Turkey has no standalone AI statute yet, but training and running AI on personal data already engages KVKK in full. Below: a data-governance checklist covering lawful basis, special categories, profiling and transparency — built to sit alongside the prospective Turkish AI Act.
Download the templateA prospective Turkish AI Act is discussed but not in force. In the meantime, any AI that processes personal data — for training, inference or profiling — is squarely within KVKK. Four points do most of the work:
KVKK has no GDPR Art. 22-style "right not to be subject to automated decisions", but Art. 11(1)(g) lets a person object to an adverse result produced solely by automated analysis, and its general principles constrain profiling — and aligning now with the prospective AI Act and the EU AI Act avoids re-papering later.
| Provision | AI step | What it means in practice |
|---|---|---|
| KVKK Art. 4 | All | Purpose limitation, data minimisation and accuracy apply to datasets and outputs |
| KVKK Art. 5 | Training / inference | A lawful basis is needed; data being online is not one, and Art. 5(2)(d) covers only data the person made public themselves |
| KVKK Art. 6 | Sensitive data | Only on an Art. 6(3) ground (explicit consent or seven others), with the adequate measures set by the Board (Art. 6(4)) |
| KVKK Art. 10 | Deployment | The privacy notice must describe AI processing and profiling |
| KVKK Art. 11 | Rights | Access, correction and deletion cover inputs and outputs; Art. 11(1)(g): right to object to an adverse solely-automated result |
| KVKK Art. 12 | Security | Measures appropriate to the risk of the AI pipeline |
| Prospective AI Act / EU AI Act | Alignment | Map high-risk use now to avoid re-papering later |
Turkey has no standalone AI statute in force; alignment points are forward-looking. Confirm the current KVKK text.
Copy the text below or download it as markdown. No sign-up.
# KVKK × AI — DATA-GOVERNANCE CHECKLIST
Document code: TR-KVKK-AI-01 · Version 1.0 · Classification: Internal
Organisation: [NAME] Prepared by: [NAME/ROLE] Date: ……/……/20……
Reference: KVKK (Law 6698); prospective AI Act / EU AI Act alignment
SECTION 1 — AI SYSTEM & DATA MAP
System: [NAME] Purpose: [……]
Training data source(s): [……] Personal data? [ ] Y [ ] N
Inference inputs: [……] Profiling produced? [ ] Y [ ] N
SECTION 2 — LAWFUL BASIS (Art. 5 / Art. 6)
[ ] Basis identified for TRAINING: …… (note: "online" is not a basis;
Art. 5(2)(d) covers only data made public by the person)
[ ] Basis identified for INFERENCE: ……
[ ] Special categories present? [ ] Y [ ] N → Art. 6(3) ground: ……
+ Board-set adequate measures (Art. 6(4)) in place? [ ] Y [ ] N
SECTION 3 — TRANSPARENCY & RIGHTS (Art. 10 / Art. 11)
[ ] Privacy notice describes the AI processing and any profiling
[ ] Access / correction / deletion cover inputs AND outputs
[ ] Channel for data-subject requests defined
[ ] Objections to adverse solely-automated results handled (Art. 11(1)(g))
SECTION 4 — SECURITY & MINIMISATION (Art. 4 / Art. 12)
[ ] Dataset minimised to purpose; retention set
[ ] Accuracy / bias check on outputs
[ ] Technical & organisational measures appropriate to risk
SECTION 5 — FORWARD ALIGNMENT
[ ] Use classified against prospective AI Act / EU AI Act risk tiers
[ ] High-risk uses flagged; human oversight defined
[ ] Cross-border transfers routed via KVKK Art. 9 (see TR-KVKK-09)
SECTION 6 — RECORDS
Retain the data map, basis analysis, notices and alignment assessment.
Owner: [ROLE] Review cycle: [PERIOD] Next review: ……/……/20……
This template is general and does not constitute legal advice.
Not a standalone one in force. A prospective Turkish AI Act is discussed and would likely align with the EU AI Act, but AI that processes personal data is already fully within KVKK today.
Data being accessible online is not, by itself, a lawful basis under KVKK Art. 5. Art. 5(2)(d) covers only data the person has made public themselves, and for special categories Art. 6(3)(ç) adds that the processing must accord with the person's intention in making it public. Training still needs a basis, and special categories may be processed only on one of the Art. 6(3) grounds (explicit consent or one of seven others) and with the adequate measures set by the Board (Art. 6(4)).
KVKK has no GDPR Art. 22-style prohibition, but Art. 11(1)(g) gives the data subject the right to object to a result against them that arises from the analysis of their data exclusively through automated systems. Its general principles and transparency duties also constrain profiling.
Because mapping high-risk uses and documentation now is far cheaper than re-papering once a statute lands. The EU AI Act already sets the likely template through the 'Brussels effect'.