AI and personal data protection in Turkey meet in one rule: if an AI system processes data about an identifiable person in training, prompts or output, Law No. 6698 (KVKK) applies in full. Every AI project must therefore settle its legal basis, notices, data minimisation, transfers abroad, security and the right to object to automated decisions at the outset.
Why AI projects remember data protection too late
AI projects usually start as experiments. One team has a language model summarise customer emails, another transcribes call recordings, and sales connects the quotation archive to a chat assistant. Once the pilot works, scope grows; KVKK comes up just before go-live, or never.
Yet almost all of these projects process personal data. The name and phone number in an email, the customer on a call recording, the candidate in a CV and the contact named in a quotation are all personal data under the law. The problem is not AI but the lack of design around where data goes, how long it stays and who sees it. The answers come from the personal data inventory, the first of the KVKK compliance steps.
Chat tools used through employees' own accounts are even less clear. We covered this "shadow AI" risk and how to write a usage policy in ChatGPT and company data security; this article focuses on the organisation's own AI projects.
AI and personal data protection in Turkey: what the Authority says
KVKK is Türkiye's general data protection law, enforced by the Personal Data Protection Authority, which has published two key texts on AI. The first is its guide on generative AI and the protection of personal data (in 15 questions), published on 24 November 2025, which assesses processing across the generative AI life cycle under Law No. 6698.
The second is its notice of 5 March 2026 on the use of generative AI tools in workplaces. It warns that such tools are often used on individual preference rather than within a defined corporate policy, making them hard to monitor and manage.
Key provisions of the law for AI projects:
- General principles (Article 4): data must be processed lawfully and fairly, for specific, explicit and legitimate purposes, in a way that is relevant, limited and proportionate; it must be accurate and kept up to date where necessary, and retained only as long as needed. A language model inventing facts about a person engages the accuracy principle directly, and prompt logs kept indefinitely engage the retention principle.
- Legal basis (Articles 5 and 6): every processing activity needs a basis; special categories such as health and biometric data face much stricter conditions.
- Notice (Article 10): people must be told the purpose of processing and to whom data is transferred; an AI service provider is one of those recipients.
- Automated decisions (Article 11): individuals can object to an outcome against them that results from their processed data being analysed exclusively by automated systems.
- Security (Article 12): technical and organisational measures must prevent unauthorised access and unlawful processing.
Transfers abroad: the most overlooked issue in cloud AI
Most popular AI services run on servers outside Türkiye, so sending personal data in a prompt often means a transfer abroad. Article 9 of KVKK was amended by Law No. 7499, with the new rules in force since 1 June 2024. The new regime works in tiers: first an adequacy decision; failing that, an appropriate safeguard such as a standard contract; and only where neither is available, a narrow set of exceptions for occasional transfers. We explain the tiers and standard contracts in detail in KVKK cross-border data transfer.
One commonly used safeguard is the standard contract. According to the Authority's announcement on the Standard Contract Notification Module, standard contracts must be notified within five business days of signature. When choosing an AI provider, the contract should state clearly where data is processed, whether it is used to train models and how long it is retained.
The cost of doing nothing
AI use is spreading faster than management tends to realise. According to the Verizon 2026 Data Breach Investigations Report, 45% of employees are now regular AI users on corporate devices (up from 15%), and 67% of users access AI services with non-corporate accounts. In Türkiye, TurkStat's AI statistics for 2025 show the share of enterprises with 10 or more employees using AI rising from 2.7% in 2021 to 7.5% in 2025.
Uncontrolled spread carries a security price:
According to IBM's 2025 report, 13% of organisations reported breaches of AI models or applications, and 97% of those lacked proper AI access controls. (IBM Cost of a Data Breach Report 2025)
In the same report, 63% of breached organisations had no AI governance policy or were still developing one. If an AI incident involves personal data, breach notification within 72 hours applies, a deadline you cannot meet without knowing which data went where.
An eight-step framework for AI and KVKK compliance
These steps apply to any AI project, whether a chat assistant, document analysis, speech analytics or a forecasting model:
- Define the use case and the data. Write down what the system answers, which sources it reads and which categories of personal data enter it. Flag any special category data separately.
- Establish the legal basis. Map each use case to a basis in Article 5 or 6. Rely on explicit consent only where no other basis exists and people can genuinely refuse; we explain the difference in explicit consent vs privacy notice.
- Minimise and, where possible, anonymise. If identities are not needed for training and testing, mask or anonymise them. For summarising and classification, send the model only the fields it needs.
- Decide on hosting and transfers. Decide whether data will be processed in Türkiye or abroad, and whether the provider uses it for training. If it goes abroad, choose the Article 9 safeguard, and if you use a standard contract, schedule its notification to the Authority.
- Tie access to existing permissions. An enterprise assistant must never show a user a document they could not already open. Manage AI access by person and department with single sign-on (SSO) and role-based permissions. Copying company data into public tools can be limited with data loss prevention (DLP) rules.
- Update privacy notices. Add AI processing, transfer recipients and any automated assessment to customer, employee and candidate notices.
- Build human oversight and a route to object. Leave the final say to a person for decisions that could go against someone, such as screening candidates or setting credit or prices. Apply the methods in reducing AI hallucinations to cut wrong outputs.
- Plan retention, logging and review. Set how long prompts, responses and logs are kept in your data retention and disposal policy. Keep an audit trail of who asked what with which data, and review it at least once a year.
How each architecture shifts the risk:
| Approach | Where the data goes | Main KVKK point to watch |
|---|---|---|
| General chat tool on an employee's personal account | Mostly abroad, outside company control | Transfers, missing policy and oversight |
| Enterprise cloud AI service under contract | The provider's contracted region | Standard contract, no training on your data, retention |
| Enterprise assistant connected to company data (RAG) | Infrastructure chosen by the company | Preserving document permissions, log retention |
| Custom-trained model running in-house | The company's own servers | Minimising and anonymising training data |
We explain how enterprise assistants work in RAG for enterprise LLMs, and when it makes sense to train your own model in our guide to custom AI model training.
Special cases: voice, video and customer conversations
Some applications handle more sensitive data. In systems that transcribe and analyse call centre recordings, both the recording and what is said are personal data; we cover this in call centre speech analytics. In video analytics, adding facial recognition to CCTV turns it into biometric processing; the ground rules are in our guide to CCTV recording and KVKK.
For chatbots talking to customers, letting people know they are speaking to AI and offering a handover to a human are the practical form of notice and the right to object. See our article on customer service chatbots for design details. In our own SmartOperator AI customer agent, these points are product settings: a link to your privacy notice appears in the chat window, values typed into form fields and the payment page are never read, the business sets how long conversations are kept, from 7 days to 10 years, and expired conversations are deleted automatically. When SmartOperator cannot find an answer it does not guess; it hands the conversation to your team.
Labelling images, audio or documents that contain personal data for model training is itself a processing activity. We cover masking, outsourcing and cross-border transfer in data labelling for AI.
How we build AI projects with KVKK at Digital Bridge
We treat the legal assessment as part of the architecture, not an afterthought:
- Discovery and needs analysis. We map the use case, data sources and personal data categories with you, and through our data protection compliance consultancy assess legal basis, notices and transfers at the outset.
- Architecture decision. Where data must not leave the organisation, we build an enterprise LLM assistant that runs entirely on your own servers with open-source language models and answers only from documents the person asking is authorised to see.
- Data preparation and training. In custom AI model training projects, we audit and clean the data first, plan masking or removal of fields where identities are not needed, and deliver a model that can run in the cloud, on your own servers or on an edge device.
- Pilot. We run a pilot in one department with limited data and human oversight switched on, reviewing wrong outputs and access logs together.
- Integration. Through AI integration we connect the model to your ERP, CRM or document system, designing the flow so that only the fields needed are passed on.
For everyday email and document work, our own product family Smart360 offers managed AI use. In SmartFiles, AI is a separate permission, like read or write, granted per person or department, and administrators can switch AI off entirely. In SmartMail, AI chat and AI reinterpretation are separate per-mailbox permissions, and each organisation's data is held in its own database.
Next step
Start by listing the AI tools in use today and the data going into them; the list exposes shadow use and compliance gaps. Bring it to us via our contact page and we will pick the priority use case together and carry out the legal and technical assessment. This article is general information, not legal advice; we recommend reviewing your own situation with a legal adviser. For more on security and data protection, see our Cyber Security & Compliance hub and the SME cyber security checklist.