AI and KVKK: Be Careful When Sharing Data

01Why Does It Need Care?

It is perfectly ordinary for an employee to paste a whole email into an AI chat to answer a customer complaint. But that email contains the customer's name, phone number, delivery address and perhaps their health condition. That information is now being processed on a server outside your company.

Turkey's Law No. 6698 on the Protection of Personal Data (KVKK) regulates for what purpose, on what legal basis and with whom personal data may be shared and processed. Using an AI tool is not prohibited in itself; the question is how and with what safeguards data is passed to it.

This article is for general information. For an assessment specific to your situation, check current legislation and your legal counsel; the guides published by the Turkish Personal Data Protection Authority are also a good starting point.

02Core KVKK Concepts

Before assessing AI use, it helps to clarify a few concepts. They determine who is responsible and which data must be protected more strictly.

03What Data Should Never Be Entered?

Every company's risk appetite is different, but some types of data should never be entered into public tools or tools used with individual accounts, under any circumstances. You can add this list directly to your internal policy.

• National ID numbers, passport and driver's license details
• Credit card, IBAN and bank account details
• Special-category data such as medical reports, prescriptions and disability information
• Employee payrolls, performance reviews and disciplinary records
• Passwords, API keys and server access credentials
• Unannounced financial results, proposal files and trade secrets
• Bulk dumps of customer lists and contact details

04Data Anonymization Methods

For most tasks, AI does not need to know who the person is. To polish the tone of a complaint email or summarize a report, names and numbers are of no use. That is why the most effective precaution is to anonymize the data before sending it, or at least replace it with pseudonyms.

Use pseudonyms

Write "Customer A" instead of "Jane Smith, 0532…". Once the response comes back, add the real details yourself. This simple habit eliminates most of the risk.

Generalize

Use an age range instead of an exact date of birth, and only the city instead of a full address. The information needed for analysis is kept, and the detail that identifies the person is removed.

Set up automatic masking

If AI will be connected to your company software, you can add an intermediate layer that masks patterns such as phone numbers, email addresses and ID numbers before the data reaches the model. This provides protection without depending on the employee's attention.

05Business Accounts and Settings

There can be important differences in data policy between individual, free accounts and business plans. Some services may use content entered on individual accounts to improve their models; on business plans this is usually off by default. Read the contract and privacy terms for each service separately.

The main settings to check are: how long chat history is retained, whether content is used for training, the region where data is processed, the admin console and user authorization. Having everyone on the team work under a single administration with company emails lets you see who uses which tool.

Using the API is a separate option. When you connect to a model from your own software, you decide at code level what data is sent. Such a setup can be built into industry-specific software solutions or as an integration with your existing systems.

06Customer-Facing AI Use

When you add an AI assistant to your website or WhatsApp line, customer data flows directly into that system. In that case you need to update your privacy notice and tell customers clearly that they are talking to an AI. We covered how to design the assistant in detail in our AI chatbot article.

In sectors such as hotels, clinics and e-commerce, guest or customer records can contain sensitive information. For example, a guest's ID details in a hotel software system do not need to be shared with an AI assistant; the assistant can work with non-personal information such as room type, dates and price.

The same principle applies on the marketing side. If AI is used for customer segmentation or campaign analysis, the digital marketing team should work with aggregated, anonymous data; individual lists of people should not be uploaded.

07Internal Usage Policy

A ban often does not work; employees keep using the tool on their personal phones. A more realistic path is to write a short, clear AI usage policy and explain it to the team.

1. Which tools are approved and which account to use them with
2. Which types of data must never be entered
3. Anonymization rules and examples
4. Who will check the AI output
5. A human giving final approval on texts that go to customers
6. Whom to notify in a suspicious situation

08If Data Was Shared by Mistake

If an employee has accidentally uploaded a sensitive file to an AI tool, first delete the chat and the file using the methods the service provides, and record the incident with its date and contents. Then determine which data was involved, how many people it belongs to and whether the service retains it.

KVKK imposes a notification obligation on the data controller when processed data is obtained by others through unlawful means. Assess immediately with your legal counsel whether the incident falls within this scope and within what time frame notification must be made; the deadlines in the Board's decisions are short, and waiting increases the risk.

09Accuracy of Outputs Is Also a Responsibility

Data security is not the only risk. AI can produce false information about a customer or invent a rule that does not exist. That personal data must be accurate and up to date is also among the law's general principles; model output should therefore not be used on its own to make decisions about a person.

To understand why models can be wrong, see our articles what is an LLM and AI hallucination. If you reply to customer reviews on social media with AI, we recommend that every reply go through human review in your social media management process.