Russia is an interesting case, though.
They are bound by the European Convention on Human Rights (although enforcement is... let's say tricky), and they are also signatories to Convention 108 (the Council of Europe "Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data") and they have signed (but not ratified) the protocol to update the convention (223, combined known as Convention 108+).
This - in theory - puts them at an advantage over countries like the US which lack any real privacy legislation.
However 1) Theory and practice aren't the same; and 2) I think it would be an impossibly hard sell for the Commission to issue an adequacy decision for Russia purely for political reasons, let alone practical ones.
https://ec.europa.eu/info/law/law-topic/data-protection/inte...
So Russia/China are already in the "further safeguards needed" camp, along with... almost all of the world?
I studied a bit of EU law in law school, but haven't kept up as much as I should. This is a helpful start to dig back in, thanks!