Use of Artificial Intelligence in Companies: Customer Data, Trade Secrets and Employee Policy
Last updated: 28.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer
Short answer: The use of artificial intelligence in companies is not prohibited; however, when an employee uploads customer data or a trade secret to an AI tool, this constitutes, from the company's perspective, an act of data processing and, in many cases, a transfer abroad. Accordingly, the conditions in Articles 4, 5, 6 and 9 of the Personal Data Protection Law (KVKK, Law No. 6698) and the data security obligation in Article 12 apply; for the protection of secrets, Article 396 of the Turkish Code of Obligations (TBK), Article 55 of the Turkish Commercial Code (TTK) and Article 239 of the Turkish Penal Code (TPC) come into play. The first step is to prepare a written AI use policy containing an approved tool list, data classification and access permissions, and to notify it to employees.
Chat-based artificial intelligence tools have rapidly entered working life for tasks such as drafting e-mails, summarising contracts, fixing code or preparing reports. The problem lies less in the tool itself than in what is uploaded to it. A sales representative pasting a customer list, an accountant pasting a payroll spreadsheet or an engineer pasting source code into a publicly available tool creates both a personal data risk and a trade secret risk for the company. This article examines the rules on data uploads, approval and access in the use of AI in companies, together with their legal basis. The product liability of the AI developer and the copyright status of generated content are outside the scope of this article.
What data may employees upload to AI tools?
As a rule, employees may upload only data that the company has classified and permitted in advance, and only to tools approved by the company. Publicly available information, anonymised texts and general drafts carry low risk. Any information relating to an identified or identifiable person, however, is personal data, and entering it into a tool counts as processing from that moment.
In practice, the soundest method is to divide data into four classes: public, internal, confidential and strictly confidential. The table below offers a general framework as to the conditions under which common data types may be uploaded; each company should adapt it to its own sector.
| Data type | Public tool used with a personal account | Enterprise tool under contract with the company | Main legal basis |
|---|---|---|---|
| Publicly available information, general draft | May be uploaded if the policy permits | May be uploaded | Company policy |
| Personal data of customers and employees | Should not be uploaded | Where there is a processing condition, a transfer safeguard and authorisation; anonymised where possible | KVKK Art. 4, 5, 9, 12 |
| Special categories of data such as health, biometric data and criminal convictions | Should not be uploaded | Only with an Art. 6 condition and the adequate measures prescribed by the Board, with separate approval | KVKK Art. 6 |
| Trade secret: price list, quotation, source code, strategy | Should not be uploaded | Where there is a confidentiality and no-training commitment, with authorised approval | TBK Art. 396, TTK Art. 55, TPC Art. 239 |
Is uploading customer data to an AI tool contrary to the KVKK?
Uploading customer data to an AI tool is not prohibited per se; however, an upload that does not rest on a processing condition, is not limited to a purpose or turns into an unsafeguarded transfer is contrary to the Personal Data Protection Law No. 6698. Since the employee acts on behalf of the company when using the tool, liability is directed at the company in its capacity as data controller.
The assessment is made through four questions. The first concerns the general principles in KVKK Art. 4: data must be processed lawfully and in accordance with the rules of good faith, for a specified and legitimate purpose, and in a manner that is relevant to, limited to and proportionate to that purpose. Pasting a customer's entire account history into a tool in order to prepare a draft reply to that customer's complaint is incompatible with the principle of proportionality.
The second is the processing condition in KVKK Art. 5. The Law requires explicit consent as a rule; consent is not required in cases such as performance of a contract, a legal obligation, or the legitimate interest of the data controller provided that it does not harm the fundamental rights of the data subject. The third concerns special categories of data such as health, biometric data or criminal convictions: under KVKK Art. 6, their processing is prohibited; they may be processed only in the exceptions listed in that Article and subject to the adequate measures determined by the Board.
The fourth is transfer abroad. A significant proportion of AI services run their servers abroad. KVKK Art. 9, as amended in 2024, makes a transfer subject first to a condition in Art. 5 or 6 and then, in order, to an adequacy decision, appropriate safeguards (for example, standard contracts or binding corporate rules announced by the Board) or exceptions that may be relied on only for incidental transfers. Where a standard contract has been signed, it must be notified to the Authority within five business days; failure to make this notification is separately subject to an administrative fine under KVKK Art. 18/1-d. The procedure is governed by the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, published in the Official Gazette of 10.07.2024. A random upload made by an employee through a personal account rests on none of these safeguards.
On 24.11.2025, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) published a guide entitled "Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi (15 Soruda)" [Guide on Generative Artificial Intelligence and the Protection of Personal Data (in 15 Questions)]. The guide assesses data processing carried out with these systems within the framework of Law No. 6698 and is one of the official sources to consult when preparing a policy. For the criminal aspect of the unlawful disclosure of personal data, see our article on TPC 135–136; in brief, Article 136 TPC provides for imprisonment of two to four years for a person who unlawfully gives personal data to another, disseminates it or acquires it.
What liability arises when a trade secret is entered into an AI tool?
The unauthorised transfer of a trade secret to a tool outside the company may give rise to separate consequences under employment law, commercial law and criminal law. At what stage and by whose hand the secret left the company determines the type of liability.
- TBK Art. 396 (duty of loyalty): The employee is obliged to use the technical systems entrusted by the employer properly and not to use for his or her own benefit, or disclose to others, the production and business secrets learned in the course of work. To the extent required by the employer's legitimate interest, this duty continues after the employment relationship ends.
- Labour Law No. 4857, Art. 25/II-e: Conduct inconsistent with honesty and loyalty, such as abusing the employer's trust or disclosing the employer's professional secrets, gives the employer the right to terminate without waiting for the notice period. Whether a given conduct is of such gravity is assessed according to the specific case.
- TTK Art. 55/1-d (unfair competition): A person who exploits, or discloses to others, business secrets learned secretly or unlawfully acts contrary to good faith; Art. 55/1-b-3 further treats inducing employees to disclose secrets as unfair competition. In such cases, civil claims such as declaratory relief, injunction and compensation arise.
- Article 239 TPC: A person who gives to unauthorised persons, or discloses, information or documents constituting a trade secret, banking secret or customer secret of which he or she has knowledge by virtue of his or her status, duty or profession shall, upon complaint, be punished with imprisonment of one to three years and a judicial fine of up to five thousand days. Where the secret is disclosed to a foreigner not resident in Turkey, the penalty is increased by one third and no complaint is required. Criminal liability requires intent; a careless upload and a deliberate leak are not assessed in the same way.
Although not involving artificial intelligence, the issue of an employee using customer information obtained at the workplace in a new workplace has been discussed before the Court of Cassation. The regional court of appeal, accepting that the duty of confidentiality arises from the law, awarded the contractual penalty (with a reduction); the 11th Civil Chamber of the Court of Cassation upheld that decision:
"…that the employer has a legitimate interest, even after the termination of the employment contract, in information of a confidential nature not being disclosed to the workplace or used by others without permission, and that agreeing on a contractual penalty in the event of a breach thereof is not contrary to the provisions of Articles 20-23 of Law No. 6098…"
Court of Cassation, 11th Civil Chamber, E. 2023/390, K. 2024/3936, 15.05.2024 (quotation from the reasoning of the regional court of appeal upheld by the Court of Cassation)
This decision shows the practical value of expressly writing confidentiality and contractual penalty clauses into the employment contract. The AI policy should make concrete how these clauses apply to the question "what information may not be entered into which tool".
Turkish Code of Obligations No. 6098 – Article 396 (last paragraph)
The employee may not, for the duration of the service relationship, use for his or her own benefit or disclose to others information learned while performing work, in particular production and business secrets. To the extent necessary to protect the legitimate interest of the employer, the employee remains bound to keep secrets after the termination of the service relationship as well.
How is an internal AI use policy prepared?
An AI use policy is prepared as a written instrument based on the existing data inventory and contracts, notified to employees and subject to oversight. Instead of a one-page list of prohibitions, a process following the steps below is recommended:
- Identify current use: Determine, through surveys and technical logs, which units use which tools, with which accounts and for which tasks.
- Classify the data: Define the public, internal, confidential and strictly confidential classes, together with the distinction between personal data, special categories of data and trade secrets.
- Create an approved tool list: Review the provider contract as regards whether the data entered is used to train the model, the retention period, server location and sub-processors.
- Establish the basis for transfer: If personal data will be processed, determine the condition under KVKK Art. 5/6 and the safeguard under Art. 9 for transfer abroad; if a standard contract has been signed, track the five-business-day notification period.
- Write approval and access rules: Regulate, on a role basis, who may access which tool and from whom approval is to be obtained for which data class.
- Inform and notify: Notify the policy to employees against signature or by registered electronic means; state clearly that usage logs will be kept.
- Provide and document training: Deliver training with sample scenarios (customer e-mail, payroll, source code) and record attendance.
- Audit and update: Conduct periodic internal audits under KVKK Art. 12/3; update the policy when a new tool is introduced or the legislation changes.
Companies that also operate in the European Union should additionally take into account the Artificial Intelligence Act, Regulation (EU) 2024/1689, which entered into force on 1 August 2024 and applies in stages. Article 4 of the Regulation, concerning the AI literacy of staff, has applied since 2 February 2025. For companies operating only in Turkey, the decisive framework is the KVKK and the secrecy provisions of domestic law.
How should approval and access rules be set up for AI tools?
Approval and access rules should be built on the principle that "a person whose duties do not require it may not access the data or the tool". KVKK Art. 12 obliges the data controller to take all necessary technical and administrative measures to prevent unlawful processing and access; it also regulates joint liability with the data processor and the obligation to carry out internal audits. Breach of this obligation is subject to the sanction of an administrative fine under KVKK Art. 18/1-b.
Personal Data Protection Law No. 6698 – Article 12 (1) and (4)
(1) The data controller shall take all necessary technical and administrative measures to ensure an appropriate level of security for the purposes of: a) preventing the unlawful processing of personal data, b) preventing unlawful access to personal data, c) ensuring the safekeeping of personal data.
(4) Data controllers and data processors may not disclose to others, contrary to the provisions of this Law, the personal data they have learned, nor use it for purposes other than processing. This obligation continues after they leave office.
In a case where an employee exceeded his or her authority by viewing and sharing customer records (a complaint unrelated to artificial intelligence), the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) directly treated the lack of access restrictions and of training as a breach of Art. 12:
"…since it was concluded that, owing to the data controller's failure to impose restrictions on access to personal data and the inadequacy of the training given to employees, the necessary administrative and technical measures for ensuring data security set out in Article 12 of the Law had not been taken…"
Personal Data Protection Board, K. 2020/124, 13.02.2020
The same reasoning can be carried over to AI tools: in a set-up where anyone can upload any data to any tool, a single employee's mistake may be assessed as a failure by the company to take measures. The access matrix should therefore include the following elements:
- Mandatory enterprise accounts: For company work, only accounts managed by the company and connected through single sign-on should be used; personal accounts should be prohibited.
- Role-based authorisation: The confidential data class should be enabled only for specific roles and specific tools; for the strictly confidential class, approval of a manager or the data protection officer should additionally be required.
- Technical barriers: Data leakage prevention software, access restrictions on unapproved domains and file upload limits should be put in place.
- Logging and off-boarding: Usage logs should be retained for a set period; the access of a departing employee should be closed on the same day.
Can the employer monitor an employee's use of AI?
The employer may monitor the use of AI on company tools; however, the employee must have been informed of such monitoring clearly and in advance. Records obtained through covert monitoring may not be usable as grounds for termination, even if they show a breach. In a case where a keystroke-logging program was installed on the employee's computer without his or her knowledge, the 22nd Civil Chamber of the Court of Cassation expressed this principle as follows:
"As a consequence of the employer's right of management, it is always possible for the employer to monitor and track the employee in the electronic environment. However, for this, it is a requirement that the employee has been informed of such monitoring. Where the employee has not been informed that he or she is being monitored, or is monitored covertly, the data obtained as a result of such monitoring must be regarded as unlawful, even if it clearly shows that the employment contract has been breached by the employee."
Court of Cassation, 22nd Civil Chamber, E. 2017/21857, K. 2019/9884, 07.05.2019
On this reasoning, the Chamber reversed the first-instance decision that had found the termination justified. Accordingly, the policy should state clearly which tools are logged and by whom, for what purpose and for how long the logs are kept, and should be notified to the employee. Monitoring should be limited to its purpose and proportionate; methods that collect private correspondence indiscriminately should be avoided.
What should be done if data is uploaded to an AI tool by mistake?
When a mistaken upload is noticed, the record must first be deleted and its scope determined, and it must then be assessed whether a data breach notification is required. Under KVKK Art. 12/5, where processed personal data is obtained by others through unlawful means, the data controller shall notify the data subject and the Board of the situation as soon as possible. The notification decision is made according to whether the data has been made accessible to a third party and the provider's retention terms; this assessment should be documented.
For the internal investigation and any disciplinary or legal proceedings, it is recommended that the following documents be kept ready:
- ✓The AI use policy notified to the employee and the signature or acknowledgement record
- ✓The confidentiality, secrecy and, if any, contractual penalty clauses in the employment contract
- ✓The approved tool list and the contract with the provider, including the data processing annex
- ✓The standard contract for transfer abroad and the document evidencing notification to the Authority
- ✓Training attendance records and training content
- ✓Usage and access logs relating to the incident, with timestamps
- ✓The deletion request and the provider's reply, and the breach assessment report
- ✓The employee's written statement of defence
Any sanction imposed on the employee should be proportionate to the gravity of the act. A first-time mistake made in good faith and the deliberate transfer of a customer list to a competitor should not lead to the same outcome. For external threats such as fraud committed by taking over corporate e-mail accounts, our article on IBAN change fraud may also be consulted.
What are the common mistakes and exceptions in companies?
The most common mistake is to ban AI entirely and ignore actual use; in that case, employees turn to personal accounts and the company loses sight of what is happening. Other mistakes encountered in practice are as follows:
- Data assumed to be "anonymous": Deleting the name is not enough; when an order number, job title and date are combined, the person may remain identifiable.
- Enterprise use without a contract: A paid subscription does not in itself mean a data processing and transfer safeguard; the contract terms must be reviewed separately.
- Over-reliance on explicit consent: Collecting consent for every processing operation is impractical, and the process may halt if consent is withdrawn; the correct condition must be chosen.
- Policy not notified: A rule that has not been communicated to the employee is difficult to rely on in termination or disciplinary proceedings.
- Failing to check the output: Customer correspondence or reports generated by the tool should not be sent without human review; they may contain incorrect information or information belonging to another customer.
There are also exceptions: where the data is entirely public, has been genuinely anonymised, or the tool runs on servers within the company without any external transfer, the risk profile changes markedly. Even in that case, however, the principles in KVKK Art. 4 and the security obligation in Art. 12 continue to apply. For fraud risks based on fake voice and images, see our deepfake article.
Preparing an AI Policy with an Istanbul Personal Data Lawyer
In the use of AI in companies, the course of a matter is often determined by three points: whether the transfer abroad rests on a safeguard under KVKK Art. 9, whether the policy has been duly notified to the employee, and whether monitoring was announced in advance. Av. Coşkun Genç Law Office provides legal assistance in Istanbul to companies in preparing AI use policies and data classification, reviewing provider contracts, assessing data breaches, and in complaint and litigation proceedings arising from the disclosure of trade secrets. In the work carried out as an Istanbul personal data lawyer, the aim is for the rules to be workable without halting the flow of business.
Companies wishing to make a preliminary assessment with an Istanbul information technology law lawyer may prepare their existing KVKK inventory, the list of AI tools in use and their contracts, the confidentiality clauses in employment contracts and, if any, records relating to the incident. The office's contact details are available on the contact page; information on its areas of practice is on the cybercrimes page.
Sources
- Personal Data Protection Law (KVKK, Law No. 6698), Art. 4, 5, 6, 9, 12, 18 – mevzuat.gov.tr
- Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Official Gazette 10.07.2024) – mevzuat.gov.tr
- Turkish Code of Obligations (TBK, Law No. 6098), Art. 396 – mevzuat.gov.tr
- Turkish Commercial Code (TTK, Law No. 6102), Art. 55 – mevzuat.gov.tr
- Labour Law (Law No. 4857), Art. 25/II-e – mevzuat.gov.tr
- Turkish Penal Code (TPC, Law No. 5237), Art. 136, 239 – mevzuat.gov.tr
- Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi (15 Soruda) [Guide on Generative Artificial Intelligence and the Protection of Personal Data (in 15 Questions)], 24.11.2025 – kvkk.gov.tr
- Personal Data Protection Board, K. 2020/124, 13.02.2020
- Court of Cassation, 11th Civil Chamber, E. 2023/390, K. 2024/3936, 15.05.2024
- Court of Cassation, 22nd Civil Chamber, E. 2017/21857, K. 2019/9884, 07.05.2019
- Regulation (EU) 2024/1689 of the European Parliament and of the Council (Artificial Intelligence Act) – eur-lex.europa.eu
Important: This article is for general information purposes only and does not replace legal advice. The data for which an AI tool may be used varies according to the provider contract, the server location, the nature of the data and the company's sector. Since the amounts of administrative fines are updated every year at the revaluation rate, the current legislation should be checked for the specific amount.