The safest rule for a newsletter team is also the simplest: do not paste anything into an AI tool that identifies a cast member, a volunteer, an interviewee, a ticket buyer or a subscriber, and strip or replace identifying detail before you ask the tool for help. Turkey's data protection authority, KVKK, announced a guide on generative AI and personal data on 24 November 2025, and its pages on data security and on transfers abroad set out duties that matter to anyone feeding member material into a tool. If you write the newsletter of a community theatre group, you handle audition notes, rehearsal schedules, volunteer lists and ticket buyers' emails every week, so the habit has to be shared and written down. This is not legal advice.
Copyright questions are outside this topic, and so is any statement about penalties.
Where personal data hides in a newsletter editor's workday
Personal data does not arrive labelled. It sits in the transcript of an interview, in the email thread a venue forwards, in the spreadsheet of volunteers and in the comments that a director leaves on a draft. An editor who pastes a thread into a chat window to get a summary has handed the names, addresses and opinions in it to a service provider.
Deliberate and accidental pastes
Some pastes are deliberate: "summarise this email." Others are accidental: a screenshot with a visible inbox, a document whose header carries an author's name, a quoted reply chain five messages deep. Practical suggestion: before pasting, scan the text for names, addresses, phone numbers and identification numbers, and remove them.
Whose data is it?
Cast members, crew, volunteers, ticket buyers, interviewees, the venue's staff and newsletter subscribers all have data that could end up in a prompt. Each has a different relationship with the group and different expectations of how their details are handled.
What KVKK's generative AI guide covers
The KVKK announcement page (Opens in a new tab) says the authority published "Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi (15 Soruda)", a guide in fifteen questions, on 24 November 2025. According to the announcement, the guide was prepared to assess the effect of generative AI on personal data protection, to encourage respect for individual privacy and to guide actors who hold data controller status.
Topics the announcement lists
- The content generation process, its life cycle, uses and the risks that use can create.
- An assessment of personal data processing through these systems under Law No. 6698.
- Processing activities across the data life cycle.
- Points individuals should consider when using generative AI in daily life.
- Measures parents can take for children.
For the questions and answers themselves, open the PDF that the announcement links to.
Security duties and the people who process on your behalf
KVKK's data security obligations page (Opens in a new tab) cites Article 12 of the Law and states that the data controller must take all necessary technical and administrative measures to prevent unlawful processing of personal data, to prevent unlawful access to it and to ensure that it is kept safe. The measures must suit each controller's structure, activities and risks.
Joint responsibility
The page says that where a controller has another person process data on its behalf, it is jointly responsible with that person for taking the measures. Processors have their own duty to take measures. The page's example is an accounting firm keeping a company's records. The page does not address AI tool providers specifically, so whether a provider is a processor in your case depends on the contract and on how the service works. That assessment is made by the person in your group who holds the data controller role.
Audit, confidentiality and notification
The page also states that the controller must carry out or commission checks within its organisation, that controllers and processors may not disclose data they learn during processing contrary to the Law or use it beyond its purpose, and that when processed data is obtained unlawfully by others, the controller must notify the person concerned and the Board as soon as possible.
Turning duties into questions
Practical suggestion: convert these duties into questions to ask about any tool. What data does it receive? Who can see it? Where are records kept? Who else does it go to? If you cannot answer, do not use the tool with member material.
Transfers abroad and picking a tool
Practical suggestion: check in the provider's documentation where a tool's servers are. KVKK's transfers abroad page (Opens in a new tab) describes a tiered regime introduced by Law No. 7499 and in force since 1 June 2024. A transfer rests first on an adequacy decision, failing that on one of the listed appropriate safeguards, and failing that on a narrow set of exceptional cases.
| Tier | What the page describes |
|---|---|
| Adequacy decision | The Board may declare a country, sector or international organisation adequate, and reviews such decisions every four years. The page states that no such determination had yet been made |
| Appropriate safeguards | An agreement between public bodies with Board permission, binding corporate rules approved by the Board, standard contracts with notification to the Board, or a written undertaking with Board approval |
| Exceptional cases | Listed exhaustively, interpreted narrowly and limited to occasional, non-regular transfers |
The Board's position can change, so check the current page before relying on this table.
The exceptions the page lists
Among the exceptional cases the page lists explicit consent given after being informed of the risks, performance of a contract, public interest, establishing or defending a right, and protecting life or bodily integrity. Because the page ties them to occasional transfers, routine use of an AI tool by a theatre group's newsletter team is not something to build on these exceptions.
Questions for choosing a tool
- Does the provider say where data is processed?
- Does the contract state whether inputs are stored or used for other purposes?
- Does a group account offer different terms from a free personal one?
- Who can view the history of inputs, and can it be deleted?
The person who holds the data controller role in the group should assess the answers. A volunteer who simply picks a tool should not.
Personal accounts and shared accounts
An account a volunteer opens with a private email address sits where the group cannot see it. When that volunteer leaves, the history of inputs leaves with them. Practical suggestion: open tools under a group account, name an administrator and add closing access to the list of steps for a departing volunteer. What each kind of account means for data processing is set out in the contract and cannot be guessed.
Plugins and integrations
Writing plugins, browser extensions and email assistants with AI features are channels through which data can leave unnoticed. They belong on the approved list too. A plugin can send whatever text is open to its provider. Before installing one, ask what data it sends, when and where, and record the answer.
A practical banned-data list
Practical suggestion: write the group's rule as three short lists, "never enter", "enter only after anonymising" and "free to use".
Never enter
- Identification numbers and images of identity documents.
- Bank, card and payment details.
- Passwords, keys and access credentials.
- Health, biometric and similar sensitive details about a person.
- Contact lists, subscriber lists, volunteer lists or ticket buyer lists.
Enter only after anonymising
- Interview transcripts and notes.
- Audition and rehearsal notes that mention individuals.
- Director feedback that names people.
Free to use
- Published newsletters and public web pages.
- Your own drafts that contain no personal detail.
- General knowledge about staging and theatre terms.
A placeholder table
Defining placeholders at the start keeps a text consistent if it must go into a tool more than once. Practical suggestion: keep a mapping table, but store it outside the tool in a place with restricted access.
| Real item | Placeholder | Note |
|---|---|---|
| Partner venue | Venue A | Generalise the town and size too |
| Cast member | Performer B | Generalise a unique role |
| Interviewee | Interviewee C | Remove the street if it points to one person |
| Date | Early in the season | When the exact date is not needed |
Restoring names afterwards
When you replace placeholders in the tool's output with real names, do it in your own environment and do not feed the result back into the tool. Check that placeholders were not swapped. If "Performer B" gets another person's name, the mistake goes straight to publication.
How to anonymise a text before pasting
- Mark names, email addresses, telephone numbers and ID numbers.
- Generalise details that point to a person indirectly: a unique role, a small street, a rare event.
- Use fixed placeholders such as "Performer A" and "Interviewee B".
- After the tool responds, check that placeholders have not been mixed up before you restore real names offline.
- Note that the original text was not given to the tool.
Where anonymising stops working
If the text still lets readers work out who is meant, it is not anonymous. In a small group, "the only prompter in the neighbourhood" identifies a person without naming them. Remove or generalise such details.
Writing the group's shared rule
An unwritten rule fades as volunteers come and go. A one-page document gives new people a starting point and gives the group something to consult after an incident. Keep it short, because long documents go unread.
What the page answers
Practical suggestion: the page should answer five questions. Which tools may be used? Which classes of data never go in? How is a text anonymised? Whom do you tell about a slip? Who reviews the document, and when? Put a date and version number at the top.
Who does what
- Writer: applies the rule and asks when unsure.
- Editor or lead: checks the record of inputs before an issue goes out.
- The person who holds the data controller role: assesses tools and decides on incidents.
A new volunteer's first week
Give a newcomer the rule page, the approved tool list and two or three realistic examples. One might be an anonymised interview excerpt, another a ticket buyer list that must never go in. Seeing the rule applied to real material helps more than reading it once.
Partners, members and what you may share
Material that members, sponsors or the venue hand over does not belong to the editor. A rehearsal schedule, a contact list or a cast biography was given for a purpose, and pasting it into a tool is a further use. The security page states that controllers and processors may not use data beyond the purpose of processing. That principle is a good reason to ask first.
Ask before you use a tool on someone else's material
Practical suggestion: agree with each member or partner, in writing, whether AI tools may be used on their material and which tools. A short clause in the group's volunteer guidelines is enough. If the person says no, the answer is no, and the record should show that the work was done by hand.
Handovers inside the group
When one volunteer passes material to another, the same rule travels with it. State in the handover which classes of data the material contains and which tools are permitted.
Accounts, approved tools and records
A volunteer who uses a personal account on a free plan with member material leaves the group unable to see where that material went. A shared rule avoids the problem.
Approved tool list
- Tools are listed in writing.
- Each entry states its purpose and the class of data it may receive.
- Tools outside the list receive no personal data.
- The list is revised after assessment by the person who holds the data controller role.
Usage records
Keep a short record of which issue used which tool and what class of input it received. If an incident occurs, the record shows what went where.
When a paste goes wrong
Everyone pastes the wrong thing eventually. Reporting it quickly beats hiding it. The data security page describes notification when processed data is obtained unlawfully by others. Whether a mistaken paste falls under that is for the person who holds the data controller role to judge.
First steps
- Record what was entered, into which tool and when.
- Delete the input from the account if the tool allows, though KVKK's data security page has no statement on how deletion works at the provider.
- Tell the person who holds the data controller role at once.
- Do not make any external notification yourself.
Risks in the output
Risk does not stop at the input. A tool's output can contain names that resemble real people, quotes attributed to the wrong person or wrong claims about a member. These need checking before publication.
Profiles and attributed statements
A profile that names a person, quotes them or describes their work must match what that person said and approved. Never publish a quotation from a tool's output without matching it to the recording or the transcript. For the checking method, see AI-written articles and human editing.
Storing drafts
A draft that contains personal detail belongs in a restricted space. The channel where the draft is shared should match how sensitive the draft is.
Which class of data is more serious?
Not every slip weighs the same. Practical suggestion: state the data class in the first message to the person who holds the data controller role. A slip involving identification, payment or health detail needs a different pace from one involving a volunteer's name. Classifying is your job.
Learning from the record
After an incident, review the record with a few questions. At what stage did the slip happen? Could the tool list or the rule page have prevented it? Does the rule page need a new line? Each incident then becomes a small correction to the process.
When in doubt, do not enter
If you are unsure what class a text belongs to, the default is not to enter it. That puts the risk on the safe side at the moment of uncertainty. Asking costs minutes, while a wrong paste costs an unknown amount.
Decision rule: may this text go into the tool?
| Situation | Decision |
|---|---|
| The text is a public document | It may go in |
| The text has no identifying detail and nothing points to a person | It may go in |
| The text has names or contact details that the task does not need | Clean it, then enter it |
| The text has identification, payment or health detail | Do not enter it |
| The tool is not on the approved list | Do not enter personal data |
| You cannot tell what the text contains | Ask the person who holds the data controller role first |
Worked example: a community theatre group's newsletter
Example scenario: the newsletter team of a community theatre group is preparing a profile of the set builder for the autumn issue. The editor has an audio transcript of the interview, a forwarded email chain with the venue and a list of volunteers to approach for quotes.
What the newsletter team does
- The editor decides what the task needs: the set builder's story and the workshop's method.
- Names, contact details and the volunteer list are left out. The set builder becomes "Interviewee A".
- Only the cleaned excerpt goes into a tool on the approved list.
- The draft is checked against the full transcript and the set builder approves the final text and any quotes.
- The record notes the tool, the purpose and the fact that the input was anonymised.
The interviewee's approval of the published text is a separate step from the decision about the tool. For the review of AI-assisted drafts, the editor review checklist applies.
Working with guest writers and the poster designer
A theatre group brings in guest writers, photographers or a poster designer. They receive the same rule along with the material. Practical suggestion: add the tool rule and the banned classes of data to the brief, and ask which tools the outside person plans to use. The data security page states that a controller is jointly responsible with those who process data on its behalf, which is one more reason to ask.
Build the habit with short drills
A rule is read once and practised many times. In a monthly meeting, take one real task and ask the group whether the text may go into a tool. Unclear cases teach best.
The first question for any task
Before drafting, ask whether you truly need personal detail to do the job. Many tasks need only the story, the dates and the result. If personal detail is not needed, do not collect it.
A short answer for members who ask
Members may ask whether their material is processed in AI tools. A prepared answer spares the newsletter team from being caught unprepared. Practical suggestion: the answer summarises the rule page. It says which classes of data never go in, how anonymising is done and that an approved tool list exists. Agree it in advance with the person who holds the data controller role, and promise nothing that conflicts with your privacy notice.
Misreadings
"I removed the name, so it is fine"
Other details can still point to a person. Anonymising means reading the whole text.
"A paid plan solves everything"
A plan does not by itself answer where data is processed or what role the provider plays. Those answers are in the contract.
"A transfer abroad only means sending a file"
The KVKK page treats transfer abroad as a tiered regime. Where a tool's servers sit is part of that assessment.
"The guide answers every practical question"
The announcement lists the guide's topics. It does not say that the guide gives a detailed rulebook for daily newsletter work.
Pre-use checklist
- The tool is on the approved list.
- The input has no names, contact details, identification, payment or health detail.
- Indirect identifiers were generalised.
- Approval for naming people or quoting them was obtained separately.
- The output was checked against the original sources.
- The record shows tool, purpose and data class.
- The person to notify in an incident is known.
For measurement and consent on websites, the cookie consent, privacy and measurement loss guide covers a related discipline. The wider framework for AI-assisted writing is in AI-written articles and human editing.
A six-monthly review
Practical suggestion: every six months, review the rule page, the tool list and the records.
- Confirm that every listed tool is still in use and that its terms have not changed.
- Look in the records for any tool that is not on the list.
- Ask whether the number and kind of incidents call for a change to the rule.
- Check the current versions of the KVKK pages.
The outcome is a new dated version of the rule. Archive the old version, because after an incident someone may ask which rule applied on that date.
Frequently Asked Questions
May I put member data into an AI tool?
Entering nothing that identifies a person is the safest course. If the task needs the data, anonymise it first and use a tool on your approved list.
What is the KVKK generative AI guide?
On 24 November 2025 KVKK announced "Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi (15 Soruda)". The announcement says it covers risks, assessment under Law No. 6698 and the data life cycle.
Is an AI provider a processor?
KVKK's data security page says a controller is jointly responsible with those who process data on its behalf. A provider's role depends on the contract and the service. This is not legal advice.
What does a foreign server mean?
KVKK's page on transfers abroad describes a tiered regime of adequacy decision, appropriate safeguards and exceptional cases. A tool's server location enters that assessment.
Is anonymising enough?
Not if the text still lets readers work out who is meant. Generalise the other details too.
What if I pasted something by mistake?
Do not hide it. Record what went in, and tell the person who holds the data controller role at once. The decision about external notification is theirs.
Conclusion
For a community theatre group's newsletter the rule is to put only public or anonymised material into tools, to use an approved list, to record what went where and to report slips quickly. KVKK's announcement, data security and transfers abroad pages frame the discipline. This is not legal advice.
If you would like an editor-supervised workflow for your content, the content writing service page lists the options.
Post a comment
Please log in to leave a comment. Login