Generative AI tools such as ChatGPT, Gemini, Claude and Copilot are now part of most employees' daily work: drafting emails, summarising reports, preparing presentations, interpreting data. The time savings are real. But every piece of text entered into these tools is processed on servers outside your organisation. Put the wrong information into the wrong tool and the result can be a personal data breach, a trade-secret leak or a bad decision.
Türkiye's data protection authority (KVKK) highlighted this risk in its Guide on Generative AI and the Protection of Personal Data, published on 24 November 2025. The guide stresses that generative AI use falls under Law No. 6698 and that outputs should be verified by humans.
The ten rules below give employees a practical framework for using these tools both productively and safely.
1. Don't enter personal data
Customer names, national ID numbers, phone numbers, addresses, health information, salaries: never type anything that could identify a person into a general-purpose AI tool. If you need to, anonymise first: use "Customer A" instead of a real name and sample values instead of real amounts.
2. Don't upload confidential documents or trade secrets
Contracts, price quotes, strategy documents, source code and internal correspondence are among your organisation's most valuable assets. Summarising them with AI is tempting, but don't upload them unless you have an approved enterprise tool.
3. Use only tools your organisation has approved
AI tools that employees use with personal accounts, without the organisation knowing, are called shadow AI. Nobody has checked their data processing terms. Enterprise versions usually offer stronger data protection commitments. If you don't know which tool is approved, ask.
4. Check whether your data is used for model training
Some free or individual plans may use your inputs to improve their models. Enterprise plans usually switch this off, but verify the settings and contract terms with your IT and legal teams.
5. Remember cross-border transfers
Most popular AI tools process data on servers abroad. Under Turkish law, transferring personal data abroad is governed by Article 9 of the data protection law (KVKK). Amendments that took effect on 1 June 2024 reshaped the transfer regime; for example, where standard contractual clauses are used, they must be notified to the authority within 5 business days of signature. Any use case involving personal data should therefore be approved by your legal team.
6. Always verify the output
Generative AI produces fluent, convincing text, but it can make things up (hallucinate). Always check figures, legal references, names and sources. The KVKK guide specifically emphasises human verification of outputs.
7. Don't leave decisions about people to AI
In decisions that directly affect people, such as hiring, performance reviews, credit or customer complaints, AI should only assist. The final decision and accountability must stay with a human.
8. Don't publish output as-is
AI output may contain material from other sources or may not match your organisation's voice. A human should review every text going to customers, the press or social media.
9. Be careful with untrusted content
When you ask an AI tool to process a web page, email or file, instructions hidden inside it can mislead the tool. This is called prompt injection, and the risk grows with AI agents that can send emails or access systems.
10. When in doubt, ask; when something goes wrong, report
If you're unsure whether you can enter some data, ask first. If you accidentally shared personal or confidential information, report it immediately to your information security or data protection officer. Early reporting is critical for managing a potential breach.
Rules aren't enough; habits are
Rules announced once by email are usually forgotten. Lasting impact needs three things:
- A written AI usage policy: a short, clear document stating which tools may be used with which data.
- Short, hands-on training: employees work through real examples of what they can and can't do.
- Approved, useful tools: without a safe alternative, shadow AI use will continue.
Our Using Generative AI Safely programme is designed for exactly this: in 2–3 hours it gives all your employees the core rules of safe use through hands-on practice.
Sources