Inserting Contracts into ChatGPT Risks Major Fines Under Russia's 152-FZ Personal Data Law
A Russian operator registered in the Roskomnadzor personal data registry (number 24-26-055344) has published a detailed breakdown of risks that arise when contracts are pasted into foreign AI chatbots. The author notes that ordinary supply or transportation agreements routinely contain ФИО of signatories, passport data of individual entrepreneurs, INN numbers, phone numbers and emails of managers and drivers.
These elements remain personal data even when the information is already published in the Unified State Register of Legal Entities. Russian regulator practice holds that public availability does not convert the data into “publicly accessible” for the purposes of the law.
Updated administrative fines after 420-FZ
From 30 May 2025 the following penalties under Article 13.11 of the Code of Administrative Offenses apply to legal entities:
- Part 1 – processing without legal basis or for incompatible purposes: 150–300 thousand rubles
- Part 1.1 – repeated violation: 300–500 thousand rubles
- Part 10 – failure to notify Roskomnadzor of processing: 100–300 thousand rubles
- Part 8 – storage of Russian citizens’ data outside Russia: 1–6 million rubles
Individual entrepreneurs are treated as legal entities for most of these provisions. Million-ruble “leak” fines under parts 12–18 do not apply to a single contract or even several dozen contracts per month.
Cross-border transfer obligations
Any transmission of personal data to an entity located in another country constitutes a cross-border transfer under Article 12 of 152-FZ. Providing access to ChatGPT, Claude, Gemini or DeepSeek is sufficient; no physical file transfer is required. Since 1 March 2023 a separate notification must be filed with Roskomnadzor before such transfers begin. For the United States and the European Union a ten-working-day waiting period applies, during which the regulator may prohibit or restrict the transfer.
In addition, Russian law requires a data-processing agreement with any third party that receives personal data. Standard user agreements of OpenAI, Anthropic or Google do not satisfy this requirement.
Court practice and real incidents
No administrative cases specifically concerning AI chatbots have yet reached public court records. However, on 27 July 2026 the Babushkinsky District Court in Moscow upheld the dismissal of a sales director who uploaded transaction reports and financial data to DeepSeek, ruling that the action amounted to disclosure of trade secrets.
Earlier incidents at Samsung in 2023 demonstrated that source code, meeting transcripts and test sequences were uploaded to ChatGPT within weeks of internal approval, prompting the company to ban external AI tools on corporate devices. A U.S. federal court order in the New York Times v. OpenAI litigation temporarily required preservation of all ChatGPT logs, including deleted conversations, for five months in 2025.
Related articles
Roskomnadzor Deploys 2.27 Billion Ruble AI Traffic Filter: Known Facts and Expert Speculations
Russian regulator Roskomnadzor has integrated a machine learning-based traffic filtering system into the automated security infrastructure of the Russian internet segment. The system, valued at 2.27 billion rubles, operates on domestic models within the agency's own infrastructure and connects to TSPU equipment that performs DPI-based filtering. Publications including Forbes, Meduza, 3DNews and SecurityLab base their reporting on the 2026 digital transformation passport, which also allocates additional billions for TSPU upgrades and hardware. Experts suggest the model analyzes packet sizes, session durations, traffic ratios and server characteristics rather than relying solely on known signatures, though no official performance metrics have been released. The exact role of the model—real-time analysis versus signature generation—remains unconfirmed, as does its impact on VPN protocols and potential for false positives affecting corporate and cloud traffic.
MinTsifry Proposes Requiring Telecom Operators to Install SORM Equipment Before Obtaining Licenses
The Russian Ministry of Digital Development plans to introduce legislation obligating telecom operators to deploy SORM surveillance systems prior to receiving operating licenses. Under the proposed rules, companies will only be permitted to begin serving subscribers after the equipment has been installed and handed over to law enforcement agencies. Non-compliance could result in license revocation through an extrajudicial administrative process. Current regulations allow operators to obtain licenses with a network diagram that merely indicates planned or existing SORM components. The change aims to close loopholes exploited by unscrupulous providers that repeatedly register new legal entities to operate without surveillance capabilities. Industry experts note that the minimum cost of a basic SORM complex starts at 5 million rubles, which could disproportionately affect smaller local providers without a transition period or scaled requirements.
GOST R 57580 Compliance: Defining Assessment Scope to Verify Real Protection in Financial Organizations
Financial institutions often maintain extensive documentation on information security yet still fail GOST R 57580 assessments due to mismatches between documented processes and actual infrastructure. The standards GOST R 57580.1-2017 and GOST R 57580.2-2018 set distinct requirements for protection levels and evaluation methodology. Correct application begins with identifying the organization's regulatory category under Bank of Russia rules such as Regulation 851-P for credit institutions or Regulation 757-P for non-credit financial organizations. Defining the precise assessment boundary is critical, including systems, remote access channels, virtualization components, and third-party interactions. Organizations must also distinguish between the full assessment scope and the representative sample selected for verification. Evidence collection requires both policy review and technical confirmation that controls function as intended across the evaluated environment.
Evaluating Secure Development Maturity: Comparing BSIMM, DSOMM, SAMM and GOST R 56939-2024
A detailed analysis compares four methodologies for self-assessing secure software development maturity in Russian companies. The review covers BSIMM from Black Duck, OWASP DSOMM, OWASP SAMM and the updated Russian national standard GOST R 56939-2024. Each model was tested through a simulated audit on a fictional company called ООО «Лиса и лосЬ» that uses GitLab, Nexus and SonarQube. The evaluation scored the methodologies on criteria including ease of maturity calculation, recommendation generation, roadmap building, heat-map creation and SDLC coverage. GOST R 56939-2024 and SAMM received the highest total scores of 35 and 34 out of 47. The article concludes that no single methodology covers all needs and recommends combining approaches tailored to specific company contexts.