Turkey has no standalone AI statute yet, but training and running AI on personal data already engages KVKK in full. Below, free of charge: a data-governance checklist covering lawful basis, special categories, profiling and transparency — built to sit alongside the prospective Turkish AI Act.
Download the template Reserve your spot for an online callA prospective Turkish AI Act is discussed but not in force. In the meantime, any AI that processes personal data — for training, inference or profiling — is squarely within KVKK. Four points do most of the work:
KVKK has no standalone "right not to be subject to automated decisions" like GDPR Art. 22, but its general principles constrain profiling — and aligning now with the prospective AI Act and the EU AI Act avoids re-papering later.
| Provision | AI step | What it means in practice |
|---|---|---|
| KVKK Art. 4 | All | Purpose limitation, data minimisation and accuracy apply to datasets and outputs |
| KVKK Art. 5 | Training / inference | A lawful basis is needed; public availability is not one by itself |
| KVKK Art. 6 | Sensitive data | Special categories usually require explicit consent |
| KVKK Art. 10 | Deployment | The privacy notice must describe AI processing and profiling |
| KVKK Art. 11 | Rights | Access, correction and deletion cover inputs and outputs |
| KVKK Art. 12 | Security | Measures appropriate to the risk of the AI pipeline |
| Prospective AI Act / EU AI Act | Alignment | Map high-risk use now to avoid re-papering later |
Turkey has no standalone AI statute in force; alignment points are forward-looking. Confirm the current KVKK text.
Copy the text below or download it as markdown. No sign-up.
# KVKK × AI — DATA-GOVERNANCE CHECKLIST Document code: TR-KVKK-AI-01 · Version 1.0 · Classification: Internal Organisation: [NAME] Prepared by: [NAME/ROLE] Date: ……/……/20…… Reference: KVKK (Law 6698); prospective AI Act / EU AI Act alignment SECTION 1 — AI SYSTEM & DATA MAP System: [NAME] Purpose: [……] Training data source(s): [……] Personal data? [ ] Y [ ] N Inference inputs: [……] Profiling produced? [ ] Y [ ] N SECTION 2 — LAWFUL BASIS (Art. 5 / Art. 6) [ ] Basis identified for TRAINING: …… (note: "public" is not a basis) [ ] Basis identified for INFERENCE: …… [ ] Special categories present? [ ] Y [ ] N → explicit consent / Art. 6 basis: …… SECTION 3 — TRANSPARENCY & RIGHTS (Art. 10 / Art. 11) [ ] Privacy notice describes the AI processing and any profiling [ ] Access / correction / deletion cover inputs AND outputs [ ] Channel for data-subject requests defined SECTION 4 — SECURITY & MINIMISATION (Art. 4 / Art. 12) [ ] Dataset minimised to purpose; retention set [ ] Accuracy / bias check on outputs [ ] Technical & organisational measures appropriate to risk SECTION 5 — FORWARD ALIGNMENT [ ] Use classified against prospective AI Act / EU AI Act risk tiers [ ] High-risk uses flagged; human oversight defined [ ] Cross-border transfers routed via KVKK Art. 9 (see TR-KVKK-09) SECTION 6 — RECORDS Retain the data map, basis analysis, notices and alignment assessment. Owner: [ROLE] Review cycle: [PERIOD] Next review: ……/……/20…… This template is general and does not constitute legal advice.
Not a standalone one in force. A prospective Turkish AI Act is discussed and would likely align with the EU AI Act, but AI that processes personal data is already fully within KVKK today.
Public availability does not, by itself, create a lawful basis under KVKK Art. 5. Training still needs a basis, and special categories under Art. 6 usually require explicit consent.
KVKK has no standalone equivalent to GDPR Art. 22, but its general principles, transparency and data-subject rights constrain profiling and automated processing.
Because mapping high-risk uses and documentation now is far cheaper than re-papering once a statute lands. The EU AI Act already sets the likely template through the 'Brussels effect'.
In a twenty-minute call we walk your training and inference data, settle the lawful basis and special-category questions, and align the use with the prospective AI Act. If you're out of scope, we say so clearly.
Reserve your spot for an online call The call is online · the template is yours either way