Gains:
- Understanding that student data is personal and often private data, and the anonymization and storage rules within the scope of KVKK and professional confidentiality
- Ability to practice de-identification and choosing a secure/institutional tool when entering data into publicly available artificial intelligence tools
- Understanding that consent to data sharing, data minimization and compliance with school policy are the responsibility of the teacher.
A teacher has access to very sensitive information in the course of his job: grades, behavioral records, health conditions, family information, guidance conversations, socioeconomic data. This information belongs to the student's most private area and when it falls into the wrong hands, it can cause lifelong harm. Most AI tools are cloud-based — meaning the text you type is processed on remote company servers, not on your computer, and in some tools it can be used to develop the model. So writing a student's information into a public AI means taking it out of your control. This unit establishes the most critical layer of security in using AI in teaching. The rule is clear: Anonymize student data first, use secure/institutional tools if possible; The responsibility is on the teacher.
What data is protected? Framework of KVKK
Personal data is any information that makes a person specific or identifiable: name-surname, school number, ID card, photograph, or even indirect descriptions such as "the tallest student of 3-A" in one context. Special (sensitive) personal data are protected more strongly: health, ethnicity, religion, criminal conviction, biometric data, association/union membership. The student's health report, diagnosis of learning disability, or family trauma are in this category.
KVKK (Personal Data Protection Law) requires personal data to be processed lawfully, for a specific purpose, in a measured and secure manner. Practical implications for the teacher: use data only as necessary (data minimization), do not misuse data, keep it secure, do not share it with third parties (including public AI) without permission. There is also an obligation of professional confidentiality: the teacher cannot disclose the information he learns about the student and his family.
Caution: Assuming "the company isn't reading this anyway" is not safe. Some free AI tools can store/use inputs in training. Once data is out, it cannot be retrieved. The safest thing is to never take the data out.
Anonymization: making it a reflex
Anonymization means removing all elements that identify a person from the data and generalizing it irreversibly. In practice:
- Name-surname → "Student A", "a student"
- School number, TR ID, class-branch → remove completely
- Parent name, phone, address → remove
- Rare/descriptive details → generalize (phrases like "one student who uses a wheelchair" give the person away; say "one student")
- School/institution name → exit or say "our school"
Before giving a text to the AI, assume that a stranger will read it: can it be understood from this text which child it is? If it is clear, generalize further.
Safe vehicle selection
Not all AI tools are the same. The safest are corporate tools that your school/institution provides, has a data processing agreement (DPA), and does not use inputs in education. With free, publicly available tools, the assumption should be the worst case scenario. When choosing a tool, ask: Are my inputs saved? Is it used in education? Where is the data processed? Does school policy approve of this tool? If you are unsure, do not use the data without anonymizing it.
Step by step: private-secure workflow
- Scan for personal data. Name, number, institution, sensitive situation.
- Anonymize. Replace with general expressions; delete identifying details.
- Apply data minimization. Do not add any information that is not required by the task.
- Select vehicle. Institutional if possible; If not, assume the worst case scenario.
- Use it. Work with anonymous text only.
- Check the output as well. The AI can reflect back the information you give it; There should be no identity leakage in the output.
three mini cases
Case 1 — Last minute capture. A guidance counselor wrote to AI to consult about a student's family problem; The text included name, grade, and "his mother is in the hospital." He noticed without sending it, generalized it all as "13-year-old student, a health challenge in his family." The general approach suggestions he received worked; No personal data was leaked.
Case 2 — Indirect identification. A teacher wrote to AI that it was "material for the only visually impaired student in the class." There was no name, but the phrase definitely described that boy at school. When he noticed, he changed it to "for a student who needs vision support." Anonymization is not just about deleting names, but also hiding identifying details.
Case 3 — Vehicle selection. One school banned teachers from using free tools with student data and provided an enterprise tool with data security. One teacher would paste note analysis into the free tool out of habit; Thanks to the policy reminder, he switched to the corporate tool and still anonymized the data. Two layers of protection combined.
Copiable templates
1) Pre-anonymization scanning:
Assume that a stranger will read the following text. Can it be understood directly OR indirectly from this text which student he is? List all the expressions that give away the identity (name, number, institution, rare feature) and suggest a general alternative for each. Text: [paste]
2) Safe vehicle self-assessment:
Write a checklist of 6 questions to evaluate an AI tool I'm considering using: input storage, use in education, data location, institutional approval, right to delete, sensitive data compliance. Add "what to do if yes / what to do if no" to each question.
3) Data minimization control:
Simplify the text I will give the AI for the following task: remove any personal/contextual details that the task DOES NOT REQUIRE, leaving only what is necessary to do the job. Task: [describe]. Text: [paste]
4) Draft school policy (for teachers):
Draft a short, clear 8-point list of rules for teachers in a school to use AI tools to secure student data: anonymization, approved tool, sensitive data, retention, consent, breach notification. Let there be Turkish, applicable articles. I will submit this to management/expert approval.
Weak prompt / Strong prompt
Weak prompt:
Ahmet Yılmaz, 7-B number 214, is very weak in mathematics and his father is indifferent; What should I do for this student?
Name, number, class, family jurisdiction — a gross violation of confidentiality; The data is out of your control.
Powerful prompt:
Suggest 3 support strategies that can be implemented at school for a 7th grade student who has difficulty with basic operations in mathematics, assuming there is limited support at home. (Student anonymous; I do not share any personal information.)
Data type
example
Is it given to AI?
How
direct identification
Name, number, TR
no
Remove completely
indirect identification
"Single disabled student"
no
generalize
Sensitive data
Health, diagnosis, family
very careful
Anonymous + enterprise tool
General pedagogical situation
"A struggling student"
Yes
anonymously
Common mistakes
- Just delete the name. If the number, class or indirect definition remains, the identity is still clear.
- Overlooking the indirect definition. Expressions like "You're the only one in your class..." give the person away.
- Taking sensitive data lightly. Health/family information is special data and requires higher protection.
- Assuming vehicle safety. It's risky to assume that the free tool doesn't store data; Assume the worst.
- Not controlling the output. The AI may repeat the credentials you provide in the response; clean the output as well.
Tip: “Two-minute rule”: before pasting any student-related text into the AI, take two minutes to clear the name, number, institution, and identifying details. This small habit prevents the biggest violations.
In summary
Student data is personal, often private data and is protected under KVKK and professional confidentiality. Public AI tools are cloud-based; Giving the data as it is leaves it out of control. The right way: to anonymize personal and indirectly identifying information, share only what is necessary (data minimization), use corporate and approved tools if possible, and audit the output. The responsibility is on the teacher.
Application task
Take a text about a student you have written (or are considering writing) to AI in the last week. Detect and generalize all direct and indirect identifiers with the “pre-anonymization screening” template. Then evaluate the AI tool you are using against the “Secure tool self-assessment” list and decide what type of data you can use with this tool.
checklist
- [ ] Have I removed direct identifiers such as name, number, TR ID, institution?
- [ ] Have I generalized indirect descriptors such as "The only one in your class..."?
- [ ] Have I treated sensitive (health/family) data with extra protection?
- [ ] Have I checked the data policy and school approval of the vehicle I use?
- [ ] Have I checked for identity leaks in the output as well?