Units
1. Introduction to Artificial Intelligence in Banking: Roles, Boundaries, Verification and Ethics 2. Credit Risk Assessment and Scoring Support: Validating AI Draft 3. Fraud Detection: Anomaly, Warning and False Alarm Management 4. Customer Segmentation and Personalization: Within Ethical Boundaries 5. Chatbot and Customer Service: Secure Automation and Handover Points 6. Compliance, AML and KYC: Know Your Customer and Anti-Money Laundering AI 7. Report and Document Automation: Secure Flow from Draft to Approval 8. Financial Analysis and Decision Support: The Interpretation Behind the Numbers 9. Prejudice, Fairness and Discrimination: The Model's Blind Spots 10. Data Privacy, KVKK, Customer Secret and Legislation 11. End-to-End Workflow, Model Governance and Self-Audit
Unit 10 / 11

Data Privacy, KVKK, Customer Secret and Legislation

Gains:

  • Ability to anonymize customer and financial data within the scope of KVKK, customer secret and bank confidentiality rules and apply secure vehicle and data processing rules
  • To understand the obligations imposed by banking legislation (BRSA, MASAK, KVKK) on the use of artificial intelligence and the need for auditability
  • Ability to understand why model explainability, record keeping and audit trail are mandatory and maintain the chain of responsibility

In banking, data is gold — but it's also responsibility. A customer's salary, spending habits, credit history and account transactions are both highly sensitive personal information and legally protected. AI produces powerful results when working with this data; but the same power can create a serious violation with the push of a button. In this unit, we will see how to protect customer and financial data within the scope of KVKK, customer secret and bank confidentiality rules, the obligations imposed by banking legislation (BRSA, MASAK, KVKK) on the use of artificial intelligence, and why model explainability and audit trail are mandatory. Basic principle: data is the property of its owner; Protecting it is not a technical choice, but a legal and ethical obligation.

Two-layer protection: KVKK and customer secret

A customer data is protected by two separate frameworks:

  • KVKK (Personal Data Protection Law): Any data that makes a person specific/identifiable is personal data. A legal basis (explicit consent or legitimate reason) is required for processing; It should be limited to the purpose, proportionate and safe. Financial data is of particular importance.
  • Customer secret (Banking Law): Any information the bank learns about its customer is a secret and cannot be shared without authorization. This obligation also binds the bank employee.

Uploading a customer data into an unapproved AI tool could violate both frameworks simultaneously.

Data type

protection

risky behavior

Name, TR, IBAN

Personal data + secret

Entering the vehicle without anonymization

account statement

Personal data + secret

Operating in an unauthorized vehicle

Credit score/history

Personal data + secret

sharing without purpose

Anonymous segment data

low risk

(risk if identity can be recovered)

Tip: It's not enough to say "I anonymized"; The data must be truly de-identified. Even a small number of characteristics (age + neighborhood + occupation) can identify a person. In anonymization, "can this data be returned to the person?" Ask the question.

Secure data processing steps

  1. Anonymize/mask. Remove identifying areas; Use alias value if necessary.
  2. Minimum data (data minimization). Process the minimum data required for the task; Do not carry too much data just in case you need it.
  3. Limit it with purpose. Use data only for the purpose for which it was collected; Do not shift data received for credit to marketing.
  4. Approved and safe vehicle. Use the bank's contractual data processing assurance tools; Do not enter customer data into public tools where it is unclear where the data is going.
  5. Audit trail. Record which data, for what purpose, and which tool was used.
  6. Storage and disposal. Do not keep data longer than necessary; Dispose of expired according to policy.

Obligations imposed by the legislation on artificial intelligence

  • Explainability: Regulated decisions (such as loans) must be justifiable; The "black box" decision cannot be audited.
  • Audit trail: Model output, data used and final decision should be recorded; The question "why was this decision made?" should be answered later.
  • Human oversight: Humans must be involved in important decisions; fully automated, unsupervised decision-making mechanisms may conflict with regulation.
  • Right of objection and correction: The customer's right to object to the decision and request correction of his data must be protected.
  • Chain of responsibility: The person responsible for the decision is always clear — not the model, but the competent person and institution.
Attention: A breach of confidentiality or violation of legislation may be revealed in an audit months or even years later and may result in heavy administrative fines, loss of reputation and legal liability. "Not noticed" is not an assurance; Registration and compliance are established from the beginning.

Four copyable templates

1) Anonymization control:

Check the following text before giving it to an artificial intelligence tool: what information does it contain that makes the person identifiable (name, TR ID, IBAN, phone, address, rare feature combination)? List them all and suggest how to mask them.Text: [data]

2) Purpose and minimum data control:

What is the minimum dataset really required for this task? Which of the following fields are unnecessary for the task and should be removed? Mark areas at risk of misuse. Task: [description] Fields: [list]

3) Audit trail record draft:

Your role: assistant who prepares an audit trail record. Create a neat transaction record with the following information: which data (anonymous), which purpose, which medium, which date, who is responsible. Leave the missing fields as "[to be filled in]". Input: [information]

4) Customer data request response (KVKK rights):

A customer requested access/correction of his data within the scope of KVKK. Draft a response that is respectful, clear and reminds you of your rights (access, correction, objection). Adding new personal data; Explain the process steps. The official will check.

Weak prompt / Strong prompt

Weak prompt:

The following customer's full name, TR ID number and account statement for the last 6 months are attached; Analyze this and give me a profile. Be quick.

It shares identity data without approval, violates data minimization, and violates customer secrets.

Powerful prompt:

Your role: analysis assistant working with anonymous data. I give you only de-identified, minimal data: 42 years old, X segment, average monthly spending range [range]. Requesting personal data or inferring identity. I will use and save the output in the approved process.

Strong prompt works anonymously and with minimal data, prohibits identity extraction and provides for an audit trail.

three mini cases

Case 1 — Correct processing. An analyst conducts a behavioral analysis of 5,000 customers with only anonymous, aggregated data; No identification field enters the vehicle, the vehicle used and the purpose are recorded. The result produces business value and no confidentiality lines are crossed.

Case 2 — Risk of re-identification. A team discovers that some customers can be identified individually by a combination of age, neighborhood and rare occupation in what they thought was an "anonymous" data set. The data is re-anonymised by generalizing these fields (age range, large region). The "Anonymous" tag is not considered safe without being tested.

Case 3 — Audit trail recovers. A loan decision may be challenged years later. The bank shows from the audit trail on which verified data the decision was based, on what grounds it was made and who approved it. Thanks to the record, the decision can be defended; If there was no trace, the bank would be in a difficult situation.

Cloud, third party and data residency

Most AI tools run in the cloud and process data on their own servers. This opens up an additional layer of questions in banking: where does the data go and who can access it there? Sending customer data to a tool often means taking that data outside the walls of the bank. Therefore, choosing a tool is not a technical decision, but a compliance decision.

Points to consider:

  • Data processing contract: Is there a contract with the tool provider that defines how data will be processed, stored and deleted? “Free” and contract-free tools are not eligible for banking data.
  • Use in training: Know whether the data you entered is used in training the model; If used, customer secrets may leak to other places.
  • Data residency: The country in which the data is kept is important in terms of both KVKK and international transfer rules.
  • Access and logging: Is it recorded who accesses it?
Caution: "Vehicle appears safe" is not an assurance. Before a tool can be used in the bank, it must pass information security and compliance approval. Entering customer data into an unapproved tool means giving the data away without knowing where it goes.

Common mistakes

  • Sharing identity data without approval. Entering the vehicle without anonymizing your name, TR ID and IBAN.
  • Assuming "anonymous". Considering the data safe without performing the re-identification test.
  • Purpose drift. Using data collected for one purpose for another purpose.
  • Bypassing the audit trail. Not recording data, purpose and means; not being able to be held accountable later.
  • Black box decision. Considering an automatic decision that cannot be justified as legitimate.
Tip: Confidentiality and compliance are not a "barrier" but the foundation of trust. The customer trusts the bank because he knows that his data is protected. Risking this trust for a shortcut is the most expensive mistake.

In summary

Customer data is both personal data within the scope of KVKK and customer secret within the scope of the Banking Law; It is doubly protected. Anonymize (and test against re-identification), work with minimal data and purpose, use only approved secure tools, leave an audit trail. Legislation requires explainability, human oversight, right to object and clear chain of responsibility. In one sentence: Data is the trust of the owner; It is the responsibility of a competent person to protect, record and account for it.

Application task

Write a sample customer data text (with ID fields) and perform an anonymization check with template 1; Determine which areas to mask. Then define a task and extract the minimum dataset with the 2nd template and remove unnecessary fields. Finally, produce a draft audit trail record with the 3rd template, listing what information should be kept for each transaction.

checklist

  • [ ] I anonymized the ID fields and tested them against re-identification.
  • [ ] I processed only the minimum data required for the task.
  • [ ] I used the data limited to its purpose; I didn't let the goal slip.
  • [ ] I have only driven approved and safe vehicles.
  • [ ] I recorded the data, purpose, means and principal in the audit trail.
  • [ ] I took into account the explainability of the decision and the customer's right to object.
Previous Next