Units
1. What is Artificial Intelligence, Machine Learning and LLM? 2. How Does Generative AI Work? 3. What Can AI Do and What It Can't Do? 4. Fundamentals of Effective Prompt Writing 5. Hallucination and the Limits of Credibility 6. Prejudice and Justice 7. Data Privacy and KVKK: Where Can I Write Company Data? 8. Everyday AI Use Scenarios in the Workplace 9. End-to-End AI Workflow: Draft, Validate, Decide 10. Copyright, Ownership and Transparency 11. Responsible Use and Human Control 12. Personal AI Roadmap and Continuous Learning
Unit 7 / 12

Data Privacy and KVKK: Where Can I Write Company Data?

Gains:

  • Can distinguish which data can be written to AI tools
  • Can practically apply the concepts of personal data and trade secrets
  • Knows the privacy difference between enterprise and public AI tools

This unit gets at the heart of the most common mistakes and most serious risks in everyday AI use: What can you write into an AI tool and what can't you? If an employee, in good faith, pastes sensitive customer data into a public chat tool to speed up business, that could expose the company to both legal action and reputational damage. In this unit we will give a clear, actionable compass. KVKK (Personal Data Protection Law) is the law that regulates how personal data will be processed in Türkiye; Its European equivalent is GDPR.

Basic Principle: "Data Leaving the Door Never Comes Back"

Once you type information into a public AI tool, that information may now be out of your control. Depending on the type of vehicle, this data; can be stored, reviewed by employees, or used in future training of the model. So the basic question is: "Would I mind if I emailed this information to someone I don't know?" If your answer is "yes," think twice before typing that information into a public tool.

Which Data is Risky? A Simple Classification

Category

examples

Can it be written on a public instrument?

personal data

Name-surname, TR ID number, telephone, address, health, salary

no

trade secret

Pricing strategy, formula, source code, contract detail

no

Internal confidential information

Unpublished financials, personnel decisions, internal correspondence

no

customer data

Customer lists, purchase history, contact records

no

public information

Published blog, press release, general descriptions

Yes

Fictional/anonymous example

Sample scenario with made-up names

Yes (carefully)

Attention: "Private/sensitive personal data" (health, religion, ethnicity, biometrics, criminal record) require the highest protection. Do not write them to any external tool without anonymizing them.

Anonymization: Doing the Same Job Safely

In most cases, you can achieve your goal without giving sensitive data to the tool. The key technique is anonymization: removing information that identifies a person or organization and replacing it with generic phrases.

  • "a customer" instead of "Ali Veli"
  • "An important contract with a large corporate customer" instead of "2 million TL contract with Acme A.Ş."
  • Deleting them completely instead of real ID/phone/address
  • Approximate or representative figures rather than actual figures

Weak Prompt / Strong Prompt

Weak prompt: Ahmet Yılmaz (TC 123456...), customer number 0532... has been delaying his payment for the last 3 months. What should I write to him?

Result: A serious privacy and KVKK violation; personal data went to the external tool.

Powerful prompt: Draft a polite but clear reminder email to be sent to a long-term customer who has been overdue on their payment for about 3 months. Do not use a name, ID, or number; replace them with placeholders such as [Customer Name].

Result: You get the same job, no personal data is exposed.

Three Mini Cases

Case 1 — Pasted customer list. An employee pasted 800 lines of customer email lists into a public tool to “segment them.” The list contained trade secrets and personal data. The information security team noticed the situation; The incident turned into a data breach notification process. The correct answer was to: study data with anonymous/representative samples or use an institutional, approved tool.

Case 2 — Solving by anonymization. An HR professional was preparing for a performance interview. Instead of the employee's real name and details, he described the employee as "an employee who fell short of his targets in the last quarter but has strong team relations." He got useful talking points; No one was exposed.

Case 3 — “Ask IT first” reflex. Before a team rolls out a new AI tool, information security should ask “what types of data can we use it with?” he asked. They learned that the enterprise version's contract had a "data not used for model training" clause and published a clear usage rule. The result: speed + security combined.

Difference between Enterprise AI and Public AI

  • Public/free tools: Usually offer limited guarantees about how your data is stored and used. By default, it is the environment in which you should be most cautious.
  • Enterprise / contractual tools: Enterprise versions that the company uses with a contract often offer contractual guarantees such as "your data will not be used in model training", "it will be deleted within a certain period of time", "it will be stored in a certain region".

Copiable Templates

Clear all personal and identifying information (name, ID, phone, address, email, company name) from the text below and replace them with [ROLE] or [PLACEHOLDER]. Then export the cleaned text.Text: [paste here]

Rewrite this scenario with a completely fictional example, without using any real person/institution information. Scenario: [paste here]

Make me a "privacy checklist before you write to AI": personal data, trade secret, customer data, and internal confidential information.

Redesign and specify the necessary placeholders to allow me to complete the following task without sharing any actual customer/employee data. Quest: [quest]

Common Mistakes

Common mistakes

  • Pasting real personal data. Name, ID, phone number, address, health, salary are not included in public instruments.
  • Assuming "no one will see it anyway". Data can be stored or used in training; risk must be managed.
  • Assuming the tool is corporate. If you are unsure, ask IT/information security; Not every vehicle gives the same warranty.
  • Thinking that uploading screenshots/files is "safe". Personal data in an image or document is also personal data.
  • Bypassing anonymization. Most tasks can be done without identifying information.
Attention: Due to KVKK/GDPR, privacy is not a "better if it happens" choice, but a mandatory rule to comply with. Transferring personal data to a third-party tool without permission may result in administrative fines.

In summary

  • The data you type into a public AI tool may be out of your control; Act with the principle of "data that leaves the door does not come back".
  • Personal data, trade secrets, internal confidential information and customer data should not be written to publicly available tools.
  • You can safely do the same job by removing identifying information with anonymization.
  • Enterprise tools may offer contractual privacy guarantees; Be most cautious in public vehicles.
  • Confidentiality is a legal obligation due to KVKK/GDPR; If you are unsure, consult your IT/information security team.

Application Task

Review the input you've written (or considered writing) on AI in the last week. Do they contain personal or confidential data? Convert one to a secure anonymized version with the "cleanup" template above and see the difference.

Checklist

  • [ ] I know which data types cannot be written to public tools.
  • [ ] I can apply the concepts of personal data and trade secrets in practice.
  • [ ] I can make a task safe by anonymizing it.
  • [ ] I know the difference in privacy between enterprise and public tools.
  • [ ] When I am unsure, I consult the IT/information security team.
Previous Next