Updated 1 November 2026: rewritten with links to the KVKK, the GDPR and regulators' guidance, and the status of the EU's Digital Omnibus proposal.
Correction (19 October 2026): An earlier version said that EU data protection authorities, like the US FTC, are ordering the deletion of AI models; model-deletion orders are so far an FTC practice, while EU authorities have ordered the deletion of unlawfully processed data and bans on processing, and the section on sanctions has been corrected accordingly.
Before training an AI model on personal data, a company has to settle three questions: which lawful basis applies under Article 5 of Türkiye's data protection law (KVKK, Law No. 6698) and Article 6 of the GDPR, whether training fits the purpose for which the data was collected, and how any transfer abroad is covered. Scraped or public data does not avoid these questions. The Turkish Personal Data Protection Authority, also known as KVKK, published its guide on generative AI on 24 November 2025, and the European Data Protection Board adopted Opinion 28/2024 on 17 December 2024.
Which lawful basis can support AI training, and does the purpose still fit?
There is no special AI basis in either law, so training must fit an existing one. Under the KVKK, Article 5 requires explicit consent unless another condition in Article 5(2) applies. In practice the realistic options are explicit consent and legitimate interest (Article 5(2)(f)). The GDPR's equivalents are Article 6(1)(a) and 6(1)(f).
Legitimate interest. The EDPB describes a three-step test: identify a lawful, specific and real interest; show the processing is necessary for it; and check that individuals' rights do not override it. The KVKK guide points to Board decision 2019/78 and says the assessment must be made case by case, by reference to the system's purpose, impact and data flow. It adds that the benefit should not be aimed solely at profit.
Explicit consent. The KVKK guide says consent to use an AI tool does not cover use of the data to develop that tool. In its portrait filter example, using the app, using uploads to improve the AI, storing outputs and using outputs for development are separate activities needing separate consents. Long, technical notices will generally not produce valid consent. The guide also warns against asking for consent where another condition applies, calling that misleading and an abuse of right, since it implies a choice that may not exist.
Reusing data you already hold
Reuse often does not fit the original purpose, and this needs its own assessment. KVKK Article 4(2) requires specific, explicit and legitimate purposes and processing that is limited and proportionate. GDPR Article 5(1)(b) bars further processing incompatible with the original purpose, and Article 6(4) lists the factors to weigh.
Take customer service chats collected to resolve complaints. Feeding them into a language model is a new purpose with different risks. Korea's sanction against the Iruda chatbot developer concerned a model built on users' private messages, and it illustrates the problem.
Can public or scraped data simply be used?
No. The KVKK guide states that data anyone can access is not data anyone can process. Its Example 11 concerns a company scraping public social media bios, posts and comments to train a language model. People did not make that data public in order to train AI, so the "made public by the data subject" condition in Article 5(2)(d) does not apply. The public nature of the data can still count in a legitimate interest balancing test.
The GDPR route is similar. The EDPB says web scraping can have significant effects on people because of the volume and indiscriminate nature of the collection, and this weighs in the balancing test. Regulators elsewhere have reached comparable results: in findings of 6 May 2026, Canadian privacy regulators found that collecting personal information from public websites to train ChatGPT's early models was overbroad and lacked valid consent, although their conclusions differ by statute.
Will anonymisation take the dataset outside the law?
Only if the anonymisation is real, and the steps before it remain regulated. The KVKK guide says truly anonymous data falls outside the Law, but the claim must be shown by technical methods and objective criteria. Until a dataset is anonymised it remains personal data. Under GDPR recital 26, pseudonymised data that can be attributed to a person through additional information stays within the GDPR.
A trained model is not automatically anonymous either. The EDPB says a model counts as anonymous only if both the chance of extracting personal data from it and the chance of obtaining such data through queries are insignificant.
Special categories need separate care. KVKK Article 6(3) has a closed list without legitimate interest, and GDPR Article 9 also bans such processing unless an exception applies. Since 27 July 2026, Article 4a of the EU AI Act lets providers of high-risk systems process such data exceptionally for bias detection, under strict conditions. Article 4a(2) extends this, within the limits it sets, to other AI systems and to deployers. In this note's reading, the KVKK has no comparable provision.
What is needed when data leaves Türkiye or the EU?
A transfer tool has to be in place before the data moves, including when the transfer happens through a foreign AI vendor. The KVKK guide says Article 9 and the transfer regulation (Official Gazette, 10 July 2024, No. 32598) apply when a Turkish controller uses an overseas AI provider and data goes abroad. Article 9 offers an adequacy decision (a Board finding that the destination gives enough protection) or appropriate safeguards, such as standard contracts and binding corporate rules. The Article 9(6) exceptions cover occasional transfers only, so they fit training pipelines poorly.
A standard contract must be notified to the Authority within five business days of signature (Article 9(5)). Failing to notify carries an administrative fine (Article 18(1)(d)). The Law's text says TRY 50,000 to 1,000,000; after annual revaluation, the Authority's table gives TRY 90,308 to 1,806,177 for 2026. Under the GDPR, Chapter V requires an adequacy decision or safeguards such as standard contractual clauses (Articles 45 and 46). The site's KVKK transfer guide covers the mechanics, and its KVKK AI governance guide covers internal controls.
What happens if the training data was unlawful?
The outcome depends on the regulator, and it can go beyond a fine. The US FTC's 2021 Everalbum order required deletion of models and algorithms built from users' photos. EU authorities have ordered deletion of data and bans on processing: Italy's Garante fined Clearview AI EUR 20 million and ordered erasure of data on people in Italy. Under KVKK Article 15(7), the Board can halt processing or transfers where damage would be hard to repair and the breach is clear.
The EDPB leaves the effect on later use of a model to case-by-case assessment. A company deploying someone else's model should check how it was developed, including the data's source and any finding of infringement. Procedure can matter too: a Rome court annulled the Garante's EUR 15 million fine on OpenAI in March 2026 for lack of competence, without settling the merits of the training question.
Will the EU's Digital Omnibus change this?
Not yet. In November 2025 the Commission proposed a new GDPR Article 88c on processing for AI development and operation. The Council's negotiating mandate, agreed by Member States' permanent representatives on 21 October 2026, renumbers it Article 88 bis. The mandate still says such processing may be carried out for a legitimate interest under Article 6(1)(f). It drops the Commission's "unconditional right to object" and refers instead to the ordinary right to object in Article 21. A new recital (33a) adds that developing or operating AI "does not in itself constitute a legitimate interest", to be assessed case by case. A negotiating mandate is the Council's position for talks with Parliament: it is not law and can change. This file is separate from the AI Omnibus already adopted as Regulation (EU) 2026/1744.
Frequently asked questions
Can publicly available data be used for AI training under the KVKK?
Not on the basis that it was made public. The KVKK's generative AI guide says public social media content cannot be used for model training under the "made public" condition in Article 5(2)(d). A company would need another basis, such as legitimate interest, where public availability is one factor in the balancing test.
Does consent to use an AI tool cover training?
No. The KVKK's generative AI guide says explicit consent given for using an AI tool does not extend to developing it. If a company relies on explicit consent under KVKK Article 5, using an app, training on uploads, storing outputs and training on outputs each need separate consent.
Can a Turkish company use a foreign AI service with personal data?
Yes, if KVKK Article 9 is met. The KVKK's guide says a transfer through a foreign AI provider must follow Article 9 and the 2024 transfer regulation. That normally means an adequacy decision or an appropriate safeguard, such as a standard contract notified within five business days.
Is an AI model trained on personal data anonymous?
Not automatically. EDPB Opinion 28/2024 says a model is anonymous only if the likelihood of extracting personal data from it, and of obtaining such data through queries, is insignificant. Supervisory authorities assess such claims case by case under the GDPR.
Sources: Law No. 6698 (KVKK); KVKK generative AI guide (Publication No. 113, November 2025); Regulation (EU) 2016/679; EDPB Opinion 28/2024; Council document 14756/26 (negotiating mandate, marked against the Commission proposal); FTC and Garante releases; decision summaries on this site, all read on 1 November 2026. The KVKK fine figures come from the Law's text and the Authority's table for 2026. General information, not legal advice.
