The Effects of the General Data Protection Regulation in the EU for Russian Firms

The research examines the impact of general data protection regulation (GDPR) on Russian companies. This regulation was adopted in Europe in order to secure the personal data of the European residents. However, it had externalities for other countries due to its exterritorial appliance. The effects could also be applicable to Russian firms and firms may decide how to treat this regulation: to ignore it, adopt it or eave the European market. The consequences of the GDPR are examined from two perspectives – market reaction and real effects to firm performance. To capture market reaction the event study methodology was used. The abnormal returns for the companies exposed to Europe were compared to the MICEX Indices. Almost no significant effects are observed both for the announcement and for the adoption. To analyze the effects on performance indicators we applied difference-in-differences methodology. Comparing EU-exposed companies with those not affected, it was found that firms tend to adjust their expenses structure. Particularly, they reallocate money from direct investment for business development into costs for GDPR compliance.