Gains:
- Understand the concepts of data sovereignty, international transfer and data retention
- Seeing the concrete impact of KVKK and EU regulations on model selection
- Ability to implement ways to increase data control with regional hosting, zero retention, and open weight
We learned the technical aspect of model selection (stage, context, cost). But perhaps the most serious dimension of a corporate decision is not technical, but legal and ethical: To whom, where and with what assurance do you entrust your data? For every institution that processes personal data, this question is not a choice, but a legal obligation. A wrong choice can result in fines, loss of reputation and loss of customer trust. In this unit, you will learn the concepts of data sovereignty, international transfer and data retention; You will see the concrete impact of KVKK and EU regulations on model selection and be able to implement ways to increase data control.
Three Basic Concepts
- Data sovereignty: The principle that data is subject to the laws of the country where it is processed. Wherever your data is processed, the rules of that country apply. So “where does my model process efficiency?” The question is strategic.
- Data transfer abroad (cross-border transfer): Processing or storing personal data on a server outside your country. Sending text to a closed model often means transferring the data to the provider's server (usually abroad).
- Data retention: How long the provider keeps the data you send and what it uses it for. Some providers offer the option of not storing data at all ("zero retention"); some keep it for a certain period of time.
Tip: Before working with any provider, clarify three questions: (1) Where is the data processed? (2) How long is it kept? (3) Is the model trained with my data? The answers to these three questions determine your privacy stance.
Critical Point in Terms of KVKK: International Transfer
Processing of personal data in Türkiye is regulated by KVKK (Personal Data Protection Law). Sending a text containing personal data to an AI provider based abroad is considered "data transfer abroad" and is subject to the special conditions of the KVKK on this subject. These conditions; It includes conditions such as the explicit consent of the person concerned, the existence of adequate protection in the country where the transfer will be made, or the provision of appropriate safeguards (such as letters of commitment, standard contractual clauses).
In practice, this means that sending personal data such as customer name, TR ID number, health information, financial data to an overseas model without thinking can put you at legal risk. If you operate in the EU, similar principles apply with the GDPR (Europe's data protection regulation) and there too, international transfers are subject to strict rules.
Caution: Saying "Our data is already anonymous" is not as safe as it is often thought. Even if you delete names from a text, context can still make the person identifiable. True anonymization requires expertise; In any case you are not sure, the safest way is to accept the data as personal data and act accordingly. This is something you will need to work on with your legal/compliance team.
Ways to Increase Data Control
If you are processing personal or confidential data, there are concrete ways to increase control:
Method
How does it work
Who is it suitable for?
Regional hosting
Processing of data in a specific geography (e.g. EU)
Regional legal compliance requirements
Zero data retention
The provider does not store data at all
Institutions with high privacy sensitivity
Enterprise/API agreements
Commitment that your data will not be used in model training
Those who handle trade secrets
Open weight + your own server
Data never leaves
Absolute confidentiality required
Data masking/extraction
Removing personal fields before sending
Additional layer in almost every scenario
These methods are not mutually exclusive; It is generally healthiest to use several together. For example, both masking personal areas and using a provider with a zero retention contract provides two layers of protection.
Why is Country of Origin Important?
- In the unit we tabulated the providers' country of origin; Here's why. The country where the provider is located determines which laws it is subject to and the legal framework under which your data will be processed. While a European-based provider (e.g. Mistral) provides a natural advantage for an organization wishing to remain within the EU border, a provider in a different jurisdiction may require additional compliance work. Origin is not a marketing detail; It is a legal and strategic criterion.
Three Realistic Cases
Case 1 — The hospital's line. A hospital wants to summarize patient notes with AI. Patient data is in the most sensitive personal data class. Since they cannot take the legal risk of sending it to an overseas cloud, they run an open-weight model in their own data centers. The data never leaves the institution; Both KVKK and patient trust are protected. They sacrifice convenience, but they do the right thing.
Case 2 — Masking in e-commerce. An e-commerce company wants to answer customer support emails with AI, but the emails contain customer name, address and order information. Before sending it to the model, they replace personal fields with placeholders in a pre-processing step (e.g. "[CUSTOMER]" instead of "Ayşe Yılmaz"). The model produces a response draft without losing context, but the personal data never goes to the provider. They also double the layer of protection by choosing a provider with zero custody agreements.
Case 3 — Regional hosting in EU finance. A Frankfurt-based fintech wants to analyze transaction data with AI, but does not want the data to leave the EU due to GDPR. They use an EU-hosted model with an enterprise agreement and regional processing guarantee. The legal team documents the process with standard contractual clauses and transaction record; They leave a trail ready for inspection.
Weak Prompt / Strong Prompt: Compatibility Assessment
Weak prompt:
Is using this model compatible with KVKK?
There is no context; The model can only provide a general answer and is not a substitute for legal advice.
Powerful prompt:
Your role: data protection aware AI consultant (preliminary analysis, not legal advice).Status: We are a health technology company in Türkiye. We are considering sending patient appointment notes (name, phone number, complaint) to a foreign-based model to summarize. We are subject to KVKK.Task: List the foreign transfer risks in this scenario. To reduce risk, consider masking, zero storage, regional hosting and open weight options for suitability. Finally, collect the points that "must be consulted with a lawyer" under a separate heading.
The strong prompt gives the scenario and legal framework clearly and asks the model not for legal advice, but for a preliminary analysis to be taken to the lawyer; This distinction is critical.
Copiable Templates
1. Data flow map:
Describe the following workflow step by step and mark which data type goes where at each step: [WORKFLOW]. Label steps that contain personal data as red, and those that do not contain green. Also indicate each point that goes abroad.
2. Masking plan:
Which fields in the following text type [EXAMPLE TEXT] are personal data? Come up with a list of rules to mask them before sending them to the model (which field will be replaced with what). Show how to mask without breaking context.
3. Provider privacy checklist:
I am evaluating the following provider [PROVIDER]. What documents (privacy policy, data processing agreement, retention period) do I need to request to answer these questions? Add a "why is it important" note for each question. Also mention the country of origin effect.
4. Preliminary analysis of fit:
We process [DATA TYPE] in the field [INDUSTRY] and [LEGAL FRAMEWORK: KVKK/GDPR] applies. The legal obstacles to using a foreign model and possible solutions (explicit consent, appropriate safeguards, regional processing) are highlighted as a preliminary analysis. Explain that this is not legal advice and which points should be consulted with an expert.
Common mistakes
- Sending personal data without thinking: Sending information such as name, ID, health, financial data to an overseas model without pre-processing.
- Assuming "anonymity": Mistaking deleting names for complete anonymity; context can still define the person.
- Not reading the storage policy: Starting without knowing how much data the provider stores and whether it uses it in training.
- Ignoring the country of origin: Making a decision without considering which law the provider is subject to.
- Putting AI in the shoes of a lawyer: Mistaking the fit analysis of the model for definitive legal advice; skipping expert confirmation on critical decisions.
In summary
- Data sovereignty means that your data is subject to the laws of the country in which it is processed; “where is the yield processed?” It is a strategic question.
- Sending personal data to an overseas model is "data transfer abroad" in terms of KVKK and is subject to special conditions.
- Regional hosting, zero retention, enterprise agreement, explicit weighting and masking; They are methods that increase data control and can be used together.
- AI's compliance analysis is a preliminary step; Critical decisions must be taken to the legal/compliance team.
Application task
- Get the origin/license note you extracted in the unit and a stream containing data in your work. With template 1 (data flow map) in this unit, map out where the data goes and mark the steps that contain personal data. Then with the 2nd template (masking plan) determine which fields will be masked before sending in these steps. Make a note of the resulting map and plan to share with the person responsible for compliance in your institution.
checklist
- [ ] I can explain the concepts of data sovereignty, international transfer and data retention.
- [ ] I know what sending personal data to a foreign model triggers in KVKK.
- [ ] I can match five methods that increase data control and who they are suitable for.
- [ ] I can data map a workflow and mark risk points.
- [ ] I understand that AI compliance analysis is not a substitute for legal advice and when expert verification is essential.