Legal Specifics of Corporate Implementation of IoT Systems in the Republic of Tatarstan

Kyrill R. Kirushin; Danil I. Safin

doi:10.17323/2713-2749.2026.1.121.140

Kyrill R. Kirushin Naberezhnye Chelny State Pedagogical University https://orcid.org/0000-0002-8958-3673
Danil I. Safin Naberezhnye Chelny State Pedagogical University https://orcid.org/0000-0002-2375-5225

DOI: https://doi.org/10.17323/2713-2749.2026.1.121.140

Keywords: Internet of Things, personal data, Tatarstan, regional legislation, IoT systems, smart devices, data protection, administrative liability

Abstract

Implementing technologies of Internet of Things (IoT) across core economic sectors of Russia’s regions, including industry, utilities, logistics and health, entails considerable legal challenges for the security of data to be processed. The article provides a comprehensive analysis of the legal specifics of corporate implementation of IoT systems in Tatarstan as one of the leaders of digital transformation in Russia. The research was undertaken to identify legal problems arising from processing smart device data and make evidence-based proposals to improve regional regulatory and enforcement mechanisms. Methodologically, the study relies on analysis of federal and regional statutory regulation for protection of information and personal data, consolidation and systematization of regional legal practice in 2020–2024 as well as empirical research of corporate bylaws including model data processing consents and legal awareness for workers. It was found that digitization of economic sectors in Tatarstan leaves out major legal gaps including uncertain legal regime applicable to IoT-generated data, lack of provisions regulating such data flows, and fragmented technical protection standards. The authors propose a number of measures including a risk-differentiated IoT data regulation framework based on contextual anonymization, as well as model data processing requirements to be introduced to the regional law. A special focus is made on providing justification for the model for differentiation of administrative liability for offences in the area under study. The study’s practical value lies in shaping legal mechanisms to minimize legal risks for operators and to balance technological development with protection of data subjects’ rights. The solutions proposed may be applicable both in Tatarstan and any other constituent territory faced with similar legal issues in the context of digital transformation of the economy.

Author Biographies

Kyrill R. Kirushin, Naberezhnye Chelny State Pedagogical University

Candidate of Sciences (Law), Senior Lecturer, Naberezhnye Chelny State Pedagogical University, 28 Nizametdinov Str., Republic of Tatarstan 423806, Russia, k.kirushin@mail.ru

Danil I. Safin, Naberezhnye Chelny State Pedagogical University

Assistant, Naberezhnye Chelny State Pedagogical University, 28 Nizametdinov Str., Republic of Tatarstan 423806, Russia, danil-safin-2018@mail.ru

References

Abramova A.G. (2024) New technologies and their importance for personal data protection (Internet of Things, Artificial Intelligence). Vestnik Rossiysko-Armyanskogo (Slavyanskogo) universiteta: gumanitarnye i obshchestvennye nauki=Bulletin of the Russian-Armenian Slavic University, no. 2, pp. 44–52 (in Russ.)

Davymoka S.V. (2025) The rights and legitimate interests of the personal data operator. Sovremenniy ucheniy=Contemporary Researcher, no. 7, pp. 446–450 (in Russ.)

Drilenko D.V., Fedyaev S.M. (2025) Legal regulation of context-dependent IoT sensors and machine vision technologies: conflict of Federal Law No. 152-FZ and Federal Law No. 572-FZ in biometric data processing (regulatory analysis and empirical study of judicial practice in 2018–2025). Nauchnye trudy Kubanskogo gosudarstvennogo tekhnologicheskogo universiteta=Proceedings of the Kuban State Technological University, no. 5, pp. 123–139 (in Russ.) DOI: https://doi.org/10.26297/2312-9409.2025.5.8

Kovalenko K.E., Kovalenko N.E. (2020) Correlation of federal and regional legislation in the field of personal data protection. Evolutsiya rossiyskogo prava. Papers of proceedings of international conference of young scientists and students. Yekaterinburg: Ural State Law University Press, pp. 127–128 (in Russ.)

Kovalev S.D. (2024) Overview of recent changes in the Federal Law “On Personal Data”. Agrarnoe i zemelnoe pravo=Agrarian and Family Law, no. 12, pp. 272–274 (in Russ.)

Kuchkovskaya N.V. (2023) Evolution of IoT law. Voprosy rossiyskogo i mezhdunarodnogo prava=Issues of the Russian and International Law, vol. 13, no. 4, pp. 350–356 (in Russ.)

Linkov V.V., Semenov E.Yu. (2020) Legal issues of personal data protection in integrating the Internet of Things into everyday life. Zakon i pravo=Law and Legislation, no.10, pp. 193–195 (in Russ.)

Lyutsko V.V., Sveredyuk M.G., Stupak V.S. (2021) The patient’s withdrawal of personal data processing consent from a health institution: legitimacy & possible regulation. Sovremennye problemy zdravookhraneniya i meditsinskoy statistiki, =Contemporary Issues of Healthcare and Medical Statistics, no. 4, pp. 502–514 (in Russ.)

Melnikov P.A. (2018) Analyzing Russia’s regulatory framework for personal data protection. Innovative potential of youth: social, environmental and economic sustainability. Proceedings of the international youth research conference. Yekaterinburg: Ural Federal University Press, pp. 179–183 (in Russ.)

Miller I.P. Legal aspects of using personal data when using electronic services. Urban Environment Safety. Proceedings of international conference. Omsk: Omsk State Technical University Press, pp. 385–389 (in Russ.)

Polegenko A.M. (2018) Peculiarities of information protection in the Internet of Things. International Journal of Open Information Technologies, vol. 6, no. 10, pp. 41–45.

Veprev S.B., Nesterovich S.A. (2021) Measures for improving the security of personal data in the Internet. Information Security: yesterday, today, tomorrow. Collection of articles based on proceedings of international scholar and practical conference. Moscow: Russian State Humanitarian University Press, pp. 153–158 (in Russ.)

Zabaikin Yu.V., Lunkin D.A. (2023) Internet of Things: legal aspects of use. Voprosy rossiyskogo i mezhdunarodnogo prava=Issues of Russian and International Law, vol. 13, no. 4-1, pp. 329–335 (in Russ.)

Zhirnova N.A., Kovaleva N.N. (2024) Personal data confidentiality problems in artificial intelligence systems. Zhurnal rossiyskogo prava=Journal of Russian Law, vol. 28, no. 7, pp. 109–121 (in Russ.) DOI: https://doi.org/10.61205/S160565900027561-1

Zinovieva E.A. (2022) Exercising individual rights and freedoms in the context of digitalization. Problemy ekonomiki i yuridicheskoy praktiki=Issues of Economics and Legal Practice, vol. 18, no. 4, pp. 94–99 (in Russ.)