KVKK and Generative Artificial Intelligence: Is Your Marketing Team Uploading Customer Data to ChatGPT?
As a marketing executive, I am focused on technology and growth; However, on the other side of the coin lies the reality of "data breach and KVKK", which is the biggest nightmare of companies. Throughout my career, I've spent a lot of time straddling the fine line between marketing and compliance. The biggest risk I see today is not happening behind closed doors, but right in the middle of our offices.
Picture the scenario: A talented performance marketer or CRM expert on your team wants to segment customers for a new campaign. It takes an Excel file (First-Party Data) with email addresses, phone numbers and last purchase dates for 10,000 contacts and uploads it to ChatGPT. Then he enters the following prompt (command): "Segment this customer list according to the RFM model and list the VIP customers to me."
It gives great and fast results. However, in the same second, your company commits a massive KVKK violation.
So, how will marketing teams use artificial intelligence in accordance with KVKK without falling behind in innovation? I prepared this "Generative Artificial Intelligence (GenAI) Marketing Checklist" as a guide for in-company training and department managers. You can share this document directly with your team and hang it on your office wall.
The "Only I See This" Misconception
When you enter data into free or standard paid (Plus) tools such as ChatGPT, Claude or Gemini, these data are used to train models as standard. In other words, a phone number or e-mail address in your VIP customer list that you have uploaded to the system can be produced tomorrow as an "answer" to a question from a competitor on the other side of the world.
Transfer of personal data to overseas servers and violation of explicit consent means a penalty of millions of lira and a zeroed brand reputation for your brand within the scope of KVKK.
For Internal Sharing: Marketing Department AI & KVKK Checklist
Integrate the following 4-step checklist into your department routine so your team can safely use AI in their daily operations.
1. Turning Off In-Vehicle Privacy and "Data Training" Settings
The default settings of the AI tool you use are usually set to “train the model with your data.” The first thing is to turn it off.
[ ] For ChatGPT: Settings > Have you gone to the Data Controls menu? Is the "Chat History & Training" option set to off?
[ ] Enterprise/Team: Does your company use ChatGPT Team, Enterprise or API? (These versions do NOT use your customer data for training by default, this is the safest way).
[ ] Have team members been informed that they should check privacy settings each time they open a new account?
2. Data Masking and Anonymization Rules
Getting AI to do analysis is great, but you don't have to do it with real data.
[. ] In the tables uploaded to the system, Personal Data (PII - Personally Identifiable Information) columns such as "Name-Surname, TR ID Number, Phone, E-mail, Full Address, Credit Card Information" are they deleted?
[ ] Is customer data masked with ID numbers (Ex: Customer_001, Customer_002) ? (AI should only see metrics, not IDs).
[ ] When printing advertising text or preparing a case study, are pseudonyms (company X) used instead of real company names?
3. In-Prompt Firewall
When writing a prompt, we sometimes provide too much information to enrich the context.
[ ] While writing the prompt, have you made sure that your company's financial data, merger/acquisition plans or trade secrets that have not yet been disclosed to the public are not included in the command ?
[ ] Are commands like "Summarize this confidential strategy report we wrote about our competitor [Competitor Name]" that reveal internal strategies avoided?
4. Shadow IT and Approved Vehicle Inventory
A new AI tool comes to market every day. Your team may be uploading data to different tools without your knowledge.
[ ] Has an "Approved AI Tools List" been created within the company (Ex: Only ChatGPT Enterprise and Midjourney can be used)?
[ ] Is approval obtained from IT and Legal/Compliance departments before using a new AI plug-in (Chrome extension, Notion AI, etc.)?
[ ] Internal company communications or confidentiality agreements (NDA) not loading in PDF readers or "Chat with PDF" style 3rd party tools, right?
Final Word for Managers: Educate, Don't Ban
If you tell your marketing team, “Using AI is prohibited,” they will continue to do it on their personal phones, hidden from you. The solution is not to ban; The aim is to create a safe "playground" (sandbox) with clearly drawn boundaries.
If your company switches to API-accessible, Enterprise artificial intelligence versions, you can increase your team's productivity by 10 times while minimizing the KVKK risk.
What was the first risk you noticed after sharing this checklist with your team? If you would like to create a strategy about legal compliance and AI integration in your brand's marketing processes, you can contact me via LinkedIn.