Using ChatGPT and similar tools at work: data security and privacy law

Everything an employee types into ChatGPT or a similar tool is data leaving the company. The first rule of safe use is therefore simple: personal data, client secrets and unreleased commercial information do not go into a tool that is not covered by business-grade assurances.

Banning the tools rarely works. People keep using them and just stop telling you. A better path is a clear policy and the right choice of tool. This article gives a general framework and is not legal advice.

What data should employees never enter into ChatGPT?

Use this list as a starting point:

• Personal data. Names, phone numbers, emails, ID numbers and health details of customers, employees, candidates or patients.
• Contracts and pricing. Signed contracts, custom quotes, discount structures.
• Source code and credentials. Passwords, API keys, connection strings, proprietary algorithms.
• Financial and strategic information. Unreleased revenue figures, investment or merger plans.
• Third-party confidential information. Anything covered by a non-disclosure agreement.

Most of this gets pasted in under innocent requests like “summarise this”, “translate this” or “find the bug”. The risk is not malice; it is habit.

How is consumer use different from business use?

The same brand can offer different ways of using it, and the data terms can differ. In general:

	Personal/consumer account	Business plan and API
Account owner	The employee	The company
Administration	None	User management, access control
Data terms	Provider’s consumer terms	Usually a separate business agreement and data processing terms
Oversight	Company cannot see	Often logs and admin tools

How a given plan handles your data, whether it is used for model training and how long it is retained vary by provider and plan, and change over time. Read the current terms in the provider’s official documents and confirm with your legal counsel; nothing in this article should be read as a guarantee from any particular provider.

What should you check under KVKK and GDPR?

Turkey’s KVKK and the EU’s GDPR both set expectations around purpose, legal basis and data security when processing personal data. With AI tools, three questions come up in practice:

1. Does personal data enter the tool at all? If not, the rules about personal data mostly do not apply, so the safest approach is to keep personal data out or anonymise it first.
2. Is data transferred abroad? Many AI services are hosted outside the country. Cross-border transfers have their own rules, which should be assessed against current law.
3. Are your notices and contracts in place? Is there a data processing relationship with the provider, appropriate information given to the people concerned, and records kept?

The answers depend on your company’s situation. For article-level detail and obligations, consult your legal counsel and your data protection officer.

What should a company AI use policy include?

A one-page policy that everyone reads works better than twenty pages nobody does. Template clauses:

1. Scope. Which tools and which people (employees, interns, contractor teams).
2. Approved tools. Which tools and plans may be used, and how to request a new one.
3. Prohibited data classes. The list above, written with examples.
4. Anonymisation rule. How to replace names, companies and figures when needed.
5. Output responsibility. A person verifies generated content before use; the user owns the result.
6. Client and contract obligations. If a client contract restricts AI use, that restriction prevails.
7. Incident reporting. Whom to tell, and how quickly, if prohibited data is entered by mistake.
8. Training and review. How often the policy is revisited.

Quick checklist

• We found out which AI tools are actually in use (survey, short conversations).
• An approved tools and plans list exists.
• Business plan accounts are opened in the company’s name, with admin access.
• Prohibited data classes are written down with examples.
• Staff received a short briefing.
• Cross-border transfer and provider terms were confirmed with legal counsel.
• A person and a process exist for incident reporting.
• The policy is reviewed every six months.

When is a company assistant the better answer?

If employees constantly use a general-purpose tool with company documents, the safer route is usually an assistant connected to your own data with proper access control. How that works is covered in company AI assistant. For the broader view, see AI automation: where to start; for security on the web side, website security. Our scope is on the AI and automation page. If you want to add AI to your own product, the topic moves to custom software.

Frequently asked questions

Should we ban ChatGPT completely? For most companies, no. A ban makes usage invisible. Approved tools, clear rules and short training give a more sustainable balance.

If we anonymise the data, is the problem gone? Anonymisation reduces risk a lot, but removing a name may not be enough; a person or client can sometimes be identified from context. Review your method with legal counsel.

Is the API safer than the chat interface? In general, APIs and business plans give more control over administration, oversight and contracts. But “safer” depends on the provider and plan terms, so read the current documents.

Who should write the policy? Management, IT and your legal or data protection lead together. Policies written by IT alone or legal alone tend to be either unworkable or too thin.

What if an employee enters confidential data by mistake? Follow the incident clause: tell the responsible person quickly, record what was entered, review the provider’s deletion and retention options, and involve legal if needed.

If you are weighing a policy or a company-grade solution for your team, tell us about your situation. Fill in the contact form or write to info@boygantech.com.