Your Team Uses ChatGPT: 7 Rules for Company Data

If your Turkish team works on laptops, someone is already pasting emails, quotes or spreadsheets into ChatGPT or a similar tool. Banning it rarely works; a one-page internal policy that says what never goes in, which accounts to use and who checks the output does. The official reference for that policy in Türkiye is the generative AI guide published by the Turkish data protection authority on 24 November 2025. Below are seven rules you can put in place this week.

First, a word on KVKK

KVKK is the shorthand used in Türkiye for two things: Law No. 6698 on the Protection of Personal Data, and the authority that oversees it, the Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority). It is the framework your local team and advisers will refer to.

In November 2025 the authority published Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi (15 Soruda), a guide on generative AI and personal data structured as 15 questions. It is published in Turkish; a Turkish-speaking colleague or adviser can walk you through the sections cited below.

Shadow AI is already in your office

“Shadow AI” means staff using AI tools for work without the company knowing or approving. It is rarely malicious. A sales rep wants a politer reply to a customer complaint, someone in finance needs help with an Excel formula, a developer pastes in code that won’t compile.

The problem is that nobody knows where the data went. A customer list pasted into a personal account does not sit in a system the company controls. When that employee leaves, the account and its chat history leave too. If your group has an AI policy written at headquarters, check that your Turkish staff know it and that it reflects the local guide.

What the KVKK guide says

The guide covers how generative AI works, its risks, how processing is assessed under Law No. 6698, and what individuals should watch for. Points most relevant to an internal policy:

• Risks (Question 5): the guide names exposure of personal data or sensitive corporate information shared in prompts as an important security issue, and warns about “hallucinations”: convincing but false outputs.
• Personal data (Question 6): personal data can appear in outputs even when the input contains none, and a model not targeting personal data does not by itself mean no processing takes place.
• Cross-border transfer (Question 10): where data controllers in Türkiye use AI systems through providers based abroad and personal data is transferred abroad, the guide states the transfer must comply with Article 9 of the Law and the related Regulation on transfers abroad.
• Security (Question 13): staff awareness and training, multi-factor authentication and secure storage of processing records and system logs are among the measures it lists.
• Everyday use (Question 14): avoid sharing names, addresses, phone numbers, ID details, third parties’ data, and health, financial or legal information; use anonymized, generalized wording where possible.

The rules below are practical guidance drawn from these points. They do not replace the guide and are not legal advice.

Seven rules for company data

1. Write down what never goes into a prompt

The heart of the policy is a short “never” list:

• Personal data of customers, employees and suppliers (names, Turkish ID numbers, phone numbers, addresses, emails)
• Customer and dealer lists, CRM exports
• Contracts, quotes and pricing work
• Source code, API keys, passwords and server details
• Public tender documents and bid files
• Health, financial and legal information about individuals

The last item mirrors the categories the guide highlights for individuals (Question 14). The rest may not be personal data, but they are your trade secrets.

2. Company accounts, not personal ones

You cannot manage settings, history or access on an account an employee opened with a private email. A business plan gives that control back. Some major vendors state on their official pages that data from business and enterprise plans is not used to train their models by default, while on individual plans this is often a setting the user must switch off. These commitments vary by vendor, plan and date, so read the current privacy and data-use page and record the answers: Is input used for training, and who controls that setting? How long is history kept? Where is data processed? Can the company close an account when someone leaves?

Once the account is live, review every admin setting and enforce multi-factor authentication, which the guide lists among measures against unauthorized access (Question 13).

3. Anonymize before you prompt

The model rarely needs a real name: “a customer’s order was late” works just as well. The guide suggests replacing names, dates and locations with abstract, general wording (Question 14). Use labels such as “Customer A”, delete ID and contact columns, and replace company names with a sector description. Be careful: removing a name is not always anonymization. The guide notes that whether data claimed to be anonymous really is should be shown by technical methods and objective criteria (Question 6).

4. A human checks every output

Fluent text is not accurate text. The guide’s example of hallucination is a lawyer finding court decisions that do not exist (Question 5), and it warns that outputs can be wrong, biased, inconsistent or misleading. Anything going to a customer, the public or an authority, whether text, figures, legal references or code, is checked by a named person who owns it.

5. One person approves new tools

New AI plug-ins, meeting note-takers and browser extensions appear almost weekly, and each is a new route out for company data. Name one approver; in a small company that may be the IT lead or the general manager. Questions to ask: Have the data terms been read? Where is data processed? Is there a business plan? Who will use it, for what? If the vendor is abroad, the cross-border point in Question 10 applies; ask your counsel what it means for your setup.

6. Keep a log and train the team

Keep a simple list of which tools each team uses and for what; an admin panel or a shared sheet will do. The guide describes securely stored processing records and logs as a useful tool for detecting incidents (Question 13), and says awareness and training for staff help build a data security culture across the organization. A short session covering the “never” list, anonymization and one hallucination example is enough; add it to onboarding.

7. Put it on one page

Nobody reads a ten-page AI policy. Cover the purpose, approved tools and account type, the “never” list, the anonymization rule, who checks outputs, how to request a new tool, and whom to tell when something goes wrong. Review it regularly; the guide sees value in reviewing risk assessments regularly and updating them when needed (Question 13).

A note on legal advice

This article is for information only and is not legal advice. How your AI use is assessed under Law No. 6698 depends on what data you process, for what purpose and through which provider. Have your KVKK position reviewed by a Turkish lawyer or data protection professional, and treat the KVKK guide as the official reference. None of the rules above, on their own, mean a company is compliant.

If you want help setting up safe, well-governed AI use for your team in Türkiye, Tuvti Digital can support tool selection, business account setup and staff training.