LLMs, Personal Data, and the 152-FZ Law

Large Language Models (LLMs) such as Codex and Claude Code were initially designed for coding tasks. However, their applications have expanded significantly, now encompassing contract management, data processing, and customer service tasks. This shift has raised concerns regarding personal data handling, especially when sensitive information like names, phone numbers, and identification numbers is involved. Sending such data to an LLM means that organizations are processing personal data, thus falling under the purview of the 152-FZ law in Russia. Our work involves integrating AI into various company departments, including operations, legal, and marketing, which constantly presents challenges related to compliance with data protection regulations. This article will clarify what constitutes personal data, outline the associated rules and penalties, and discuss strategies for organizations wishing to utilize LLMs for document processing without incurring fines. We will examine the advantages and disadvantages of these technologies and provide practical solutions for compliance.