AI and Customer Data: GDPR, US and KVKK Checklist

Which rules apply to you?

A store in one country can still face rules in another when it targets customers there. The European Commission says, for example, that the GDPR can apply to a business outside the EU that offers goods or services to people in the EU. Start by listing the markets you sell to.

European Union and EEA

Main risk: sending customer messages and order data to an AI vendor without understanding its role, retention, security and any transfer outside the EEA.

Under the GDPR, a controller must choose a suitable processor and put the required processing terms in a binding contract. Personal data should be limited to what is necessary.
Transfers outside the EEA may need an approved mechanism, such as the EU standard contractual clauses.
AI transparency: according to the European Commission's FAQ and legal analyses, Article 50 of the AI Act has applied since 2 August 2026, and chatbots and other interactive AI systems must tell people they are dealing with AI. A narrower grace period applies to some marking duties. Check your role and the specific system rather than assuming every internal automation is a customer-facing chatbot.
Breaches: where notification is required, the controller must notify the authority within 72 hours.

Check before launch: what data enters the tool; whether the provider acts only on your instructions; the contract and subprocessors; retention and deletion; access controls; the transfer mechanism; the customer notice; and a route to a person.

United States

Main risk: assuming one privacy rule covers every customer.

The FTC can act against unfair or deceptive practices, including broken privacy promises. It has warned AI companies not to use customer data in ways that contradict their confidentiality commitments.
State laws add separate duties. California's CCPA applies to businesses that meet its conditions and thresholds, so it does not automatically apply to every small shop. Colorado has a different applicability test and its own consumer rights.

Check before launch: whether your published privacy statements match what the AI vendor actually does; whether customer data may be used to train a model; what you collect and keep; who has access; and which state laws apply. The FTC's advice is simple: take stock, keep only what you need, protect it, dispose of it properly and plan for incidents.

Turkey (KVKK)

Main risk: sending customer records to an AI service without mapping the processing and any transfer abroad.

The controller must inform people about matters such as the purposes of processing, recipients, collection method and legal basis, and must take appropriate technical and administrative security measures.
Using a provider abroad raises a cross-border transfer question. The KVKK Authority describes the transfer safeguards, including standard contracts, and says a signed standard contract must be notified to it within five business days.
A qualifying breach must be notified to the Authority without delay and no later than 72 hours after learning of it.

Check before launch: your customer notice; the legal ground for each use; the provider's location and other recipients; any transfer mechanism; access permissions; retention and deletion; and incident handling. The Authority also publishes AI-specific recommendations on personal data.

A rule that works everywhere

Do not send information the tool does not need. You can ask for help with a reply about a damaged product without including the buyer's full address and phone number. See also AI in customer service.

Keep reading

Unsure how to set up AI safely?

I can help you map what data your tools receive and set sensible limits. Reach me through the contact section. For legal advice, consult a qualified professional for your market.

Contact Me

Sources

Rules, numbers and dates change often. This page reflects the sources below as checked on Oct 9, 2026, so confirm the current version before you act.

Privacy

Is It Safe to Use AI With Customer Data?

Category:

Written by:

Tags:

Posted on: