An employee pastes a client file into a chat window to get a summary. A developer pushes a repository through a code assistant. An analyst uploads last quarter’s customer list to build a model of churn. None of these people think of themselves as transferring data abroad, and in most companies none of them has been told that is what they are doing.
This is the third part of a series on the legal consequences of a company’s move to artificial intelligence. The first part dealt with the board’s position and the second with the supplier contract. This part follows the material that goes in.
Two separate problems, usually confused
Company data going into a model raises two distinct legal questions that are often treated as one. The first is personal data, governed by Law No. 6698. The second is the trade secret, governed by the unfair competition provisions of the Commercial Code and by whatever confidentiality obligations the company owes its own counterparties. A deployment can be clean on the first and catastrophic on the second.
The data protection layer
If personal data goes into the tool, the company is processing it and needs a lawful basis under Articles 5 and 6. The basis is rarely explicit consent and should rarely be attempted as such in an employment or customer context; legitimate interest and contractual necessity carry most real deployments, and both require the purpose to be defined before the processing rather than reconstructed after it.
Whether the tool is abroad matters. Article 9 governs transfer abroad and the company needs a mechanism, not an assumption that a global supplier has handled it. Where the mechanism is a standard contract, the notification step has its own short deadline, which we set out separately in the piece on filing a KVKK standard contract.
Then there is the classification question, which determines who carries what. A supplier that processes only on documented instruction sits as a processor. A supplier that uses inputs for its own purposes — improving its models, building aggregate products — is not acting purely on instruction, and the arrangement needs to reflect that honestly. This is exactly why the training clause discussed in the previous part is a data protection clause and not only a commercial one.
The trade secret layer, which has no consent cure
This is the part that gets less attention and is harder to unwind. Article 55 of the Turkish Commercial Code lists unlawful disclosure of production and business secrets among the principal cases of unfair competition, extending to evaluating or communicating to others information and business secrets learned unlawfully. Article 57 then makes the employer answerable: where the act of unfair competition is committed by employees or workers in the course of performing their services, the actions set out in Article 56(1)(a), (b) and (c) may be brought against the employer.
Read that against a company where a dozen people paste confidential material into consumer tiers of tools the company never contracted for. The exposure is not only the company’s own secrets. It is the secrets the company holds under a confidentiality obligation to somebody else — the client’s data room, the counterparty’s draft, the supplier’s pricing. Consent from a data subject does nothing about that. The obligation runs to a different person entirely, and it is contractual.
What actually reduces the exposure
Three things, in order of effect.
First, a sanctioned tool. Most of this risk comes from unmanaged consumer accounts, and the fastest reduction is providing a contracted enterprise tenant with the retention position agreed, then saying clearly that other tools are not to be used for company material. A prohibition without a provided alternative is ignored, reliably.
Second, a classification rule people can actually apply. Not a taxonomy with six tiers, but a line: material received under a confidentiality obligation to a third party does not go into any tool unless that has been cleared. Everything downstream follows from where that line sits.
Third, a record. Which tools are approved, for which categories of material, with which retention setting, and when that was last checked. This is the artefact that turns an incident into a manageable conversation with a counterparty, and it is the same artefact the board needs in order to have supervised anything.
The question to ask before the deployment
Not “is this allowed”, which invites an unhelpfully abstract answer, but a concrete one: if the counterparty whose material is in this workflow read a description of it tomorrow, would the company be comfortable, and would the contract with them support it. That question resolves most cases quickly, and it resolves them before rather than after.
The next part moves from the data to the workplace itself: what an employee use policy has to contain, where monitoring stops, and what happens when automation is the reason for a restructuring.
Sources. Law No. 6698 on the Protection of Personal Data (KVKK). Statute links open the official consolidated Turkish texts on mevzuat.gov.tr.
This entry is for general information only and is not legal advice. How any of it applies depends on the company, the deployment and the agreements actually in place.
