What does running work chats on personal messaging apps mean for KVKK and information security? Data controller duties, security measures and the corporate alternative.
“I’ve set up a group and added everyone.” In many organisations, that’s how work conversations move into personal messaging apps. It’s quick, everyone already has the app, and nobody has to learn anything new. But behind that convenience, something builds up that the organisation often doesn’t notice: customer details, photos of employees’ medical notes, price quotes and internal discussions accumulate on accounts and devices the company doesn’t control.
This article outlines what running work chats on personal messaging apps means under Türkiye’s Personal Data Protection Law No. 6698 (KVKK) and for information security, and where business messaging differs.
Note: this article is general information, not legal advice. For an assessment specific to your organisation, consult a lawyer specialising in data protection.
Why work chats contain personal data
Under KVKK, personal data is any information relating to an identified or identifiable natural person. That is a broad definition, and even routine work chats usually include it:
- Employees’ names, phone numbers and contact details;
- Details of customer or supplier contacts;
- Conversations about leave, sick notes, shifts and performance;
- Shared documents and photos (ID copies, medical notes, signed forms).
Some information, such as health data, is treated separately in the law as special category personal data and is subject to stricter conditions. When an employee posts a photo of a medical note in a personal chat group, that data moves into an environment the organisation has no control over.
The organisation’s duties as data controller
An organisation that processes employee and business data is, in most cases, the data controller under KVKK. Article 12 requires the data controller to take all necessary technical and organisational measures to ensure an appropriate level of security, in order to prevent unlawful processing of and access to personal data and to safeguard it.
When work chats scatter across personal apps, those measures become hard to apply:
- Access control: the organisation can’t determine who can see which conversation. Someone added to a group by mistake may see its entire history.
- Leavers: when an employee leaves, the chats and shared files stay on their personal device and account.
- Retention and disposal: one of the general principles in Article 4 is keeping data only as long as necessary for its purpose, and Article 7 covers erasure, destruction or anonymisation once the grounds for processing no longer apply. Erasing data in an environment you can’t access isn’t realistically possible.
- Data subject rights: Article 11 gives people rights such as learning whether their data is processed and requesting its erasure. Scattered chats make it hard to respond fully.
- Transfers abroad: providers and servers of personal messaging apps are often outside Türkiye, and transferring personal data abroad is subject to the separate conditions set out in Article 9.
In the event of a data breach, the controller must also notify the data subject and the Personal Data Protection Board as soon as possible. Detecting a breach — and its scope — in an environment the organisation never sees is very difficult.
Information security risks
Beyond KVKK, work chats on personal apps put the organisation’s own information at risk:
- Lost company memory: project decisions, promises to customers and shared files stay in personal accounts and leave with the employee.
- Lost devices: on a lost or stolen phone, work conversations may be unprotected, and the organisation can’t intervene in that session.
- Wrong recipient: with personal and work chats in the same app, documents are more likely to be sent to the wrong conversation.
- Outsiders: groups gradually accumulate former employees, suppliers and unknown numbers.
Business vs personal messaging at a glance
| Topic | Personal messaging app | Business messaging |
|---|---|---|
| Account | The employee’s personal phone number | A corporate account the organisation opens and closes |
| Who you chat with | Anyone whose number you have | People in your own organisation |
| When someone leaves | Chats stay with the person | The organisation closes the account |
| Where data lives | Wherever the provider decides | Infrastructure the organisation chooses |
| Work and private life | Mixed in one app | A separate, work-focused channel |
| Link to other work tools | None | Same platform as tasks, portal and notifications |
What to check when moving to business messaging
- Where is the data? Find out which country and infrastructure hosts it.
- How is it encrypted? Ask plainly. Encryption at rest on the server and end-to-end encryption are different things; know which one you’re getting.
- Separation between organisations: in cloud services, make sure each organisation’s data is isolated from the others.
- Account lifecycle: who opens and closes accounts, and what happens to a leaver’s account?
- Deletion requests: how is an employee’s erasure request handled?
- Policy and notice: a tool alone isn’t enough. Set out in an internal policy which conversations belong in which channel, and inform employees.
Make the switch easy rather than forbidden
Trying to shut down work groups on personal apps overnight rarely works; people find a way to keep their habits. The better route is to make the corporate channel easier. Business messaging should be on the employee’s phone, new messages should arrive as push notifications, and it should sit alongside everyday tools such as tasks and announcements. Once that’s in place, moving work chats to the corporate channel becomes a natural choice rather than an obligation.
Managers leading by example is decisive: if the manager writes about work in the corporate channel, the team follows. You should also review, with your legal and information security teams, what data sits in old work groups on personal apps and what to do with it.
With HibritİK Messaging, work chats stay in the company
HibritİK Internal Messaging keeps real-time, one-to-one conversations between colleagues on the same platform as their tasks and projects. Text, images and files can be shared, with read receipts, online status and message search. Per-company data isolation means you only chat with people in your own organisation.
Messages are stored on the server encrypted with AES-256-GCM. To be clear, this is encryption at rest rather than end-to-end encryption. On the security and data protection side, cloud data is hosted in Istanbul, Türkiye, and if you want data to stay on your own servers there is an on-premises option. Backups are encrypted, and users can see and end their active sessions. Organisations open and close accounts; on an employee’s deletion request, the company administrator anonymises the account. HibritİK is developed by Sotech Bilgi Teknolojileri, an ISO 27001 certified company.
These measures support you in meeting your KVKK obligations, but compliance comes from policy, notice and training alongside the tool. We look at HR data specifically in our article on KVKK-compliant HR software. To try it in your own organisation, start your 14-day free trial.