Personal data in an in-house AI assistant: Turkey's KVKK
If an in-house AI assistant processes personal data in Turkey, every core obligation of Law No. 6698 on the Protection of Personal Data (KVKK) applies. The Turkish data protection authority’s November 2025 guide on generative AI says so plainly. The company that deploys the assistant is usually the data controller. Each processing activity needs a legal basis, staff and other individuals must be informed, and data sent to a model provider abroad must comply with Article 9 of the Law.
This piece is for anyone building or buying an AI assistant for a company operating in Turkey. Drawing on two guides published by the authority, we map the technical decisions in an assistant project to the relevant provisions of the Law. It is not legal advice: our view is that the legal assessment belongs with specialists, and the technical side should be built to match. The technical structure of such an assistant is covered in what is RAG, and privacy by design in hallucination, data privacy and human approval.
KVKK and the authority, briefly
KVKK is Turkey’s general data protection law. It is enforced by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, “the Authority”), whose decision-making body is the Personal Data Protection Board (“the Board”). Readers who know the GDPR will recognise much of the vocabulary — data controller, data processor, explicit consent, adequacy decision — though the rules are not identical and the details below follow the Turkish texts.
What is the authority’s generative AI guide?
In November 2025 the Authority published the Guide on Generative AI and the Protection of Personal Data (in 15 Questions) — in Turkish, Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi (15 Soruda), publication no. 113. It explains, through fifteen questions, how personal data should be handled under Law No. 6698 across the life cycle of generative AI systems.
For an in-house assistant, the most relevant questions are: identifying the controller and processor (question 7), the general principles (8), the legal basis (9), transfers abroad (10), transparency (11), data subjects’ rights (12) and data security (13).
On transfers abroad, the Authority also publishes a separate Guide on the Transfer of Personal Data Abroad, dated January 2025, to which the generative AI guide refers.
Is the company deploying the assistant the data controller?
In most cases, yes. Under Article 3 of the Law, the data controller is the person who determines the purposes and means of processing; the data processor processes data on the controller’s behalf, under the authority the controller grants.
The guide stresses that roles are determined by each party’s actual control over the processing, and that contract wording alone does not settle the question. Using a human resources example, it explains that a company integrating an existing model into its own work — and deciding which data is uploaded and for what purpose — may be regarded as the data controller.
The guide makes one further point. With “closed-access” models, the deploying organisation may not have access to all the information about how data is processed. When roles are being assessed, what the deployer can see and how much control the provider offers both need to be taken into account.
In practice, the contract with the model provider should show clearly for what purpose the provider processes data, whether it retains it, and whether it uses it for training.
Which general principles shape the assistant directly?
All the principles in Article 4 of the Law apply. Two come up most often in assistant design:
- Being relevant, limited and proportionate to the purpose. The guide describes data minimisation in a generative AI context as keeping the personal data used “limited to what is necessary”. Classifying a request does not require the customer’s national ID number to reach the model.
- Retention only as long as needed. The guide reminds controllers that data with no remaining reason to be kept must be erased, destroyed or anonymised. The assistant’s chat logs are subject to the same rule.
The guide also notes that the principle of being “accurate and, where necessary, up to date” needs particular care with generative AI. If the assistant produces a conclusion about a person, its accuracy falls within the controller’s duty of care.
Which legal basis applies?
Every processing activity must rest on at least one of the conditions in Article 5 of the Law — or, for special categories of personal data, Article 6. The guide underlines three points:
- There is no hierarchy between the conditions. Explicit consent is listed first, but it does not take priority. The first step is to check whether another condition is met.
- Consent is not collected needlessly. If processing can rest on another condition, asking for explicit consent as well would be, in the guide’s words, misleading and an abuse of right.
- Consent to use does not cover development. Explicit consent given to use an AI system does not extend to using the data to develop that system.
If the assistant touches special category data — health, trade union membership, criminal convictions and the like — those documents need a separate assessment before they come into scope. Technically, that means keeping such document groups out of search altogether, or opening them only to authorised roles.
How are staff and other individuals informed?
Article 10 of the Law requires the controller, when collecting data, to tell the individual who the controller is, the purpose of processing, to whom the data may be transferred, the method of collection and legal basis, and their rights under Article 11. The guide notes that this must follow the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, published in the Official Gazette no. 30356 of 10 March 2018.
The guide’s recommendations specific to generative AI include:
- Separate, explicit notice for processing done to use the system and processing done to develop it.
- Renewed notice whenever the purpose of processing changes.
- For systems that interact directly with people, such as chatbots, making it clear to the user that they are talking to a generative AI system.
- Making the privacy notice easy to reach from within the system’s interface.
An in-house assistant involves two groups: the staff who use it, and the people named in the documents it searches — customers, suppliers, job applicants. Whether each group has been properly informed should be checked separately.
What if the model provider is abroad?
Sending personal data to a model run by a provider outside Turkey is a transfer abroad under Article 9 of the Law. The generative AI guide states explicitly that when controllers in Turkey use these systems through providers established abroad, the transfer must comply with Article 9 and with the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, published in the Official Gazette no. 32598 of 10 July 2024.
Article 9 was rewritten by Article 34 of Law No. 7499, published in the Official Gazette no. 32487 of 12 March 2024, and the new version took effect on 1 June 2024. According to the Authority’s transfer guide, the revision was modelled largely on the GDPR. Transfers are now assessed in three tiers:
| Tier | Condition | What it means for an assistant project |
|---|---|---|
| 1. Adequacy decision | A condition under Article 5 or 6, plus a Board adequacy decision for the destination country, sector or organisation | Check the Authority’s website for a decision covering the provider’s country |
| 2. Appropriate safeguards | Without a decision: a processing condition, the individual’s ability to exercise rights and seek remedies in the destination country, and one of the safeguards in Article 9(4) | For private companies, the relevant options are standard contracts and binding corporate rules |
| 3. Occasional transfers | Without a decision or safeguard: one of the cases in Article 9(6), and only occasionally | Not a suitable basis for an assistant that runs continuously |
The appropriate safeguards in Article 9(4) are: agreements between public bodies; binding corporate rules approved by the Board; the standard contract announced by the Board; and a written undertaking authorised by the Board. A standard contract must be notified to the Authority within five working days of signature.
The transfer guide also states that storage in a cloud located abroad, and remote access from abroad, count as transfers when the criteria it sets out are met. So it is not only the model call that matters: check where the logs and the vector database live too.
How do staff exercise their rights in an assistant?
The rights in Article 11 of the Law apply to the assistant as well. The guide accepts that the nature of generative AI can make these rights harder to exercise in practice, but says this does not make them inapplicable.
The right that needs most care in an in-house assistant is in Article 11(1)(g): the right to object to an outcome against the individual that arises from analysis of their data exclusively by automated systems. The guide gives recruitment, credit assessment and insurance as examples. If the assistant scores job applications or produces assessments of staff, a person must take the decision and objections must be capable of genuine review. Technically, that means recording every recommendation with its reasoning and the documents it relied on.
What does data security require?
Article 12 of the Law requires every necessary technical and organisational measure to prevent unlawful processing of and access to personal data, and to keep it safe. Alongside those measures, the guide recommends training staff on the security risks of using generative AI.
In an assistant project, that means:
- Applying access control at the search stage, so that documents a user cannot access never reach the model.
- Setting limits against hidden instructions in outside content the assistant reads.
- Deciding separately who can see the chat logs and how long they are kept.
- A written company rule on what data staff may paste into general-purpose chat tools.
Before you build: technical decisions mapped to KVKK
We recommend filling in the table below with your legal counsel before the build. Each line ties a technical decision to the relevant provision.
| Technical decision | Provision | Question in the guide |
|---|---|---|
| Model provider and contract | Art. 3 (roles) | 7 |
| Which fields go to the model, which are masked | Art. 4 | 8 |
| How long chat logs are kept | Art. 4 | 8 |
| The processing condition for each data group | Arts. 5 and 6 | 9 |
| Country of the provider and of the logs | Art. 9 and the Regulation | 10 |
| Notice in the user interface | Art. 10 and the Communiqué | 11 |
| Human decision and route to object | Art. 11 | 12 |
| Access control, logging, training | Art. 12 | 13 |
Any empty line is a question to settle before the build.
Frequently asked questions
Is the authority’s generative AI guide binding?
The guide is guidance published by the Authority. What binds is Law No. 6698 and the secondary legislation it rests on. Because the guide shows how the Authority applies those provisions to generative AI, it is an important reference when designing a project.
Do we need explicit consent from our staff?
According to the guide, the first step is to check whether processing rests on a condition other than explicit consent. If it does, consent should not be requested as well. Which condition applies should be assessed for each data group, and we recommend doing that with your legal counsel.
Is sending data to a model abroad prohibited?
No, but it must comply with Article 9 of the Law and the Regulation. Without an adequacy decision, the safeguard most relevant to private companies is the standard contract, which must be notified to the Authority within five working days of signature. You can also shrink the scope of the transfer by masking personal data, or by not sending it to the model at all.
Are the assistant’s chat logs personal data?
Yes, if they contain information that identifies a person or makes them identifiable. Who can see the logs, how long they are kept and how they are deleted when that period ends all need deciding separately.
Does this piece replace legal advice?
No. It shows how the guides published by the Authority map onto the technical decisions in an assistant project. Your own situation needs assessment by legal counsel.
If you would like to talk about building a company assistant that handles personal data properly from the start, see our AI systems architecture page or write to us.