# KVKK × AI — DATA-GOVERNANCE CHECKLIST

Document code: TR-KVKK-AI-01 · Version 1.0 · Classification: Internal
Organisation: [NAME]   Prepared by: [NAME/ROLE]   Date: ……/……/20……
Reference: KVKK (Law 6698); prospective AI Act / EU AI Act alignment

SECTION 1 — AI SYSTEM & DATA MAP
System: [NAME]   Purpose: [……]
Training data source(s): [……]   Personal data? [ ] Y [ ] N
Inference inputs: [……]   Profiling produced? [ ] Y [ ] N

SECTION 2 — LAWFUL BASIS  (Art. 5 / Art. 6)
[ ] Basis identified for TRAINING: ……  (note: "public" is not a basis)
[ ] Basis identified for INFERENCE: ……
[ ] Special categories present? [ ] Y [ ] N → explicit consent / Art. 6 basis: ……

SECTION 3 — TRANSPARENCY & RIGHTS  (Art. 10 / Art. 11)
[ ] Privacy notice describes the AI processing and any profiling
[ ] Access / correction / deletion cover inputs AND outputs
[ ] Channel for data-subject requests defined

SECTION 4 — SECURITY & MINIMISATION  (Art. 4 / Art. 12)
[ ] Dataset minimised to purpose; retention set
[ ] Accuracy / bias check on outputs
[ ] Technical & organisational measures appropriate to risk

SECTION 5 — FORWARD ALIGNMENT
[ ] Use classified against prospective AI Act / EU AI Act risk tiers
[ ] High-risk uses flagged; human oversight defined
[ ] Cross-border transfers routed via KVKK Art. 9 (see TR-KVKK-09)

SECTION 6 — RECORDS
Retain the data map, basis analysis, notices and alignment assessment.

Owner: [ROLE]   Review cycle: [PERIOD]   Next review: ……/……/20……

This template is general and does not constitute legal advice.