Data protection and AI: sharing project data with AI tools

When you give a project to an expert who works with AI tools, the documents you share may be sent to those tools' servers, which are often abroad. For files containing personal data, this can count as a transfer abroad under data protection law (in Türkiye, KVKK No. 6698) and create additional obligations.

Which data is risky?

• Customer lists, phone numbers and e-mail addresses
• Health, financial or other sensitive information
• Employee information, contracts
• Source code and documents that are trade secrets

Three options

1. AI may be used: the expert states the tools they use. Suitable for work without personal data.
2. Only models running on the expert's own server: the expert uses models that run on their own computer or on a server in Türkiye and do not send data out.
3. No AI: the work is done entirely by hand. The most cautious option for sensitive data.

Practical tips

• Minimise data: give the expert the least data needed for the job.
• Anonymise: where possible, replace names, numbers and addresses with fictitious examples.
• Work with sample data: in software projects, use test data instead of real customer data.
• Agree in writing: state the data preference and confidentiality obligation in the proposal or contract.
• Revoke access: change the access and passwords you gave once the work is done.

About transfers abroad

Data protection law makes transferring personal data abroad subject to certain conditions. Which transfer can be made on which basis varies by company. For projects containing personal data, we recommend talking to your legal adviser.

FAQ

Do local models lower quality?

Large cloud models can give better results for some tasks; for many tasks local models are enough. Ask the expert for an assessment of your job.

What if the expert ignores my data preference?

That is a breach of your agreement. Stating your preference in writing helps protect your rights in such a case.

This article is for general information only and is not legal advice.