// wiki · analysis · September 2026

Training AI on secrets and personal data

Draft article. The rules are as of September 2026; the assessment of a specific dataset always depends on the composition of the data.

The short answer

Training a model on a company's internal data is possible — it is not disclosure while the data does not leave the controlled contour. There are three conditions: the data itself was obtained lawfully, the contour is closed (one's own server or an agreed corporate service), and the “learning-out” risk is managed: a model can memorise fragments and give them to outsiders. Personal data adds the requirements of 152-FZ; protected secrets add the requirements of their own laws.

Corporate secrets

Own information under the trade secret regime stays protected if training happens in a closed contour: transfer to a controlled resource is not disclosure, unlike an upload to a public service, which practice has equated with disclosure (case No. 02-1545/2026, the note on secrets). Third parties' data under an NDA is a separate question: the right to “process” does not include the right to “train a model” unless the contract expressly allows it; the wording is worth checking and adding to new NDAs. The secrecy regime does not vanish after training: weights capable of reproducing the secret are protected information too.

Personal data

• The ground of processing. Training a model is a new purpose: personal data collected for one task cannot be silently fed into a dataset; consents, de-identification or another lawful ground are needed.
• Localisation: training on servers in Russia; foreign cloud platforms add a cross-border transfer.
• Data subjects' rights: deletion on request is technically hard for a trained model — an argument for de-identifying before the data enters the sample and storing the mapping table separately from the dataset.
• The operator's documents describe such processing honestly: “training of internal models” should be named among the processing purposes.

Legally protected secrets

State, attorney-client, medical, banking and other secrets have their own regimes. The general principle: the model is not a subject of liability — the operator answers; processing in a closed contour is permissible where the regime allows processing by the organisation's own means, and prohibited where the law requires a special channel or consent. For professional secrets an internal contour with need-to-know access is usually compatible with the regime; for state secrets — only a certified environment.

The memorisation risk

Large models can reproduce fragments of training data verbatim. For secrets and personal data this is a leakage channel: someone who knows how to ask can pull out what was memorised. Measures: filtering and de-identifying the dataset before training, restricting access to the model itself (the contour is not only about training but also about use), extraction tests before release, query monitoring.

Checklist

• a list of the categories of data that go into training, and the ground for each;
• the contour: where it trains, where it runs, who has access to the weights;
• personal data: consents or de-identification; localisation; reflection in the operator's documents;
• NDAs with partners: whether the right to train exists;
• a test of “what the model can give away” before every release.

Setting up the contour and policies for training on company data is part of product rights and risks practice and continuous support.