Personal Data, 152-FZ, and Anonymization: New Challenges for Businesses
In the contemporary digital landscape, personal data serves as both a vital fuel for the digital economy and a significant source of legal and reputational risks for companies. This situation is exacerbated by two critical factors emerging in 2025–2026: an unprecedented tightening of penalties for data breaches under Federal Law No. 420-FZ, and the widespread use of large language models (LLMs) by employees, into which they often copy real client data. These practices create new compliance challenges under Federal Law No. 152-FZ “On Personal Data.”
For Chief Information Officers (CIOs), Chief Information Security Officers (CISOs), legal professionals, and anyone responsible for data processing within an organization, it is crucial to grasp the fundamental principles: what the law defines as personal data, the specific requirements of 152-FZ, and why data anonymization has evolved from a theoretical option into a practical protective tool.
Risks of LLM Use and 152-FZ Violations
Practical examples illustrate how easily employees can inadvertently breach regulations. HR specialists, aiming to streamline their work, might upload complete candidate resumes, including sensitive details like passport information, addresses, and national insurance numbers, into chatbots such as ChatGPT. While this may seem like a routine, time-saving operation for the employee, for the company, it constitutes an unauthorized transfer of personal data to a third party, whose servers may be located outside of Russia, without proper grounds or notifications. Such actions formally represent multiple violations of 152-FZ.
Developers of solutions, such as proxies designed to mask personal data before submission to LLMs, observe that many companies are only beginning to comprehend the scale of the problem and establish a conceptual framework. It is essential not only to understand what the law considers personal data but also to discern when anonymization genuinely removes obligations versus when it merely creates an illusion of protection.
- Definition of Personal Data: Information relating directly or indirectly to an identified or identifiable natural person.
- 152-FZ Requirements: Obtaining consent, data protection, database localization, notification of transfer.
- Anonymization: A process that makes it impossible to determine the identity of a data subject without additional information.
While the article rightly highlights the growing risks with LLMs and 152-FZ, the reliance on anonymization as a practical protective tool seems overly optimistic. Achieving true, irreversible anonymization, especially with complex datasets, is incredibly difficult and often not as robust as implied. There’s a significant risk of re-identification, even with supposedly anonymized data, which could lead to a false sense of security and even greater compliance issues down the line. The costs and technical expertise required for effective anonymization shouldn’t be underestimated either.