Updated 2 November 2026: KVKK says uploading files "may" amount to a transfer abroad after an assessment of the tool, not that it always does. The guide was prepared with the Union of Turkish Bar Associations. Claims about what lawyers habitually do and an unverifiable Korean draft guideline have been withdrawn.

Correction (19 October 2026): We corrected the criminal provisions cited (Articles 136 and 239 of the Turkish Penal Code, not Article 130), described the guide's wording on special-category data as a recommendation rather than a rule, and corrected the FAQ to reflect the guide's view that a Türkiye-hosted tool still calls for an Article 8 domestic-transfer assessment.

Türkiye's data protection authority (KVKK) and the Union of Turkish Bar Associations presented a practice guide for lawyers on 22 September 2026. It says that uploading client files to generative AI tools such as ChatGPT or Gemini may amount to a transfer of personal data abroad under Article 9 of Law No. 6698. The 158-page guide (KVKK Publication No. 115, dated July 2026) does not ban these tools.

What does the KVKK guide say about generative AI?

The AI section is a short part of a longer document. The guide also covers lawyers' status as controllers, joint offices, delegated counsel (tevkil), employed lawyers, trainees and office staff, the conditions for processing data, and data security. On the question of AI, it says the following.

  • Not just research. Uploading a file with personal data should not be treated merely as technical support or legal research.
  • A possible transfer abroad. If the provider is based abroad, its servers are abroad, or sub-processors abroad handle the data, Article 9 "may" be engaged. It depends on the tool's infrastructure, retention policy and the location of the provider and servers.
  • What to check. Lawyers should review the terms of use, privacy policy, processing conditions, data location, sub-processor provisions and any transfer mechanisms. If a transfer is found, Article 9 must be met.
  • Domestic tools too. Even where the provider is in Türkiye and processes data there, handing over files may be a transfer under Article 8. The legal basis, purpose, data categories and proportionality should be assessed.
  • Security. Under Article 12 the guide considers these important: masking or anonymising data as far as possible, avoiding upload of special-category data, sharing only the minimum needed, reviewing retention, model training, human review, sub-processor and security policies, and setting internal rules for the office.

KVKK's President, according to a press report, said the guide does not prohibit lawyers from processing personal data. It promotes processing what the work requires, on a proper basis, to the extent necessary and securely.

Is a KVKK guide legally binding?

No. It does not create new obligations, but it shows what the regulator expects. Article 12 of Law No. 6698 requires appropriate technical and administrative measures, without defining them. In our view, once KVKK has published a specific expectation, a lawyer who did the opposite has more to explain. Fines also vary within a range: Article 17 of the Misdemeanours Law looks at the wrong, the fault and the person's economic situation, and in our view good-faith compliance efforts are relevant to that. The guide did not change the law on 22 September; Article 9 already applied.

Which transfer routes are open to a lawyer?

Article 9, as amended in 2024, sets three levels. The guide summarises them in the same order, and our cross-border transfer guide covers them further.

  • Adequacy decision. The Board may decide a country or sector offers adequate protection. We found no published decision as of 1 November 2026.
  • Appropriate safeguards. These include binding corporate rules and standard contracts. A standard contract must be notified to the Authority within five business days of signature (Article 9(5)), and failure to notify carries a fine of TRY 50,000 to 1,000,000 before any revaluation (Article 18(1)(d)). KVKK has said no additions, removals or changes may be made outside the optional clauses.
  • Exceptional transfers. Only if neither route is available, and only incidentally ("arızi"), on grounds such as explicit consent after being told the risks, a contract with the person, or the establishment, exercise or protection of a right (Article 9(6)).

In our reading, standard contracts are the realistic route for regular use, and whether a provider will sign KVKK's text unchanged is the question to ask. The exceptional route fits poorly: daily use of an assistant is hard to call incidental, and the retainer requires legal services rather than a particular tool. That is not a position the guide takes.

What about special-category data?

The guide words it as a recommendation, but in our view lawyers should treat it as a firm line. Article 6 covers race, ethnic origin, political opinion, philosophical belief, religion or sect, dress, membership of an association, foundation or trade union, health, sexual life, criminal convictions and security measures, and biometric and genetic data. Employment, criminal defence, family and personal injury files often contain such data.

Article 6(3) allows processing on listed conditions, including explicit consent and necessity for establishing, exercising or protecting a right. That condition may cover the lawyer's work on a file. In our view, it does not obviously extend to choosing a foreign processing tool.

Does professional secrecy raise a separate problem?

Yes, and the guide's AI section does not settle it. Article 36 of the Attorneys' Act forbids lawyers from disclosing what they learn through their work. The Penal Code separately penalises unlawful disclosure of personal data (Article 136) and of commercial or client secrets (Article 239). Meeting Article 9 does not by itself meet Article 36.

The open question is whether giving client information to a provider is a disclosure at all. One view is that a processor acting on instructions and bound to confidentiality is an extension of the office. We found no Turkish decision on this for AI tools. The view is weakest where the provider may use the content for its own purposes. Terms differ by plan: OpenAI, for example, says it may train on content from services for individuals unless the user opts out, and treats business services such as ChatGPT Enterprise and its API differently. Lawyers should read the current terms of the tool they use. See also our notes on AI chats and confidentiality and fabricated citations.

What should a law office consider?

This is general guidance drawn from the guide and our reading of it.

  • Know which plan is in use. Plans differ on training, retention and contract terms.
  • Settle the transfer basis or keep client data out. That means contract terms in KVKK's form and notice within five business days.
  • Strip identifiers by default. Names, ID numbers, addresses and case numbers can often be removed without loss. Masking is not always anonymisation, since a distinctive dispute can still identify the parties.
  • Tell clients. Where tools are used on client material, say so in the engagement terms. In our view this is a professional matter as well as a data one.
  • Write the office rules down. The guide itself asks for internal rules. Our AI use policy guide offers a structure.

Does the reasoning apply outside law firms?

In our view, yes. Nothing in the transfer reasoning depends on the data being a case file, though the guide addresses only lawyers. It refers to KVKK's other papers, including its generative AI guide of November 2025 and its workplace paper of February 2026, so this was not KVKK's first word on the subject. Our KVKK and AI governance guide brings these together.

The EU's starting point is similar, but with more options. The GDPR's Chapter V also restricts transfers, yet the EU has adequacy decisions, and its standard clauses need no notification to an authority. In South Korea, the Personal Information Protection Commission held a meeting on agentic AI on 23 September, according to a Yonhap report. Organisations interviewed for a study presented there named prompt injection and excessive permissions as risks, and the Commission plans a guide by the end of 2026.

Frequently asked questions

Has KVKK banned ChatGPT for Turkish lawyers?

No. KVKK's guide of September 2026 does not prohibit generative AI. It says uploading files with personal data may amount to a transfer, sets out what to review, and lists protective steps such as masking, minimising data and avoiding special-category data.

Does the KVKK guide apply if the AI tool runs in Türkiye?

Partly. Article 9 falls away if the provider and processing genuinely stay in Türkiye, but the KVKK guide says handing over files may still be a transfer under Article 8. Article 12 security duties, Article 6 and professional secrecy under Article 36 of the Attorneys' Act continue to apply.

Does client consent solve the transfer problem?

Sometimes, and less often than hoped, in our view. Explicit consent under Article 9(6) sits in the exceptional route, which is limited to incidental transfers and requires the client to be told the risks. That can work for an occasional transfer but fits a daily tool poorly.

Is the firm or the employed lawyer the data controller?

According to the KVKK guide, an employed lawyer acts on behalf of the employing lawyer, who decides the purposes and means, so the employed lawyer is neither controller nor processor. The secrecy duty in Article 36 of the Attorneys' Act is addressed to lawyers, so firm policy does not end the individual's own duty, in our reading.

Burhan Doğuş Ayparlar's View

This section sets out my personal assessment as the founder of this site and an attorney at law (Türkiye).

I think KVKK's reasoning is sound, and the discomfort it causes falls first on my own profession. A file sent to infrastructure in another country has left the country, and it makes no difference that it went through a text box and not an email attachment.

Where I would push back a little is proportionality. The guide asks lawyers to check terms of use, retention and sub-processors. For a large firm this is a task. For a small office it means reading long contract terms in a foreign language that can change without notice. I would like KVKK and the Union of Turkish Bar Associations to assess the main services centrally, publish which plans can support a compliant arrangement, and offer a model clause set.

The part I take most seriously is secrecy. If a provider's terms allow content to be used for model improvement, I do not think the view of the processor as an extension of the office survives, because the information has gone somewhere outside your instruction. The difference between plans is therefore more than a procurement preference.

Sources: KVKK, Practice Guide on the Protection of Personal Data in Lawyers' Professional Activities (Publication No. 115), section on generative AI at pp. 120-122 and Article 12 passage; Türkgün (22 September 2026, press report, for the date and the President's remarks); KVKK notice on standard contracts (5 February 2025); Laws Nos. 6698, 1136, 5237 and 5326; OpenAI's data policy page; GDPR; Yonhap report via Supple (23 September 2026). All read on 1 November 2026. Fine amounts are the statutory figures, without revaluation. Our reading of the transfer routes and of secrecy has not been tested in a published decision that we could find. General information, not legal advice.