AI and ML
GigaChat, YandexGPT or ChatGPT: What Is Legal to Use With Customer Personal Data
LLM comparisons focused on answer quality skip the question that actually comes first for a business handling customer data: where that data physically lives.
In short
If the product processes Russian customers’ personal data, the model choice is first a question of Russia’s data-localization law (152-FZ), not answer quality: the law requires the primary recording and storage of Russian citizens’ personal data to happen on servers inside Russia. GigaChat and YandexGPT are processed on Russian infrastructure and remove this question by default; using ChatGPT or another foreign API with real customer personal data requires either upfront data anonymization or a separate legal assessment, not just an "we use AI" line in the terms of service.
The wrong question: "which model answers better"
Most public comparisons of GigaChat, YandexGPT and ChatGPT judge answer quality across different query types — a reasonable question for personal use, but not the first question for a business planning to run real customer data through the model: names, phone numbers, addresses, purchase history. For that business, the first question is not "which model is smarter" but "where does this data physically end up, and what does the law say about that."
What 152-FZ actually requires in practice
Federal Law 152-FZ, "On Personal Data," requires an operator processing Russian citizens’ personal data to record, organize and store that data using databases physically located inside Russia. This requirement exists independent of whether AI is involved at all, it concerns personal data as such. But when personal data is sent to an LLM via API for processing (not just storage), the same principle extends to that specific action too.
The practical consequence: sending a real customer name, phone number or address to a foreign model’s cloud API can technically constitute a cross-border transfer of personal data, which the law applies separate requirements to, not a gray area needing a lawyer’s attention someday, but a direct compliance question worth closing before launch, not after a customer complaint or an audit.
Comparison by practical compliance status
| Model | Infrastructure | What this means in practice |
|---|---|---|
| GigaChat (Sber) | Russian | Removes the localization question by default |
| YandexGPT | Russian | Removes the localization question by default |
| ChatGPT / foreign APIs | Foreign | Requires data anonymization or a separate legal assessment |
What to do if the product wants to use a foreign model
Using a foreign model is not necessarily off the table, it is a question of architecture, not abandoning the model entirely. A working pattern: anonymizing data before sending it to the model (replacing name and contact details with a technical identifier matched back to real data only inside the business’s own infrastructure), or using the foreign model strictly for tasks that never touch personal data directly, summarizing public content, generating marketing copy, rather than processing customer inquiries containing their personal data.
This decision is worth making with a lawyer at the start of the project, not retrofitted after discovering the model has already been processing real customer data for months in a way that does not meet the law’s requirements.
Frequently asked questions
Can ChatGPT be used with Russian customers’ personal data?
Directly, it is risky without additional measures: sending a real name, phone number or address to a foreign API can technically constitute a cross-border transfer of personal data requiring separate legal justification. A safer path is anonymizing data before sending it to the model, or using the model only for tasks that never touch personal data.
Does using GigaChat or YandexGPT remove all legal questions?
It removes specifically the infrastructure-localization question, since data is processed on Russian servers. It does not remove the rest of 152-FZ’s requirements around personal data handling in general, processing consent, stated purposes, retention periods, which apply regardless of which model is chosen.
What is data anonymization, and how does it help?
Replacing personal data (name, phone, address) with a technical identifier before sending it to the model, where matching that identifier back to real data is kept only inside the business’s own infrastructure. The model processes the request without ever seeing the real personal data, which removes part of the cross-border-transfer question.
When should a lawyer get involved in the model choice?
At the start of the project, before the architecture gets built around a specific model, reworking the system after discovering a compliance gap is significantly more expensive than designing it correctly from the outset.
Need a hand with this?
We do this work, not just write about it. Describe the task and we will scope it and send a staged estimate.
Related services
- AI strategy consultingMost companies have already run at least one AI pilot. A minority have taken even one pilot to stable, ongoing use. The gap usually is not the model, it is whether the process had a measurable payoff and whether the real running cost was worked out before starting. We help pick the right entry point so budget does not disappear into a demo that stays a demo.
- AI and ML developmentWe build AI that solves a defined task and pays for itself, not demos for the sake of demos. Classifiers, recommendations, text and document processing, LLM assistants, and model integration into an existing product.
Read next
- Where AI and ML Actually Pay Off in a Business, and Where They Are Expensive HypeMachine learning pays off where there is a repeated decision, a lot of similar data and tolerance for error. Missing any one of the three means do not. Here are the use cases that work, their realistic accuracy, the running costs and how to run a four to six week pilot.
- An AI Assistant on Your Own Knowledge Base: How RAG Works and What It CostsHow a RAG assistant differs from a button-tree bot and from an LLM with no data, where hallucinations come from and what actually reduces them, what SaaS costs against a custom build, and which month the project breaks even.
- What to Check in Your CRM and 1C Before an AI Project So the Budget Isn’t WastedMost failed AI projects run into the data, not the model — and the client usually only learns the data’s real quality after the money is already spent.