Prompts containing personal data, processor roles, masking and deployment models: a KVKK checklist for enterprise generative AI use.
Employees pasting corporate data into public chat tools is today the data risk organisations meet most often. Banning generative AI is not the solution; offering it in a controlled, auditable and compliant way is. This article is for general information and does not replace legal advice.
1. Roles: controller and processor
Your organisation is the data controller for its own customer and employee data. If an AI provider processes the data only on your instruction it is a data processor. This relationship must be documented in a written data processing agreement.
2. Transfer abroad
Processing prompts and documents on the servers of a provider located abroad brings KVKK’s provisions on cross-border transfer into play. The simplest solution is processing the data in a cloud in Türkiye or in your own data centre.
3. Purpose-limited use and model training
Make sure the data is not used by the provider to train general models. ‘Zero retention’ and ‘not used for training’ commitments should appear explicitly in the contract.
4. Data minimisation and masking
Question whether the prompt really needs identity, national ID number, IBAN or health data. If not, automatic masking can be applied at input, with original values restored in the answer.
5. Special-category personal data
Data such as health, biometric and religious belief require additional measures. For scenarios working with such data, on-premise deployment and strict authorisation should be preferred.
6. Automated decisions and data subject rights
Individuals have the right to object to decisions that are analysed exclusively by automated systems and produce a result against them. AI outputs should be positioned as decision support, and the final decision should remain with a human.
7. Audit log and retention
Record who asked what, when and with which document, and define retention periods. The audit log is necessary both for security and for answering data subject applications.
A practical start
First publish a usage policy, then offer a controlled enterprise assistant. Data stays in-country, permissions are inherited from the source system and every answer comes with its source. You can download our security and compliance statement and KVKK guide from the documents section.
Checklist summary
- Is the data processing agreement signed?
- Is data processed in Türkiye?
- Is there a commitment not to use it for training?
- Are masking and authorisation applied?
- Are audit log and retention period defined?