Part VI, section 24
A practical guide to data protection compliance when using AI
24.1
That AI can do something does not mean it should
Cost of error
high
low
AI prepares, a human decides
Financial reporting
Legal documents
Medical findings
Only a human decides
Hiring and firing
Ethical choices
Crisis situations
AI can manage alone
Transcribing recordings
Summaries
Formatting
AI writes, a human edits
Posts and mailings
Business correspondence
Brainstorming
The path from rules and logic to general intelligence
1
Classical AI
rules, logic, search
2
Machine learning
finds patterns in data
3
Neural networks
interconnected representations learned from data
4
Deep learning
multilayer neural nets for vision, speech and language
5
Generative AI
creates text, images, audio and code
6
Agentic AI
plans, uses tools and acts
7
General AI (AGI)
universal intelligence, not yet achieved
Each level builds on the previous one.
The higher the level, the more AI acts on its own.
CURRENT FRONTIER
WE ARE HERE
The same architecture as a computer, on a new basis
Six layers, each with its own compliance zone
Localisation and CBT by first recording, provider fine-tuning, from 01.03.2027 Russian data centres for sovereign models
Model and weights
Vector database
Context window
Tools
Wrapper (harness)
Agent
Orange layers handle the request, dark ones hold knowledge and the model. Build the data flow map across all six layers
Rules and court decisions of 2025-2027 that change how AI is handled
01.09.2025
Depersonalisation under the new rules
RKN Order No. 140 requirements and methods bind all operators
01.03.2026
AI block of FSTEC Order No. 117
State systems may not pass restricted-access information to the model developer
14.05.2026
Fine for invented references
Court fine of ₽50,000 for non-existent case law in an appeal, AI is no excuse
26.05.2026
A neural network as a disclosure channel
First instance weighed a secret uploaded to a neural net in a dismissal, with no separate classification
01.09.2026
Law 243-FZ took effect
AI technology support law; core requirements for large models from 01.03.2027
07.09.2026
Digital literacy concept
Staff AI training is proposed to be built into risk management
01.03.2027
Sovereign models and AI labelling
Data centres in Russia, right to label AI content, training exemption, draft of a new FSTEC AI block
01.09.2032
End of the transition period
For systems running on 01.03.2027 that process data in Russia
now
rules
courts
benchmarks
24.2
Stripping PD does not lift secrecy, and passing data to a service is disclosure
WHO IS AFFECTED
secrecy
regime
Advocates
Art. 8 of Law 63-FZ
Notaries
Art. 16 Notary Fundamentals
Insolvency administrators
Art. 20.3 of Law 127-FZ
Mediators
Art. 5 of Law 193-FZ
Auditors
Art. 9 of Law 307-FZ
Doctors
Art. 13 of Law 323-FZ
Also bank, tax and insurance secrecy and the client's own trade secret
TWO FILTERS BEFORE UPLOAD
1 PD filter
Removes names, contacts, contract numbers and other identifiers
2 Secrecy filter
Figures, metrics, deal structure and company information remain secret even without names
Passing to a service is already disclosure
The service provider is a third party, and no leak is needed for a violation
Data subject consent is no substitute for client consent
Only the client's expressed will can release the secret, and its form can be stricter
The right to use AI goes in the contract
In advance, in the client agreement. Materials still pass both filters
Ban taking information out, not the tool
THREE ZONES BY WHERE THE REQUEST RUNS
Own in-house model
Data stay inside the perimeter, the system can be tuned to tasks
External model via API
Allowed after internal regulations, a contract and a filter
Public service, personal account
No excuse, this zone is closed first
BABUSHKINSKY DISTRICT COURT OF MOSCOW
DECISION OF 26.05.2026, CASE NO. 02-1545/2026
Uploading reports to DeepSeek held to be disclosure of a trade secret
Deal and financial reports went to DeepSeek, tender documents to personal email. Dismissal held lawful; whether the data reached third parties does not matter
Evidence of the regime: list of information, signed undertaking, workplace control, investigation report
THREE MEASURES INSTEAD OF A BAN
Secrecy regime
List of information, handling rules, employee's signed undertaking
A convenient internal platform
Without it staff turn to personal accounts and workarounds
Outbound traffic control
DLP and a single gateway for calls to external models
Personal accounts for work are banned outright; permitted services are listed in an internal regulation
Whoever uses the output is responsible for its accuracy
WEST SIBERIAN COURT RULING, 14.05.2026
CASE NO. A27-7831/2025
50 000 ₽
court fine for non-existent and unrelated case law in a cassation appeal
Half the maximum and equal to the principal debt in dispute
The fine fell on the organisation, not its representative
AI preparation is no excuse; the party answers for generated text (Art. 9(2) of the Arbitration Procedure Code)
A new representative's request to ignore the citations did not prevent the fine
The appeal also had unrelated rulings. A real number on an irrelevant subject passes a formal check
THREE LINES OF DEFENCE
A contract with the provider does not shift liability, the company that used AI will be held to account
Final actions without human review are banned in procedures, scripts and instructions. Review is selective, with escalation criteria
Warning the client about AI use, consent to data transfer, liability limits
Review and client notice records: who checked, when and what was fixed
Before filing, every reference is checked on three points: the decision exists, its subject matches the argument, the quote is really in it
The more powers an agent has, the wider the company's responsibility
WHAT IS IN THE PROCESSING PERIMETER
Agent
System instruction
Attachments and links
Knowledge base fragments
Memory between sessions
Call logs
Quality telemetry
Backups
External tools
Each element holds PD with its own periods and access. Dark marks what is most often forgotten
THREE FAILURE SCENARIOS
Excessive collection
data volume exceeds the purpose
Transfer outside
information goes to a third party without a basis
Loss of data
records that should have been kept are erased
FOUR BARRIERS
Injection is a separate risk. A hidden command in a file or on a page is executed like a user's instruction
24.3
The safest scenario: do not upload PD to the service at all
IDENTIFIABILITY SCALE
Original PD
names, phones, contract numbers
Masking and pseudonyms
Names replaced, links and details remain
Depersonalisation under RKN Order No. 140
Still PD per RKN's position
Aggregates, no one singled out
Groups where no person can be singled out
WHAT TO KNOW
Since 01.09.2025 the depersonalisation requirements and methods in RKN Order No. 140 bind all operators
Depersonalisation is itself processing and needs a basis and purpose
A model can infer health or beliefs from ordinary data, and that is already a special category (Art. 10 of Law 152-FZ)
WHAT TO DO
Clean data before it leaves the company perimeter
Find out what staff really upload to AI, and in what form
Treat any sensitive information the same way, especially in foreign services
Depersonalised data are still personal. Masking does not exempt from Law 152-FZ
Classification depends on what the provider does with your data
What does the provider do with the data received?
Only carries out your request
Processing instruction
A contract with a list of actions, purposes, confidentiality and protection requirements. You answer to the subject
Learns from them or uses them for its own purposes
Independent operator
Needs its own transfer basis, usually consent. Default fine-tuning breaks the instruction structure
FOUR HIDDEN CHANNELS
Fine-tuning
On by default, cannot be switched off on some plans
Rating button
Sends data back to the provider even with training switched off
Chat licence
Requests and files often go under an irrevocable licence
Export control
Account blocked together with materials, keep copies outside the service
Data came from a counterparty? First check in its contract whether sub-processors are allowed. And a corporate subscription is itself a transfer of employee PD
Where first saving data breaches the localisation requirement
A hidden foreign model
A foreign model may run inside a Russian product unnoticed by the user - a domestic label does not guarantee the data stay in Russia.
First saving abroad
Meeting transcription or a chatbot on a foreign platform: the first recording happens on servers abroad, and the localisation requirement is not met.
First in Russia, then abroad
Sovereign model from 01.03.2027
When PD are first recorded in a database in Russia and only then sent to a foreign recipient under the CBT rules, localisation is met.
Answers and storage in a Russian entity's data centre. The owner does not matter for localisation, but does for Law 243-FZ
LOCALISATION FINES
₽6m
maximum for a first violation
₽18m
maximum for a repeat violation
Review the data routes in the product with an eye to how staff really use it.
Art. 13.11(8), (9) of the CAO, entities
Using foreign AI is a cross-border data transfer
Steps before the transfer starts
COUNTRY LIST: RKN ORDER NO. 128, NO. 253 FROM 30.10.2026
Listed country
Transfer is possible right after notification
Country not on the list
Transfer starts after 10 working days, and RKN keeps the right to ban it.
USA - COMPLICATED PROCEDURE
The law regulates large foundation models and does not cancel the PD regime
IS THE MODEL COVERED BY THE LAW
basis for other software
LFM
All three signs together make a large foundation model (LFM). Scoring, antifraud and computer vision follow the general rules of Law 152-FZ
From 01.03.2027
Russian entities' data centres
Sovereign and national models prepare answers and store data in Russia. This is not the same as localisation
Mandatory cases
The Government may set where only such models are allowed, in finance in agreement with the Bank of Russia
Training exemption
Settles the copyright question, but not PD. Information about people needs its own basis
Transition until 01.09.2032
For systems running on 01.03.2027, if data are processed and stored in Russia
To do now: list the models and their status, record the launch date and place of processing, provide for model replacement in the provider contract
24.4
Each step leaves a document, or the process cannot be proved
document
at every step
1
Owner
Every AI service has a responsible person
Scenario, model, provider, data, tools, level of autonomy
What may be uploaded and done, where a human is required
Launch, extra measures, scenario restriction or refusal
No service is released without passed checks
Changing the model, provider, instruction or knowledge base restarts assessment
Quality metrics, complaints, errors and corrective measures
See Art. 18.1 of Law 152-FZ and GOST R ISO/IEC 42001-2024 on AI management systems
One page to decide before launch whether AI can be trusted with personal data
16 ITEMS IN FOUR BLOCKS
I
Purposes and bases
Why AI is needed, what data enters it and on what basis
II
AI provider
Who sees data, stores it and learns from it
III
Storage and transfer abroad
Where data are kept and whether other countries can access them
IV
Protection and control
AI access, retention, decisions about people, tests
RESULT ON MANDATORY ITEMS
Yes
launch allowed
Partly
limited launch
No
launch stopped
OPEN THE CHECKLIST
Current version to download and fill in
24.5
Signs of a separate purpose, the compatibility dispute and narrow bases under Art. 6(1) of Law 152-FZ
Signs of a separate purpose, expert approach
No purpose arises
training within the same process and purpose, like payment antifraud. Compatibility with the collection purpose is disputed if the model stays in the service
Documents: state the training purpose separately in the policy, notification, basis and harm assessment; "technology development" wording is not specific enough
Three data branches, labelling, collection from open sources and release of an open-weights model
1
Branch A. Depersonalise
with re-identification testing; RKN orally treats the result as PD (28.01.2022, 27.08.2025, 14.08.2026)
2
Branch B. Find a basis
on the original data: research, legitimate interest or contract
3
Branch C. Collect anew
for a declared training purpose, with its own sample retention period
Experiment: in experimental regimes under Laws 123-FZ and 258-FZ the depersonalisation rules of RKN Order No. 140 do not apply, and Art. 6(1)(9.1) is open only to participants within the programme
Credit, insurance, HR and antifraud scoring: bases for features, Art. 16 of Law 152-FZ and the practice gap
Open platform
features from social networks and ads need their own basis and a line in the notification (A40-5250/2017, rulings of 2017-2018). What is published by law falls under Art. 6(1)(11), the fork is disputed
Practice gap
credit history disputes concern removing a delinquency record (33-44119/2021, 88-8554/2022) and consent to a report (A56-47954/2021), while courts do not ask about a purely automated decision
Proxy features, historical samples and a six-step check before launch and at every retraining
No dedicated offence
The risk comes via adjacent routes
general ban on discrimination (Labour Code Arts. 3, 64), on discriminatory vacancies, Consumer Protection Law Art. 16, Constitution Art. 19. Their sufficiency is disputed
How bias works, expert approach
a postcode stands in for ethnicity, and occupation and type of education stand in for sex
the sample repeats past decisions, and the model underrates small groups
Recommended check before launch and at retraining
protected characteristics are excluded from the model
whether the feature can be rebuilt from other attributes
skewed composition and low representation of groups
shares of positive and negative outcomes
an inference about health or beliefs needs a basis
date, scope and results as evidence
Benchmark: the AI Development Strategy (Decree No. 490 of 10.10.2019) names PD protection in model training among the challenges; it creates no duties but is a benchmark of good faith
Substantive involvement, why control degenerates and the operator's duties under Art. 16(3) and (4) of Law 152-FZ
Signs of involvement, expert approach
Why the loop degenerates
per the expert approach, trust in the system, lack of time to check and loss of skill get in the way. Sampling, four eyes and escalation help
Explain the procedure, Art. 16(3)
the decision procedure and possible legal consequences without disclosing the algorithm; data categories and sources on the expert reading, the depth is disputed
Practice: Art. 16 has almost no case law of its own: in 33-7486/2015 the Orenburg Regional Court checked only a signature under general terms. Decision mechanics surface in supervisory checks and related disputes
Depersonalisation does not lift restrictions: masked data remain personal and follow the rules of Law 152-FZ.
Professional and trade secrets need a second filter: stripping PD does not lift the secrecy regime.
The user, not the provider, is held to account for AI output, so final steps without human review are banned.
A foreign service raises localisation and CBT issues; Law 243-FZ joins from 01.03.2027. Prepare protection in advance.
t.me/prv_adv
