AI Agents and Federal Law GDPR: How Not to Expose Personal Data to an LLM

Federal Law GDPR regulates not 'AI use' but personal data processing—information that directly or indirectly identifies a person. Therefore, the first engineering question when launching an AI agent isn't 'can we use LLM' but 'which process fields are personal data and when do they end up in the prompt'. How to choose the model itself for this scope is discussed separately in the article on foreign LLM under Law GDPR.

Channel one—operator or agent prompt. Support staff insert a full ticket in the request: name, phone, contract number. The agent does the same automatically when gathering task context from the customer card. One request—one data subject, but thousands of such requests per month.

Channel two—CRM export to context. For the agent to 'know customers', they pass a database segment: order history with names and contacts. One such prompt—no longer a single data subject but hundreds or thousands of records. The volume of affected subjects determines the penalty category in case of breach.

Channel three—call transcripts. Customer conversation recordings go to the model for summaries or quality control. In the transcript—names, phone numbers, delivery addresses, and sometimes health or financial information that the law protects more strictly than regular personal data.

Channel four—resumes and applications. An HR agent ranking candidates works with concentrated personal data: contacts, birthdates, workplaces. The same risk comes from AI features inside SaaS services enabled 'by default'—the company's circuit doesn't see them.

Sending such text to a cloud LLM is personal data processing involving a third party. Critical questions must be resolved before launch, not after: legal basis and processing instruction (Law GDPR, Part 3, Article 6), primary collection localization in CIS database (Part 5, Article 18; from July 1, 2025, foreign primary collection is prohibited), and for foreign APIs—Roskomnadzor notification of cross-border transmission before transmission begins (Article 12)

Qualifying a specific workflow is legal work: which legal basis applies, whether the provider agreement covers data processing requirements. The engineering task is simpler and stronger: build a circuit where personal data never reaches the model at all. Then most of these questions compress to verifiable 'exactly what leaves the circuit'.

LLM & Security Gateway Implements the scheme as a separate component: gateway and anonymization map deploy within the client perimeter, applications switch via base URL change—endpoint is compatible with OpenAI format, client code requires no rewrite. Anonymization works at each call level, protecting both single requests and multi-step agent chains with RAG.

Provider keys are stored in the gateway itself; teams get virtual keys with instant revocation—this closes the 'bypass gateway' path: applications and staff have no direct keys. Every request is logged with the model, token count, and cost. The same principle at the system level shows security gate: AI agent for 1C: the model doesn't connect to the database directly but acts through audited tools with access control.

As of May 30, 2025, amendments to Law No. 420-FZ (November 30, 2024) to Article 13.11 of the Administrative Offenses Code take effect. Personal data leak 1,000–10,000 subjects: ₽3–5M fine; 100,000+ subjects: ₽10–15M; biometric data: ₽15–20M. Repeat breach converts fine to turnover-based: 1–3% of annual revenue (₽20–500M). Failure to notify Roskomnadzor: separate offense, ₽1–3M. Operation without processing notification: ₽100–300K.

Concurrently, Law 421-FZ (November 30, 2024) added Article 272.1 to the Criminal Code—liability for illegal personal data trafficking, with cross-border transmission as an aggravating factor. The full legal framework—operator obligations, documentation, security levels—is covered in articles on personal data processing under Law GDPR and on PDIS classification; we don't repeat it here.

The 'just don't tell anyone' strategy fails against the law's mechanics. Operators must notify Roskomnadzor of an incident within 24 hours and report investigation results within 72 hours (Part 3.1, Art. 21); silence incurs a separate fine beyond the breach itself. Breaches surface externally—in sold databases and regulator monitoring—not just from your reports.

There's a third reason for the AI circuit. Without a gateway and log, the company doesn't know what reached the model: no way to prove personal data didn't leave or assess the incident scope. A request log isn't bureaucracy—it's the only answer to 'what data left the circuit'—both during an incident and during audits.