Generative artificial intelligence tools have rapidly entered ordinary corporate life. Employees use ChatGPT and similar AI systems to summarise contracts, draft emails, analyse Excel files, translate reports, review customer complaints, prepare presentations and even examine internal legal documents.

The practical problem is that the same employee who saves thirty minutes by uploading a company document may also expose the company to significant legal risk.

Consider a simple example:

A sales employee uploads an Excel file containing customer names, telephone numbers, purchase histories and pricing information to a personal ChatGPT account and asks:

“Analyse these customers and tell me which ones we should contact first.”

Or an HR employee uploads employment agreements to obtain a summary. A lawyer working inside the company uploads a pending litigation file. A finance employee uploads a spreadsheet containing customer bank information. A manager copies confidential pricing information into an AI prompt.

From a Turkish law perspective, this seemingly ordinary act may simultaneously trigger personal data protection, cross-border data transfer, contractual confidentiality, trade secret and employment law issues.

The most important question therefore is:

If an employee uploads company documents to ChatGPT without management authorisation, can the company itself still be held liable?

In many circumstances, the answer is yes.

However, company liability is not necessarily automatic. The decisive question is whether the company had established and actually implemented reasonable organisational and technical safeguards capable of preventing unauthorised AI use.

1. Uploading a Document to ChatGPT Is Not Merely “Using Software”

Companies should avoid treating generative AI tools like ordinary word-processing programs.

When an employee uploads a document to an external AI service, several legally relevant events may occur.

The information may:

• be transmitted to an external service provider;
• be stored or temporarily retained on external infrastructure;
• contain personal data belonging to customers, employees or third parties;
• contain special categories of personal data;
• constitute confidential information or trade secrets;
• be processed outside Türkiye;
• become subject to the contractual and technical conditions of the relevant AI provider.

Consequently, the legal analysis must start with the data contained in the prompt or uploaded document, rather than with the technology itself.

An innocent-looking PDF may contain dozens of categories of personal data.

A customer contract may include names, addresses, telephone numbers, identification information, financial data and signatures.

An HR document may contain salary information, disciplinary records or health information.

A litigation file may contain highly sensitive personal information concerning several individuals.

Uploading such information to a generative AI platform may therefore constitute a new personal data processing operation under Law No. 6698 on the Protection of Personal Data (“KVKK”).

The Turkish Personal Data Protection Authority has expressly emphasised that although the KVKK was not drafted specifically for artificial intelligence systems, the general data protection framework applies to personal data processing conducted through AI technologies.

2. Who Is Responsible Under the KVKK: The Employee or the Company?

This is where companies frequently make a serious mistake.

After discovering an unauthorised upload, management may argue:

“The employee did this without our permission, so the company cannot be responsible.”

That argument may not be sufficient.

Under Article 12 of the KVKK, the data controller must take all necessary technical and administrative measures to:

• prevent unlawful processing of personal data;
• prevent unlawful access to personal data; and
• ensure the secure storage of personal data.

The data controller must also conduct or have conducted the necessary audits within its organisation regarding compliance with the KVKK.

For corporate processing activities, the relevant company will generally be the data controller where it determines the purposes and means of processing.

Employees processing customer or employee data as part of their duties normally operate within the organisational structure of the company.

Therefore, an employee’s mistake does not automatically remove the company’s responsibilities as data controller.

3. A KVKK Decision That Is Extremely Relevant to ChatGPT Uploads

One of the most important Turkish Personal Data Protection Board decisions for understanding this issue predates the generative AI boom but is remarkably similar to today’s ChatGPT problem.

In Personal Data Protection Board Decision No. 2021/154, an employee of an insurance company transferred customer information from his corporate email account to his personal Gmail address.

The incident affected information relating to 544 customers.

The Board did not simply accept the argument that the employee had independently caused the breach.

Instead, it examined what the company had done to prevent such conduct.

The Board found deficiencies concerning:

• the configuration of the company’s Data Loss Prevention (“DLP”) system;
• monitoring of employee activity;
• control of data transfers outside the organisation; and
• employee data protection training.

The company was ultimately sanctioned for failing to take sufficient technical and administrative measures under Article 12 of the KVKK.

This decision is highly relevant to corporate use of generative AI.

Replace “personal Gmail account” with “personal ChatGPT account” and the compliance issue becomes immediately visible.

A company may therefore face questions such as:

Why could the employee upload the database?

Was access to generative AI platforms restricted?

Was there an AI policy?

Had employees been trained not to upload personal data?

Were confidential documents technically protected?

Did the company use DLP or equivalent controls?

Was employee AI usage monitored?

These questions may become more important than the employee’s statement that the upload was accidental.

4. “We Did Not Know About It” May Not Be a Complete Defence

Another Board decision is also instructive.

In Decision No. 2022/1072, a company argued that certain unlawful emails had been sent by an employee without the company’s knowledge or approval.

Nevertheless, the Board emphasised the company’s obligations under Article 12 of the KVKK, including its obligation to take technical and administrative precautions and conduct appropriate internal audits.

The company was ultimately subject to an administrative fine.

Accordingly, saying:

“Management never authorised ChatGPT.”

is not necessarily equivalent to saying:

“The company fulfilled its KVKK obligations.”

A regulator could reasonably ask what the company had done to prevent foreseeable unauthorised AI use.

5. The Emerging Standard: Companies Need an Internal AI Usage Policy

The KVKK Authority’s Personal Data Security Guide is particularly significant in this context.

The Authority recommends that organisations establish security policies and procedures, train employees, impose confidentiality obligations and maintain disciplinary mechanisms for violations.

The guide specifically states that security rules should follow a restrictive approach rather than an “everything is permitted” model and emphasises confidentiality agreements, training and disciplinary processes.

Applied to generative AI, this means that companies should no longer rely on informal instructions such as:

“Please be careful when using ChatGPT.”

A written Artificial Intelligence Acceptable Use Policy should normally exist.

At minimum, it should specify:

• which AI systems employees may use;
• whether personal accounts are prohibited;
• what categories of information may never be uploaded;
• whether customer information may be processed;
• whether source code may be uploaded;
• whether legal files may be uploaded;
• whether health, biometric or financial data may be uploaded;
• whether confidential contracts may be uploaded;
• whether information must first be anonymised;
• which corporate AI accounts are authorised;
• who must approve exceptions;
• how AI-related incidents must be reported.

A company that cannot answer these questions may have difficulty demonstrating that it has taken adequate administrative measures.

6. Personal ChatGPT Accounts Create a Particularly Important Risk

Companies should distinguish between employees independently using consumer AI products and an organisation deliberately procuring an enterprise AI solution.

OpenAI currently states that content submitted through individual services such as ChatGPT may be used to improve models depending on the user’s settings, and users may opt out of model training.

By contrast, OpenAI states that inputs and outputs from its business offerings, including ChatGPT Business, ChatGPT Enterprise and the API, are not used for model training by default.

This distinction is important from a corporate governance perspective.

But it should not be misunderstood.

“The AI provider does not train on our data” does not automatically mean “the processing is KVKK-compliant.”

Even where information is not used for model training, it may still be transmitted to and processed by an external service provider.

The company must therefore separately analyse:

• the legal basis for processing;
• the recipient;
• retention;
• security;
• sub-processors;
• international data transfers; and
• contractual safeguards.

Turning model training off is therefore a security and privacy measure, not a complete legal solution.

7. Does Uploading Data to ChatGPT Constitute a Transfer Abroad?

Potentially, yes.

Where personal data is transmitted from Türkiye to infrastructure, a service provider or another recipient located outside Türkiye, the international transfer provisions of Article 9 of the KVKK must be examined.

Article 9 was substantially amended in 2024.

Under the current system, international transfers may generally rely on:

1. an adequacy decision;
2. appropriate safeguards where statutory conditions are satisfied; or
3. limited exceptional transfer grounds where neither of the first two mechanisms is available.

Standard contracts are among the mechanisms recognised as appropriate safeguards.

Where a KVKK standard contract is used, the signed standard contract must generally be notified to the Personal Data Protection Authority within five business days.

Therefore, before permitting employees to insert personal data into a foreign AI platform, companies should map:

Who receives the data?

Where is the data processed?

What contractual transfer mechanism applies?

Does the processing involve subprocessors?

Which KVKK Article 9 mechanism supports the transfer?

Using an AI system without answering these questions creates a potentially significant compliance gap.

8. Special Categories of Personal Data Make the Situation Much More Serious

The risk increases substantially if employees upload documents containing special categories of personal data.

Examples may include information relating to:

• health;
• biometric characteristics;
• genetic information;
• criminal convictions;
• trade union membership;
• religion;
• philosophical belief;
• political opinion;
• sexual life.

Uploading a patient’s medical report to ChatGPT to obtain a summary is therefore fundamentally different from asking ChatGPT to rewrite a generic marketing sentence.

The company must separately analyse Article 6 of the KVKK and applicable additional security requirements.

For organisations operating in healthcare, insurance, HR, legal services or financial services, unrestricted employee AI usage may therefore be especially dangerous.

9. The Problem Is Not Limited to Personal Data: Trade Secrets May Be Even More Valuable

Not every confidential corporate document contains personal data.

A company may upload:

• pricing models;
• customer acquisition strategies;
• unpublished product specifications;
• source code;
• business plans;
• tender documents;
• acquisition targets;
• negotiation strategies;
• formulas;
• internal financial projections;
• supplier discounts.

These may constitute commercially confidential information or trade secrets.

The fact that the document contains no personal data does not make uploading it legally harmless.

10. The Employee’s Duty of Confidentiality Under Turkish Employment Law

Article 396 of the Turkish Code of Obligations provides that employees must act diligently and loyally in protecting the legitimate interests of their employer.

Importantly, employees may not use or disclose information learned during employment, particularly production and business secrets, for their own benefit or disclose such information to others.

The obligation may continue even after termination where necessary to protect the employer’s legitimate interests.

Uploading confidential company information to an unauthorised generative AI platform may therefore constitute a violation of the employee’s statutory duty of loyalty and confidentiality.

11. Can the Employee Be Dismissed for Uploading Confidential Documents to ChatGPT?

Potentially, yes.

Article 25/II(e) of the Turkish Labour Law expressly recognises conduct contrary to honesty and loyalty—including revealing an employer’s professional secrets—as a possible ground for termination for just cause.

However, employers should avoid adopting an automatic rule that:

“Any ChatGPT upload = immediate termination.”

The legal assessment should consider:

• the type of information uploaded;
• whether personal data was involved;
• the confidentiality level;
• whether the employee acted intentionally;
• whether the information was anonymised;
• whether an internal AI policy existed;
• whether the employee had been trained;
• whether similar AI use had previously been tolerated;
• the potential or actual damage;
• the employee’s position;
• whether the disclosure was reversible;
• whether a less severe disciplinary measure would be appropriate.

Evidence is also critical.

Logs, corporate device records, DLP alerts and audit trails should be preserved before disciplinary action is taken.

Interestingly, the KVKK Board has also recognised that employers may have a legitimate interest in appropriately monitoring corporate email systems in order to detect confidentiality, security and loyalty violations, provided that monitoring remains proportionate and limited to its legitimate purpose.

A properly drafted employee monitoring notice and AI policy can therefore become important parts of the company’s defence.

12. Trade Secret Disclosure May Also Create Criminal Exposure

Certain disclosures may go beyond employment law.

Article 239 of the Turkish Criminal Code regulates the disclosure of commercial secrets, banking secrets and customer secrets.

A person who, because of his or her position, duty, profession or occupation, becomes aware of such information and unlawfully discloses it to unauthorised persons may, where the statutory elements of the offence are satisfied, face criminal liability.

Where personal data is unlawfully transferred or obtained, provisions of the Turkish Criminal Code concerning unlawful disclosure or acquisition of personal data may also become relevant.

Criminal liability will naturally depend on the facts of each case, including intent, the nature of the information and the manner of disclosure.

Nevertheless, employees should understand that uploading company databases into unauthorised systems may be considerably more serious than simply violating an IT policy.

13. Turkish Commercial Code and Unfair Competition

Trade secret disclosure may also have consequences under unfair competition law.

Article 55 of the Turkish Commercial Code recognises unlawful disclosure or exploitation of production and business secrets as conduct contrary to honest commercial practices.

Depending on the circumstances, the injured company may therefore seek remedies against parties unlawfully acquiring, exploiting or disclosing commercially sensitive information.

Potential remedies may include claims aimed at:

• determining the unlawfulness;
• preventing ongoing conduct;
• eliminating its consequences;
• damages;
• recovery of economic benefits under applicable conditions.

This becomes particularly relevant where an employee uploads confidential material and the information subsequently reaches a competitor or another commercial party.

14. The Company May Also Be Liable to Its Own Client

Another frequently overlooked issue is contractual liability.

Assume that a consultancy company receives confidential financial data from Client A.

An employee of the consultancy company then uploads that information to an unauthorised AI platform.

Even if the employee violated internal instructions, the consultancy company may still face contractual claims from its client.

Under Article 116 of the Turkish Code of Obligations, a debtor using employees or other auxiliary persons in performing its obligations may be responsible for damage caused by those persons while performing the relevant activities.

Therefore, a company cannot necessarily tell its customer:

“Our employee broke the rules, so this is not our responsibility.”

The client may rely on:

• confidentiality clauses;
• data processing obligations;
• professional obligations;
• contractual security obligations;
• general contractual liability principles.

For technology companies, law firms, accountants, healthcare providers and consultants, this contractual dimension can sometimes create greater financial exposure than the administrative KVKK fine itself.

15. What Should Companies Do Before Allowing ChatGPT?

Companies should approach corporate AI implementation as a compliance project rather than merely an IT purchase.

A defensible governance framework should typically include the following.

1. Create an AI Inventory

Identify which AI tools employees are already using.

“Shadow AI”—employees using AI without informing IT or management—is currently one of the largest practical risks.

2. Classify Corporate Information

Information should be classified, for example, as:

Public / Internal / Confidential / Strictly Confidential

Employees should immediately understand which categories may never be inserted into external AI systems.

3. Adopt an AI Acceptable Use Policy

The policy should clearly define authorised and prohibited usage.

4. Update Employment Documentation

Employment agreements, confidentiality agreements and internal regulations should expressly address:

AI tools, external cloud services, generative AI and unauthorised uploading of company information.

Older confidentiality clauses drafted before generative AI became common may be too generic.

5. Provide Mandatory AI and KVKK Training

Training should include practical examples.

For example:

Allowed:
“Rewrite this generic customer email in professional English.”

Prohibited:
“Here is our customer database. Analyse which customer is most profitable.”

6. Implement Technical Controls

Depending on the company’s risk profile, this may include:

• DLP systems;
• blocking unauthorised AI domains;
• browser controls;
• endpoint monitoring;
• access restrictions;
• file classification;
• logging;
• corporate AI gateways;
• automatic anonymisation.

The KVKK Board’s 2021/154 decision demonstrates why merely having a DLP system is insufficient if it is incorrectly configured or not actively monitored.

7. Procure an Appropriate Corporate AI Environment

Companies should evaluate whether consumer accounts are appropriate at all.

Business or enterprise solutions may offer stronger contractual, administrative, authentication, retention and governance controls.

8. Conduct a KVKK Transfer Assessment

Where data may leave Türkiye, Article 9 must be analysed before deployment.

9. Establish an AI Incident Response Procedure

Employees should know exactly whom to contact if confidential data is accidentally uploaded.

16. What Should the Company Do If an Employee Has Already Uploaded a Confidential File?

Speed matters.

The company should immediately:

1. identify exactly what was uploaded;
2. determine whose personal data was affected;
3. identify whether special categories of personal data were involved;
4. determine which AI account and service were used;
5. preserve relevant logs and evidence;
6. investigate whether the conversation or file can be deleted;
7. determine whether the provider retains additional copies;
8. assess whether an international transfer occurred;
9. assess contractual notification obligations;
10. evaluate whether the incident constitutes a personal data breach.

Under Turkish practice, where a personal data breach requiring notification has occurred, the Personal Data Protection Board interprets “as soon as possible” as generally requiring notification to the Authority within 72 hours after the data controller learns of the breach.

The company should therefore avoid spending several days debating internally whether the employee should be disciplined before the KVKK incident assessment has been completed.

17. The Most Dangerous Corporate Position: “We Have No AI Policy Because We Never Authorised AI”

This approach is becoming increasingly difficult to defend.

If employees are realistically able to access ChatGPT, Gemini, Claude or similar tools from their computers or phones, generative AI usage is a foreseeable organisational risk.

A company that ignores this risk may later struggle to argue that it took all necessary administrative and technical measures.

The better legal approach is not necessarily to prohibit AI entirely.

Instead, companies should establish a controlled environment in which employees understand:

what AI they may use, what information they may submit and what they must never upload.

Conclusion: The Employee Clicks “Upload”, but the Legal Risk May Remain with the Company

When an employee uploads a corporate document to ChatGPT, the legal issue does not end with the employee.

The incident may simultaneously involve:

KVKK compliance, international data transfers, data breach obligations, employment duties, contractual liability, trade secrets, unfair competition and even criminal law.

Most importantly, Turkish data protection practice shows that companies cannot always escape liability by arguing that an employee acted independently or without authorisation.

Personal Data Protection Board Decision No. 2021/154 is particularly instructive: an employee transferred hundreds of customer records to a personal email account, but the Board focused heavily on the employer’s inadequate technical controls, monitoring and employee training.

The practical lesson for companies is therefore simple:

Do not wait for the first confidential document to be uploaded before regulating generative AI.

A company using AI—or merely employing people who can access AI—should establish a written AI usage policy, confidentiality framework, employee training programme, technical controls, data classification system and incident response procedure.

In the age of generative AI, corporate confidentiality is no longer protected merely by marking a document “CONFIDENTIAL.”

Companies must also control where employees can paste it.