Security, Privacy And Compliance

Why This Week Matters

Weeks 2 to 4 pointed you toward use cases, data and vendors. This week asks what can go wrong and how to prevent it. Three kinds of risk matter. Security risk is the exposure of data or systems to people who should not reach them. Privacy risk concerns personal data about customers, staff and other individuals. Compliance risk is the chance of breaking a law, regulation or contract. They overlap, and one careless prompt can touch all three.

A note on scope: this module gives a working overview for business teams, not legal advice. Laws change and details depend on your sector and facts. Use this week to ask better questions of your legal, data protection and security colleagues, and to bring them into projects early. Early involvement is cheaper than late repair.

How Data Leaks Through AI Tools

Most leaks are ordinary. A person pastes a customer list, a contract or source code into a public chat tool to save time. The text leaves the company and may be stored by the provider, sometimes used to improve its models, depending on the service and its settings. Consumer products and business products often have different terms, which is why the account type matters.

Other routes exist. Files uploaded to a tool may be more sensitive than their file names suggest. Plug-ins and connectors may pass data to third parties. An assistant connected to many systems with one broad account can reveal documents to people who should not see them (week 3). Logs of prompts and answers can contain personal data and need protection. Finally, prompt injection is an attack where text hidden in a web page or document tells the model to ignore its instructions or reveal information. Treat any outside content that a model reads as untrusted.

• Pasted text: customer data, contracts, code, financial results.
• Uploads and connectors: files and systems shared with a tool.
• Provider retention: storage and possible training use under the service terms.
• Logs: prompts and answers kept by you or the vendor.
• Prompt injection: hidden instructions in content the model reads.

Shadow AI

Shadow AI means employees using AI tools that the company has not approved or does not know about. It happens because the tools are useful, easy to reach and often free. In most firms it is already present. People are not acting out of bad faith: they want to finish work faster.

A ban alone rarely works, since it pushes use out of sight. A better response has four parts. First, listen: ask staff which tools they use and for what, without punishment. Second, offer approved tools with business terms so the safe option is also the convenient one. Third, publish clear rules on what data may be used where. Fourth, train people, because most mistakes come from not knowing. The aim is to move use from hidden to visible, not to remove it.

KVKK And GDPR In Plain Words

Turkey's Personal Data Protection Law, known as KVKK (Law No. 6698), and the European Union's General Data Protection Regulation (GDPR) share many ideas. Personal data is any information about an identified or identifiable person: a name, an email address, an employee number, a voice recording. Processing is almost anything you do with it, including typing it into an AI tool. The company that decides why and how data is processed is the controller. A vendor processing data on its behalf is a processor, and a written agreement should govern that relationship.

Both laws expect a lawful basis for processing, use of data only for stated purposes, collecting no more than needed, accuracy, limited storage, and security. Individuals have rights to be informed and to access, correct or delete their data, and to object in certain cases. GDPR also limits decisions made only by automated means that significantly affect a person. Sending personal data to another country, which includes sending it to a cloud AI service abroad, has specific rules under both laws. For high-risk processing, GDPR expects a data protection impact assessment, a structured review of risks before you start. Turkish companies serving customers in the EU may fall under both.

The EU AI Act At A High Level

The EU AI Act, Regulation (EU) 2024/1689, is the first broad law that regulates AI by risk level. Unacceptable-risk practices are banned. High-risk systems, which include uses in areas such as hiring and workforce management, access to credit, education and essential services, must meet requirements on risk management, data quality, documentation, human oversight, accuracy and security. Limited-risk systems carry transparency duties, for example telling people that they are talking to an AI system or that content is AI generated. Minimal-risk uses face no specific duties. Separate rules apply to providers of general-purpose AI models.

Roles matter. A provider develops a system and places it on the market. A deployer uses it in its own operations. Most companies in this course are deployers, and they still have duties, such as using high-risk systems as instructed, assigning human oversight, and keeping logs. The Act also asks organizations to promote AI literacy among staff, which links to week 8. It applies in stages over several years and can reach companies outside the EU whose systems are used in the EU, so confirm current dates and scope with counsel. Practically, ask of each use case: which tier might this be?

Keep ownership clear. Assign one named person to maintain the approved tool list, one to handle privacy questions, and one to receive incident reports. Publish their names inside the policy so that staff know where to turn.

Controls That Work

Controls reduce risk without stopping work. Use business accounts with clear terms on retention and training, and single sign-on so you can add and remove users. Apply least privilege (week 3) to every connector. Keep logs, protect them, and decide how long to keep them. Complete a vendor assessment covering location of processing, subprocessors, certifications and incident handling, and sign a data processing agreement where personal data is involved.

Add process controls. Classify use cases by risk before launch, and require a data protection review for any that touch personal data. Keep a person responsible for checking outputs that affect customers, employees or money. Test for prompt injection where a tool reads outside content. Prepare an incident plan: who is told, who decides, and how quickly. Rehearse it once. A policy that nobody has tried is a guess.

Writing An Acceptable-Use Policy

An acceptable-use policy is a short document that tells staff what they may and may not do with AI tools. Keep it to one or two pages in everyday language. Include the approved tools and how to request new ones, the data levels from week 3 and which may enter which tool, tasks that need human review before use, rules on disclosing AI use to customers or colleagues, how to report mistakes or incidents, and who to ask.

Make it usable. Give examples: 'You may paste a public product description. You may not paste a customer complaint with a name or an order number into a tool that is not approved.' Link it to training and revisit it every quarter, because tools change quickly. Finally, make leaders follow it visibly. A policy that leaders ignore teaches staff to ignore it too.

Key Terms

Personal data

Any information about an identified or identifiable person.

Controller and processor

The controller decides why and how data is processed, and the processor handles it on the controller's behalf.

KVKK

Turkey's Personal Data Protection Law, Law No. 6698.

GDPR

The European Union's General Data Protection Regulation on personal data.

EU AI Act

Regulation (EU) 2024/1689, which regulates AI systems by risk level.

Shadow AI

Use of AI tools by staff that the company has not approved or does not know about.

Prompt injection

An attack where hidden text in content a model reads tells it to ignore instructions or reveal data.

Data protection impact assessment

A structured review of privacy risks done before a high-risk processing activity starts.

Acceptable-use policy

A short document that tells staff what they may and may not do with AI tools.

Exercise: Draft Your Acceptable-Use Policy

1. List the AI tools staff in your team actually use, asking at least three colleagues informally and without blame.
2. Mark each tool approved, unknown or not approved, and note whether the account is personal or business.
3. Using the four data levels from week 3, write a table showing which level may enter which tool.
4. Place your top use case in an EU AI Act tier (unacceptable, high, limited, minimal) and write the reason in two sentences. Flag it for review by legal or data protection.
5. Write the policy in one to two pages with approved tools, data rules, review rules, reporting steps and a contact person.
6. Add three examples of allowed and not allowed prompts in plain language.
7. Ask a colleague from legal or security to review the draft and list their top three changes.

Further Reading

• Regulation (EU) 2016/679, General Data Protection Regulation, European Union, Official Journal
• Regulation (EU) 2024/1689, Artificial Intelligence Act, European Union, Official Journal
• Law No. 6698 on the Protection of Personal Data (KVKK), Republic of Turkiye, Official Gazette, with guidance from the Personal Data Protection Authority
• AI Risk Management Framework 1.0, National Institute of Standards and Technology (NIST), 2023
• OWASP Top 10 for Large Language Model Applications, OWASP Foundation