A Russian operator registered in the Roskomnadzor personal data registry (number 24-26-055344) has published a detailed breakdown of risks that arise when contracts are pasted into foreign AI chatbots. The author notes that ordinary supply or transportation agreements routinely contain ФИО of signatories, passport data of individual entrepreneurs, INN numbers, phone numbers and emails of managers and drivers.
These elements remain personal data even when the information is already published in the Unified State Register of Legal Entities. Russian regulator practice holds that public availability does not convert the data into “publicly accessible” for the purposes of the law.
Updated administrative fines after 420-FZ
From 30 May 2025 the following penalties under Article 13.11 of the Code of Administrative Offenses apply to legal entities:
- Part 1 – processing without legal basis or for incompatible purposes: 150–300 thousand rubles
- Part 1.1 – repeated violation: 300–500 thousand rubles
- Part 10 – failure to notify Roskomnadzor of processing: 100–300 thousand rubles
- Part 8 – storage of Russian citizens’ data outside Russia: 1–6 million rubles
Individual entrepreneurs are treated as legal entities for most of these provisions. Million-ruble “leak” fines under parts 12–18 do not apply to a single contract or even several dozen contracts per month.
Cross-border transfer obligations
Any transmission of personal data to an entity located in another country constitutes a cross-border transfer under Article 12 of 152-FZ. Providing access to ChatGPT, Claude, Gemini or DeepSeek is sufficient; no physical file transfer is required. Since 1 March 2023 a separate notification must be filed with Roskomnadzor before such transfers begin. For the United States and the European Union a ten-working-day waiting period applies, during which the regulator may prohibit or restrict the transfer.
In addition, Russian law requires a data-processing agreement with any third party that receives personal data. Standard user agreements of OpenAI, Anthropic or Google do not satisfy this requirement.
Court practice and real incidents
No administrative cases specifically concerning AI chatbots have yet reached public court records. However, on 27 July 2026 the Babushkinsky District Court in Moscow upheld the dismissal of a sales director who uploaded transaction reports and financial data to DeepSeek, ruling that the action amounted to disclosure of trade secrets.
Earlier incidents at Samsung in 2023 demonstrated that source code, meeting transcripts and test sequences were uploaded to ChatGPT within weeks of internal approval, prompting the company to ban external AI tools on corporate devices. A U.S. federal court order in the New York Times v. OpenAI litigation temporarily required preservation of all ChatGPT logs, including deleted conversations, for five months in 2025.
