Russia to Offer Free Software for Personal Data Anonymization
The Ministry of Digital Development, Communications and Mass Media will provide operators and authorized government agencies with free software that anonymizes personal data through transformation. The government has amended its regulations accordingly, and the mechanism is scheduled to take effect on September 1, 2029.
The regulation establishes five methods for de-identifying personal data. Operators may use either free software or their own algorithms licensed by Mintsifry (the Ministry of Digital Development, Communications and Mass Media) and the Federal Security Service (FSB). The ministry already provides free software for four of the five methods.
The method of introducing identifiers replaces some personal information with special codes. The method of changing data composition or semantics removes information from a dataset when it is not needed for processing. Decomposition splits personal data into several parts, which are stored separately. The shuffling method rearranges individual records or groups of records in a database.
The transformation method covered by the amendments provides an additional layer of protection by generalizing data attributes. For example, it replaces an exact birth date with an age range and a residential address with a district. This approach protects information about specific individuals while preserving the data needed for statistical analysis.
Operators currently use this method with their own certified algorithms or purchase software from third-party developers. Mintsifry representatives say that, by 2029, the ministry expects to have accumulated enough data to identify the most effective approaches to developing the software and select a developer to create it. This is an important signal for the IT industry. Organizations that handle personal data but operate on limited budgets will be able to reduce spending on specialized software. Meanwhile, software developers are likely to work more closely with corporate clients.
Where a Unified Data Infrastructure Is Headed
The evolution of personal data de-identification systems is helping expand the domestic market and build a national data infrastructure. At its core is the Edinaya informatsionnaya platforma natsionalnoy sistemy upravleniya dannymi (Unified Information Platform of the National Data Management System, EIP NSUD). Since 2025, it has served as the official platform for processing de-identified personal data.
A broader set of tools will help further improve artificial intelligence algorithms. High-quality, large-scale datasets are essential for training AI models.
Mintsifry is responsible for improving the system and developing free software that will give participants in the unified platform access to automated data-processing tools. These include not only de-identification tools but also government data analytics capabilities.
The information security market is also expected to gain momentum. Government-provided software will cover basic needs, but corporate organizations will still require professional support to configure and protect their entire digital infrastructure.
How Russia Reached This Point
The legal groundwork for developing de-identification standards and algorithms dates back to 2006, when Russia adopted its Personal Data Law. In 2012, a government resolution added de-identification to the list of measures designed to minimize the risks associated with information system breaches.
However, for many years, the process lacked a clear legal framework. Commercial organizations actively used de-identified information for analytics and marketing, but under the law, that information was still classified as personal data.
In 2020, Moscow launched an experimental legal regime allowing the use of “regional data sets” to advance AI development and improve government efficiency. In 2024, the Ministry of Economic Development announced that it was working on an experimental legal regime to test de-identification technologies. In August of that year, a law was signed establishing the legal basis for creating and using de-identified datasets.
Building a Unified System
By 2029, Mintsifry is expected to expand the range of tools available to data operators so they can meet all applicable requirements. This should lower technical and financial barriers, improve data comparability and make datasets more useful for analytics.
Russia is gradually building a system in which large datasets held by both commercial companies and government agencies are processed under common rules. This marks an important stage in the country's digital evolution.
