How to Use Fable 5, Opus 4.8 and GPT under GDPR

"Fable 5 / Opus 4.8 / GPT are stronger, but they run in someone else's cloud, so we cannot use them" is a common conclusion, and it is wrong for two reasons. First, GDPR regulates neither the workflow nor the model, but personal data - those that identify a person.

Most of the text you send to an LLM does not contain personal data. Second: between "everything in a foreign cloud as-is"

between "everything on your own hardware" there is an intermediate setup - a privacy gateway that anonymizes data before sending and restores it in the response. GPU for self-hosted inference is the most expensive and latest step, not the first. Start with what is cheaper and faster: a privacy gateway in front of a foreign model or CIS cloud. Buy hardware only if the setup truly requires it - and that decision should be calculated in the calculator for your configuration, not guessed.

GDPR protects personal data - information that directly or indirectly identifies an individual: full name, phone, email, passport, taxpayer ID, social insurance number, card number, account number, IP when linked with other attributes. That is the regulatory boundary. Anonymized, aggregated, synthetic, and purely corporate data (SKUs, policy texts, anonymized statistics) are outside 152-

are not covered by the federal law. So the right first question is not "can we use a foreign model"

There are three mutually exclusive setups for the same task, and the sensible sequence is from cheap and fast to expensive. (A)

Foreign frontier via a privacy gateway - maximum reasoning, minimum capex, fast start; cross-border transfer remains in anonymized form. (B) On-prem open-weight (DeepSeek V4, Qwen3, Gemma 4) on your own hardware - data never leaves the perimeter, but GPU capex appears and you depend on the open-weight release pipeline. (C) CIS cloud (GigaChat, YandexGPT) - processing in CIS data centers under GDPR, with no own hardware and no VPN, at the cost of a lower ceiling in model capability versus global leaders.

Below are the pros and cons of each setup.

This is what the buyer screenshots for security and legal.

If the model operates inside an AI agent with access to CRM data and transcripts, the article covers data-leak channels and a launch checklist on AI Agents and Federal Law GDPR.

Estimating the setup by eye is costly not only in infrastructure, but also in regulatory risk.

The 2025 amendment package moved personal-data violations into the realm of turnover-based fines and criminal liability, with cross-border transfer as a separate aggravating factor.

Law No. 420-FZ of 30/11/2024 (effective 30/05/2025) introduced turnover-based fines into Article 13.11 of the Administrative Code: for a repeat breach, 1-3% of annual revenue, minimum RUB 20 million, maximum RUB 500 million. In the same package: failure to notify

Law No. 421-FZ of 30/11/2024 (in force from 11/12/2024) introduced Article 272.1 of the Criminal Code: for unlawful collection, storage, and transfer of personal data, up to 10 years in prison under aggravating circumstances, and cross-border transfer is explicitly named as an aggravating factor.

Practical takeaway: which fields in the process count as personal data and in which environment they are processed must be documented before the pilot, not after the first incident.

A system prompt or skill is soft behavior control: it reduces the chance of error, but does not guarantee its absence. The gateway provides a strict, verifiable boundary: detect -> mask before the cloud.

So a skill is policy, while a gateway is enforcement.

You cannot rely on a single instruction instead of anonymization under GDPR.