Short answer: If customer names, phone numbers, messages or requests go into an AI system, that is a personal data processing activity, and the general rules of KVKK (Turkey's Personal Data Protection Law, Law No. 6698) apply. The core steps: define the purpose and lawful basis of the processing, inform the individual, process only the data you need, know in which country the data is processed and, where necessary, meet the requirements for cross-border transfers, and secure access and logs.
This article is for general information only and does not constitute legal advice. For situations specific to your business, consult a KVKK specialist.
KVKK is broadly similar to the EU GDPR in concepts such as transparency (the privacy notice), lawful basis, data minimization and cross-border transfer rules, so readers familiar with GDPR will recognize much of the framework below. The specific requirements described here, however, are those of the Turkish law.
At which points does AI use involve processing personal data?
- Customer-facing assistants (WhatsApp, website chat)
- Tools that summarize or classify CRM and email data
- Systems that process documents such as contracts, applications and invoices
- Customer information that employees copy and paste into general-purpose AI chat tools
The last one is the most frequently overlooked risk: without a company policy, employees can unknowingly transfer customer data to an uncontrolled service.
Checklist: Which questions must be answered before you start?
| Question | Why it matters |
|---|---|
| For what purpose is the data being processed? | Use beyond the stated purpose violates KVKK |
| What is the lawful basis? (contract, legitimate interest, explicit consent…) | Every processing activity needs a legal basis |
| Has the individual been informed? | The obligation to inform applies in every case |
| Is more data being processed than necessary? | The data minimization principle |
| In which country is the data processed and stored? | Cross-border transfer rules come into play |
| Does the provider use the data for model training? | It may need to be turned off through business settings |
| Who can access it, and are logs kept? | The obligation to take technical and administrative measures |
| How long will the data be retained? | Retention and destruction policy |
What has changed for cross-border data transfers?
A significant share of AI services run on servers outside Turkey; in that case, personal data is being transferred abroad. An amendment made in 2024 renewed KVKK's rules on cross-border transfers. Under the new system, data can be transferred to countries that have an adequacy decision or, where there is no adequacy decision, by providing one of the appropriate safeguards. The most common of these safeguards is the standard contract published by the Personal Data Protection Board; after the standard contract is signed, it must be notified to the Personal Data Protection Authority within a set period. Exceptions have also been defined for limited, incidental cases.
The practical takeaway: find out where your AI provider processes data. If appropriate safeguards cannot be provided, consider anonymizing the data before sending it, or a solution that runs in Turkey or on your own servers.
What technical measures reduce the risk?
- Masking and anonymization: Mask fields such as names, phone numbers and Turkish national ID numbers before sending them to the model; most tasks can be done without this information.
- Business accounts and settings: Instead of general consumer apps, prefer business plans or the API, where the data is not used for training.
- Access permissions: Limit, on a role basis, who can use the system and which data they can see.
- Logging and monitoring: Record which data was processed and when; monitor in a way that lets you detect unusual use.
- Retention period: Keep chat and transaction logs only as long as necessary, and destroy them at the end of the period.
- Employee policy: Put in writing which data may be entered into which tools, and explain it to the team.
What should the privacy notice say?
If you use an AI-powered service, your privacy notice should clearly state the purpose for which the data is processed, its categories and to whom it is transferred (including service providers), how any cross-border transfer is carried out, and the rights of the individual. For a customer-facing assistant, letting people know they are chatting with an AI is also the right practice from a trust perspective.
Want to use AI without compromising on data security? We set up our AI solutions with masking, authorization and logging mechanisms and, where needed, recommend an architecture in which the data stays on your own servers.
Sources
Frequently Asked Questions
Not in itself, but the requirements regarding purpose, lawful basis, informing the individual, cross-border transfers and security must be met. Employees entering customer data into general-purpose tools without a company policy is a significant risk.
Data that has been made genuinely anonymous, so that it can no longer be linked to an individual, is not considered personal data. However, simply deleting the name is often not enough; if the person can be re-identified from other information, the data is still personal data.
Not always. Processing can rely on another lawful basis, such as the performance of a contract or legitimate interest. Explicit consent comes into play where no other basis applies; the right basis should be determined according to your situation.