AI and KVKK: using AI with personal data

AI products often work with personal data: customer messages, call recordings, CVs, usage data. Processing it with AI brings all obligations under Law No. 6698 (KVKK). For the general framework, see our KVKK guide.

Legal basis and purpose

You need a valid legal basis and a specific, explicit purpose to process personal data with AI. Using data collected for one purpose (e.g. a support request) for another (e.g. model training) must be assessed separately.

Notice

Explain in your privacy notice that data is processed with AI, for what purpose and with which providers; see our terms and privacy guide.

Data minimisation

• Do not send personal data the model does not need.
• Mask, pseudonymise or anonymise where possible.
• Set retention periods; do not keep prompt and response logs longer than needed.

Special category data

Health and biometric data face stricter conditions. Products using them need legal assessment; see our health tech guide.

Cross-border transfer

Sending data to model APIs hosted abroad can be a cross-border transfer. Assess KVKK transfer mechanisms (such as standard contracts). Running open-weight models domestically can be an alternative; see open vs closed models.

Provider contracts

Clarify in contracts:

• Data will not be used for model training
• Retention and deletion
• Security measures and processor responsibilities

Automated decisions

Decisions against individuals made solely by automated systems matter for the person's right to object. Include human review in important decisions; see responsible AI.

Security

Apply access control, encryption, logging and protections against AI-specific attacks such as prompt injection; see AI security.

Conclusion

Processing personal data with AI is possible, but privacy must be designed in from day one. If you sell to Europe, GDPR and the EU AI Act also apply. This guide is general information; get expert advice for your product.