Can personal data go into AI tools?
An employee pasted a customer complaint into an AI tool and asked for a draft reply. The text had the customer’s name, phone and order details. Where is that data now? 🤖
AI tools boost productivity; but entering personal data raises questions of transfer, retention and training.
Short answer: set a written rule for AI use: which tools are approved, which data isn’t entered, and data is anonymised if needed; business accounts and settings are checked. 🧭
Note: this is general information, not legal advice. Regulations and Board decisions change; see the Turkish Personal Data Protection Authority for current guidance and a lawyer for your specific case.
Four risks
BU BÖLÜMÜN ÖZETİ
- Cross-border transfer
- Retention
- Model training
- Personal accounts
Invisible questions. ⚠️
Cross-border transfer
If the tool is abroad, entered data is transferred; see the transfers guide. 🌍
Retention
How long does the provider keep entered text? 🗄️
Model training
Under some settings data may be used to improve models. 🧠
Personal accounts
An employee’s personal account is outside the business’s control. 👤
A usage rule
BU BÖLÜMÜN ÖZETİ
- Approved tools
- Data not entered
- Anonymisation
- Human review
Four points. 📜
Approved tools
Which tools, with which account types, are used? ✅
Data not entered
Customer identities, special category data, employee files, confidential information. 🚫
Anonymisation
If needed, names and contact details are removed before entry. 🎭
Human review
Outputs are checked before publishing or sending; see the archive’s output verification guide. 👁️
Accounts and settings
BU BÖLÜMÜN ÖZETİ
- Business accounts
- Training setting
- History and retention
- Reading the terms
Four checks. ⚙️
Business accounts
Where possible, accounts with clear processing terms. 🏢
Training setting
The setting on whether data is used for model training. 🎛️
History and retention
Keeping and deleting chat history. 🧹
Reading the terms
The provider’s data terms are read and kept; see the vendors guide. 📑
Safe use examples
BU BÖLÜMÜN ÖZETİ
- General text
- Templates
- Anonymous analysis
- Internal knowledge
Four areas. 💡
General text
Drafts, summaries and ideas without personal data. ✍️
Templates
Placeholders instead of customer names; filled in later. 🧩
Anonymous analysis
Analysis with de-identified, aggregated data. 📊
Internal knowledge
Process and product knowledge without personal data. 📚
Four common mistakes
BU BÖLÜMÜN ÖZETİ
- Uploading whole files
- Personal accounts
- No rules
- Unchecked output
All four take data outside. 🚧
Uploading whole files
Uploading a customer table as it is for analysis. 📤
Personal accounts
Business data in an employee’s free personal account. 👤
No rules
Everyone uses whatever tool they know. 🌪️
Unchecked output
Wrong or inappropriate output sent to customers. ⚠️
What should I do today?
BU BÖLÜMÜN ÖZETİ
- Step 1: learn current use
- Step 2: a half-page rule
- Step 3: check settings
- If you want help
Three steps, one hour. 🪜
Step 1: learn current use
Which AI tools and accounts does the team use? Ask. ❓
Step 2: a half-page rule
Approved tools, data not entered, anonymisation; in writing. 📜
Step 3: check settings
Training and history settings; business account options. ⚙️
If you want help
Let us write your AI usage rules together: use the consult your expert form. For a compliance snapshot of your digital assets see the digital audit; the bigger picture sits on the KVKK consultancy page. 🎯
Related reading from the archive: shadow AI · verifying output.
📝 Notes From the Field
A firm noticed staff were uploading customer tables and complaint texts to personal AI accounts. A half-page usage rule was written: an approved business tool, a list of data not to enter and a placeholder template method; training settings were checked. The team kept benefiting from AI while customer data stopped going into the tools.
📖 Short Glossary
AI tool: a software service generating text, images or analysis. Model training: using entered data to improve a model. Placeholder: a temporary term used instead of real data. Business account: an account held by the business with set terms.
⚡ Quick Summary
Data entered into AI tools raises new questions. 🤖 Cross-border transfer, retention, model training and personal accounts are the four risks. A written rule sets approved tools, data not entered, anonymisation and human review. Business accounts, training and history settings are checked. General text, templates, anonymous analysis and internal knowledge are safe uses.
🎯 Next Step
Let us write your AI rules: use the consult your expert form. The inventory sits in the VERBİS and inventory guide; for your setup see the digital audit.
Frequently Asked Questions
Sık Sorulan Sorular
It’s less a flat ban than questions of transfer, retention and legal basis. Not entering personal data unless needed, and anonymising, is safest.
Business accounts usually have clearer, manageable processing terms and settings; an employee’s personal account isn’t under the business’s control.
AI outputs can be wrong or inappropriate; human review before anything reaches customers is essential.
Source: Turkish Personal Data Protection Authority — guidance and decisions