ChatGPT and GDPR: Can Companies Upload Personal Data to AI Tools?
Why Does Using ChatGPT Pose Legal Risks for Companies?
Generative artificial intelligence applications have now become an integral part of companies' daily operations.
Employees use ChatGPT and similar artificial intelligence systems;
- preparing a contract
- Organizing customer emails,
- summarizing the reports,
- Evaluating CVs,
- generating software code,
- analyzing tables,
- preparing legal or technical texts
It can be used for this purpose.
However, this convenience raises an important legal question:
When an employee uploads information belonging to a customer or another person to an artificial intelligence system, does this constitute a transfer of personal data, and is this process compliant with the Turkish Personal Data Protection Law (KVKK)?
While the answer depends on the specifics of the case, allowing companies to use generative artificial intelligence without control can create serious risks to personal data, privacy, and trade secrets.
According to Law No. 6698 on the Protection of Personal Data, what matters is not the name of the technology, but which data is processed, for what purpose, on what legal grounds, by whom, and where.
Could information entered into ChatGPT be considered personal data?
Yes.
Information entered into an artificial intelligence system may constitute personal data under the Turkish Personal Data Protection Law (KVKK) if it relates to a specific or identifiable natural person.
For example:
"Our customer Mehmet Yılmaz has a debt of 450,000 TL."
An expression like this is not just a text.
When name and financial information are considered together, it may constitute a personal data processing activity.
Similarly, the following information may also be considered personal data:
- first and last name,
- phone number,
- email address
- address,
- Turkish Republic Identity Number,
- customer records,
- employee performance data,
- resumes,
- financial information,
- IP addresses,
- location data,
- Information on lawsuits and disputes.
Therefore, even a company employee simply "asking for a summary of a document" can become a data processing activity that needs to be examined under the Personal Data Protection Law if the document contains information about real persons.
The risk is higher in terms of sensitive personal data
Some data uploaded to artificial intelligence systems may be considered sensitive personal data.
For example;
- health information,
- biometric data,
- genetic data,
- Information regarding criminal convictions,
- political thought,
- religious or philosophical belief,
- union membership
Information like this requires higher protection.
For example, a human resources department uploading an employee's medical report to artificial intelligence to create a summary cannot be considered a simple text processing activity.
In this case, the provisions of the KVKK (Law on Protection of Personal Data) regarding special categories of personal data need to be evaluated separately.
Can a company be held responsible for an employee's use of ChatGPT?
This is one of the most important issues.
If an employee uses an artificial intelligence tool to perform their job, the data processing activity may have consequences for the company.
Company;
The defense "The employee uploaded it to ChatGPT from their own account, we had no knowledge of it" may not absolve them of responsibility in every case.
Data controllers have an obligation to take the necessary technical and administrative measures to ensure that personal data is processed lawfully.
Therefore, allowing companies to completely uncheck their employees' use of artificial intelligence could pose a significant compliance risk.
Can uploading data to artificial intelligence be considered a data transfer abroad?
This issue should be examined particularly in the context of cloud-based artificial intelligence services offered by foreign technology companies.
If the data is transferred to servers located outside of Turkey or to a data recipient abroad, Article 9 of the KVKK (Law on the Protection of Personal Data) concerning the transfer of personal data abroad may come into play.
However, the fact that the service provider is a foreign company does not automatically produce the same legal consequences in every transaction.
The company's;
- the artificial intelligence service used,
- data processing provisions in the contract,
- the service provider's position as data processor or data controller,
- where the data is stored
- sub-data processors,
- international data flow
It also needs to be reviewed.
The rules regarding data transfer abroad have changed in the KVKK (Turkish Personal Data Protection Law)
Article 9 of Law No. 6698 was significantly amended in 2024.
Under the new system, in addition to adequacy decisions, methods based on appropriate safeguards can also be used when transferring personal data abroad.
One of these is the standard contracts published by the Personal Data Protection Board .
Standard contracts;
- from data controller to data controller,
- from data controller to data processor,
- from data processor to data processor,
- from data processor to data controller
It is organized according to different transfer structures.
Therefore, a company working with a foreign AI or cloud service provider must first correctly define the legal roles of the parties in the transfer relationship.
Is signing a standard contract sufficient on its own?
Standard contracts are an important legal tool for transferring data abroad, but they are subject to specific form and notification requirements.
According to KVKK (Personal Data Protection Law) regulations, the standard contract must be reported to the Authority within five business days following its signing .
Companies signing any "Data Processing Agreement" found online or a standard contract prepared according to foreign legal systems should not be considered sufficient under the Turkish Personal Data Protection Law (KVKK) alone.
The transmission structure and the safeguards to be implemented must be evaluated in accordance with Turkish data protection legislation.
Is obtaining explicit consent sufficient to upload data to artificial intelligence?
One of the most common mistakes in practice is assuming that every problem can be solved with explicit consent. However, explicit consent is not the only legal basis for processing personal data under the KVKK (Turkish Personal Data Protection Law). If one of the other data processing conditions stipulated in the law is met, obtaining explicit consent may not be required.
However, the company;
"We're using AI, let's get explicit consent from everyone" – this approach won't solve all legal problems.
Firstly;
- processing purpose,
- data category,
- data minimization,
- transfer,
- storage,
- security,
- rights of the relevant persons
It should be evaluated.
Explicit consent is not an unlimited permission that automatically makes an unlawful or disproportionate data processing activity lawful.
Why is data minimization important in the use of artificial intelligence?
One of the fundamental principles of the KVKK (Law on Protection of Personal Data) is that personal data must be relevant to, limited to, and proportionate to the purpose for which they are processed.
This principle is particularly important for generative artificial intelligence.
For example, if a company only wants to correct the language of a customer complaint text, the customer;
- ordinary,
- address,
- phone number,
- Turkish Republic Identity Number,
- bank account information
In most cases, it may not be necessary to send all of this data to the artificial intelligence system.
If the same result can be achieved by anonymizing the text, then it is safer not to transfer personal data to the system at all.
Anonymization and masking can reduce the risk
Companies should remove personal data from their systems as much as possible when using generative artificial intelligence.
For example:
Risky use:
"Our customer Ahmet Yılmaz has a phone number of 0532 XXX XX XX and a loan debt of 250,000 TL. Please prepare a warning letter accordingly."
Instead:
Safer usage:
“A customer has a contractual debt of 250,000 TL. Prepare a sample warning letter draft without using personal information.”
A usage like this could be preferred.
However, not every masking method provides true anonymity.
If the data can be matched with other information to re-identify the individual, the data may still be considered personal data.
Trade secrets should not be entrusted to artificial intelligence either
The risks associated with using artificial intelligence are not limited solely to the Turkish Personal Data Protection Law (KVKK).
Employees must register in the system;
- pricing strategies
- merger documents,
- investment talks,
- customer lists,
- source codes,
- Product information not yet revealed,
- contracts,
- financial projections
Uploading this information could constitute a breach of trade secrets and confidentiality for the company.
Therefore, corporate AI policies should include provisions not only for personal data but also for trade secrets and intellectual property
Customer agreements should also be reviewed
In addition to the company's own GDPR obligations, the contracts it has with its customers are also important.
For example, if a software company has received data from a customer under a confidentiality obligation, uploading that data to a third-party AI system could constitute a breach of contract.
Therefore, when evaluating the use of artificial intelligence, not only the Personal Data Protection Law (KVKK) should be considered;
- confidentiality agreements,
- data processing agreements,
- service contracts,
- customer agreements,
- sectoral regulations
should also be examined.
Should companies ban their employees from using AI?
An absolute ban might not be feasible for most companies. Generative AI can significantly improve efficiency in business processes. A more effective approach is to establish specific rules for its use.
Companies can specify which AI applications are allowed to be used and clearly regulate which data categories cannot be uploaded to the system.
For example, company policy could prohibit uploading the following data to publicly available AI tools:
- customer personal data,
- employee health information,
- identity documents,
- trade secrets
- bank and payment information,
- Documents subject to a confidentiality agreement,
- source codes.
Should a policy be developed for the use of artificial intelligence in companies?
For medium and large-sized companies in particular, developing a written AI Usage Policy is becoming increasingly important.
This policy could regulate at least the following issues:
- Which artificial intelligence tools can be used,
- What information cannot be uploaded to AI systems?
- How to anonymize personal data,
- Prohibitions to be applied to special categories of personal data,
- Protection of trade secrets,
- Human control of AI outputs,
- Copyright risks,
- The use of customer data,
- Transferring data abroad,
- Procedure to follow in case of a data breach.
Human Resources Departments Should Pay Particular Attention
Human resources departments have begun to make extensive use of productive artificial intelligence.
For example;
- CV evaluation,
- preparing performance reports,
- employee analysis,
- creating interview questions,
- reports on layoff processes
It can be prepared with the help of artificial intelligence.
However, CVs can contain a lot of personal data.
Uploading an employee's or candidate's information directly to a third-party AI system can also result in data transfer.
The issue becomes even more sensitive when automated evaluations have legal consequences for employees.
Therefore, the use of artificial intelligence in HR processes should also be subject to legal and technical oversight.
The risk is higher in the healthcare, legal, and finance sectors
Due to the nature of the data used in some sectors, the risks associated with the use of artificial intelligence may be higher.
For example;
Hospitals: Patient reports and health data.
Law firms: Client information, case documents, and trade secrets.
Banks and fintech companies: Financial information, credit and payment data.
Insurance companies: Health, accident, and financial information.
Allowing companies to use artificial intelligence solely on the initiative of employees in these sectors could create significant risks.
What should be done if an employee accidentally uploads personal data?
The first step is to determine the scope of the incident.
Company;
- which data was uploaded,
- how many people it concerns
- which AI service it was sent to,
- whether the account is corporate or personal,
- whether the data is stored or not
- whether or not it is possible to delete it
- whether it was transferred to other systems
must determine.
Depending on the nature of the incident, it must also be assessed whether this constitutes a personal data security breach.
If necessary, the data breach notification procedures under the Personal Data Protection Law (KVKK) should be implemented.
What does the Turkish Personal Data Protection Law (KVKK) say about artificial intelligence?
The Personal Data Protection Authority has long kept the risks to personal data in the field of artificial intelligence on its agenda.
The organization has also published specific guidelines on the protection of personal data in generative artificial intelligence systems.
This approach is based on ensuring that personal data processing activities throughout the lifecycle of artificial intelligence technologies are carried out in a lawful, transparent, secure, and human-centered manner.
Therefore, companies;
"There is no specific law regarding artificial intelligence in Türkiye, therefore we have no legal obligations regarding the use of AI."
This approach is incorrect.
Regardless of a specific AI law, existing GDPR laws, contract law, intellectual property law, and trade secret provisions will continue to apply to the use of artificial intelligence.
What Companies Need to Do
Companies using generative AI on an enterprise scale should at least conduct the following legal checks:
- to create an inventory of the AI tools used,
- reviewing supplier contracts,
- To identify the flow of personal data,
- to analyze whether data is being transferred abroad,
- to create an appropriate transfer mechanism if necessary,
- Developing an employee AI usage policy,
- To define prohibited data categories for trade secrets and customer data
- providing training to employees,
- To implement anonymization whenever possible,
- To establish a data breach procedure.
Frequently Asked Questions
Is entering customer information into ChatGPT a violation of GDPR?
Not every incident can automatically be classified as a breach. The nature of the data, the purpose of processing, the legal basis, the service used, and how the data transfer took place must all be considered together.
If a company employee uses their own ChatGPT account, wouldn't the company be held responsible?
If the use of the account is within the scope of company activities, the mere fact that the account belongs to an employee does not automatically eliminate any legal liabilities that may arise for the company.
Is it possible to upload anonymous data to artificial intelligence?
Data that is truly anonymized and cannot be linked to an individual is not considered personal data under the KVKK (Turkish Personal Data Protection Law). However, simply removing a name does not always constitute anonymization.
Using ChatGPT constitutes data transfer abroad
Depending on the technical and contractual nature of the specific service, the transfer of personal data abroad may be relevant. The identity of the provider, where the data is processed, and the data protection roles of the parties need to be examined separately.
Is it mandatory for companies to develop artificial intelligence policies?
While legislation does not mandate a uniform "AI Policy" for every company, establishing corporate rules for the use of artificial intelligence can be an important administrative measure to ensure data security and legal compliance.
Conclusion
The use of generative artificial intelligence systems in companies is no longer just a technological preference.
Any contract, customer record, CV, or company document uploaded to AI systems like ChatGPT could potentially concerns about personal data, trade secrets, intellectual property, or privacy .
Especially when using foreign cloud services, the provisions of the KVKK (Turkish Personal Data Protection Law) regarding data transfer abroad should be evaluated separately.
Therefore, it is becoming increasingly important for companies to manage the use of artificial intelligence through corporate policies, data classification, contractual controls, and technical measures, rather than leaving it to the individual choice of employees.
Companies may need to conduct legal assessments regarding GDPR compliance analysis, AI usage policy development, transfer of personal data abroad, standard contracts, data processing agreements, AI service agreements, and data breach management in terms of productive artificial intelligence use
About Post Author
Pingback: What are the Legal Consequences of Using Photos Without Permission?