For Windows users and IT administrators, Microsoft’s inclusion makes this more than an Apple privacy story. The critical questions are which services Russia considers covered, what information it expects providers to retain, and how the companies will respond. The published entries do not settle those questions.
Three years of records does not mean three years of messages
The most important distinction is between communication-activity records and communication content.
Article 10.1 of Russia’s Information Law, reproduced by the legal database ConsultantPlus, establishes two retention categories, both requiring storage within Russia:
| Data category | Statutory retention requirement |
|---|---|
| Information about users and the receipt, transmission, delivery or processing of their electronic communications | Three years after the relevant activity ends |
| The communications themselves, including text, voice, images, sound and video | Up to six months, with detailed procedures, periods and volumes set by the government |
The law therefore does not prescribe three years of retention for every message or recording. That distinction matters when assessing the scale and nature of the requirement.
Article 10.1 also requires covered providers to supply retained information to authorized bodies conducting operational-search activities or protecting national security, in circumstances established by federal law. A separate provision requires information necessary to decode messages when a provider uses, or offers users, additional encoding. These are legal obligations—not proof of disclosure, possession of particular encryption keys, or a demonstrated ability to decrypt every service.
Which Apple and Microsoft services are covered?
That remains unresolved. Vedomosti reports Microsoft’s registration number as 593-РР and Apple’s as 594-РР. Their entries identify corporate websites rather than a service-by-service list. The publication also says it was unclear whether the companies registered voluntarily or were added by the regulator.
Kommersant’s reporting identifies Apple’s iMessage and cloud functions, and Microsoft’s enterprise communications, email, storage and IT infrastructure, as potential areas of relevance. Those are possibilities raised in the coverage, not an official determination that every named product falls under the designation.
Consequently, the listing should not be presented as confirmation that all Microsoft 365 correspondence—or information on every Windows PC—is now available to Russian agencies. The evidence establishes a regulatory classification, not a documented technical change across Microsoft’s product portfolio.
Fines and restrictions are risks, not automatic outcomes
Noncompliance can expose providers to fines and service restrictions. However, EvApps director Alfred Stolyarov told Kommersant that blocking does not follow automatically from registration; it can follow further demands and disputes with authorities. He also emphasized that registration alone establishes neither disclosure nor noncompliance.
Vedomosti reported that access to the corporate websites named in the entries was not restricted at the time of its October 28 coverage. Separately, 9to5Mac reported that day that neither Apple nor Microsoft had publicly explained its response or indicated whether it intended to comply. That is a dated reporting position, not confirmation of either company’s subsequent conduct.
The practical takeaway for IT teams
Kommersant’s coverage highlights business continuity as a potential concern if restrictions eventually affect cloud email, files or workplace communications. For organizations with Russian operations or users, that makes the designation a reason to review dependencies—not to assume a confirmed breach or an immediate shutdown.
As a planning response, administrators should ask:
- Which business workflows depend on Apple or Microsoft communications services in Russia?
- What written clarification can providers offer about affected services and data handling?
- What approved contingency arrangements would keep essential communications functioning if access changes?
These are precautionary planning questions, not newly established customer obligations.
The bottom line is narrower than the most alarming headlines, but still significant: Russia is asserting retention and disclosure requirements over Apple and Microsoft through its existing regulatory framework. The listing is documented; the precise product scope and actual company compliance are not established by it. Keeping those facts separate is essential to understanding the privacy and enterprise IT implications.