Personal data for AI

The experience of Germany

In October 2025 Germany issued a Data Protection Guide for companies using generative AI technologies based on the search¹ and augmented generation method . “RAG” method means that a user's query is supplemented with context and clarified before the query is sent to the AI for response generation. The guidelines are intended for organizations that process personal data through RAG systems, including the use of² embedded AI models and vector databases. Seven principles of operation are highlighted:

1) Data accuracy, otherwise it leads to false AI responses about a person.

2) Traceability of sources used to supplement the query.

3) Data security through technical measures of separating data storage.

4) Classification of data according to its intended use, so that data is not used for irrelevant purposes.

5) Data should be used to generate a response to the extent necessary to process the query and should not be stored longer than necessary.

6) Compliance with legislation even at the stage of training the language model before implementing the RAG method.

7) Observance of all the rights of personal data subjects, including the right to access information about data processing.

Organizations using AI based on the RAG method must be ready to explain to subjects the principles and conditions of using their data in AI systems in an accessible manner.

The practice of regulating personal data protection for AI at the standards level may become more popular in European countries amid initiatives to simplify the requirements of the EU General Data Protection Regulation (GDPR) in order to stimulate the development of AI technologies. In November 2025, the European Commission is expected to present a³ package of amendments to the GDPR. Given that the European approach to personal data has become a model for many foreign national laws, the new trend is expected to quickly spread to other countries.

Russia’s experience

Data protection standards for AI are being developed in Russia. In 2022, a GOST standard was approved for managing big data analysis processes for AI (but the issue of personal data protection is closed with a⁴ reference to general legislative requirements). In July 2025, the Bank of Russia presented a Code of Ethics for the development and application of AI in the financial market. In terms of data protection, it is recommended to use customer data by developing AI solutions only if a significant improvement in efficiency is expected from the introduction of AI for the⁵ provision of financial services.

According to a 2025 survey in European countries, 84% of respondents are convinced that the more detailed the regulation of privacy⁶ issues for AI, the safer its use will be. Therefore, in Russia and around the world, we can expect the development of industry standards for data protection for AI in sectors such as healthcare and e-commerce.

From the monitoring issue No. 10 (22), October 2025. Download the full issue (PDF) · issue page at the Gaidar Institute