# KVKK and generative AI: a checklist

> To use generative AI with personal data under KVKK, Türkiye's data protection law, first map which tool processes which data. Then write an employee usage policy, check each provider's retention and training terms, settle the legal basis for any cross-border transfer and update your privacy notice. This checklist follows the guidance the Turkish authority published in November 2025.

URL: https://corrplus.net/blog/kvkk-generative-ai-checklist/
Updated: 2026-10-26
Corrplus Team

## What does the KVKK guidance on generative AI expect from companies?

Generative AI is a type of AI that produces text, images or code based on patterns learned from its training data. KVKK is Türkiye's Law No. 6698 on the Protection of Personal Data, and the name is also used for the authority that enforces it. In November 2025 the authority published a guide, "Generative AI and Personal Data Protection (in 15 Questions)", that applies the law to these systems.

The guide does not create new obligations. It explains how existing rules apply: how to identify the controller and processor, the general principles, legal bases, cross-border transfer, transparency, data subject rights and security. It stresses that personal data can be processed not only in training but also during use and output generation.

The practical consequence: every AI tool your team uses should be a row in your personal data inventory. Which tool, which data, what purpose, which country. Without those rows, none of the steps below can be verified. For background, see our glossary entries on [KVKK](/glossary/kvkk/) and [LLMs](/glossary/llm/).

### How does KVKK differ from GDPR for AI use?

Teams that already work under GDPR will recognise most of KVKK. The differences that matter most for AI projects are these:

| Topic | GDPR | KVKK |
|---|---|---|
| Transfers outside the territory | Adequacy decisions, standard contractual clauses, binding corporate rules | Since 1 June 2024: adequacy decisions, appropriate safeguards such as standard contracts, narrow exceptions |
| Adequacy decisions in place | In place for a number of countries and territories | None yet, according to the authority's transfer page |
| Standard contract notification | Not required | Notify the authority within five business days of signature |
| Controller registration | No general register | VERBİS registry for controllers above the thresholds |

If you serve customers in both Türkiye and the EU, one AI integration may need to satisfy both regimes. Plan the data flows once and document them for each.

## What rules should staff follow when using ChatGPT, Claude or Gemini?

Bans rarely work; people keep using the same tools on personal accounts. A stronger approach is to approve specific tools and write clear limits. A short usage policy should cover:

- **Approved tools and account type.** Which tools may be used with a company account and which are not allowed.
- **Data that is never entered.** Special category data (such as health or biometric data), national ID numbers, customer contracts, payroll.
- **A habit of anonymising.** Generic descriptions instead of names, phone numbers and addresses.
- **Review of output.** Models can produce wrong information; anything sent to a customer is read by a person first.
- **A reporting route.** Who to tell, and how, when data is entered by mistake.

A policy only works once people have seen examples, so roll it out with a short training session.

## Does calling a model through an API count as a transfer abroad?

If your application sends a customer message to an OpenAI, Anthropic or Google API, and the provider's servers are outside Türkiye, the personal data in that message is usually transferred abroad. Since the amendment that took effect on 1 June 2024, Article 9 sets three tiers: adequacy decisions, appropriate safeguards, and limited exceptions for occasional transfers.

With no adequacy decisions in place, the standard contract is the most common route for regular transfers, and it must be notified to the authority within five business days of signature. The exceptions are for occasional, non-regular transfers and are read narrowly; an integration that runs every day does not fit them. Decide the basis together with your legal counsel. Our contribution as a technical team is to document exactly where the data goes and which fields it contains.

## How do you check retention, training and region options?

The same model comes with different data terms depending on how you access it. The table below is a general comparison based on providers' own published statements. Terms vary by plan, contract and date, so read the current documentation before you sign.

| Access route | Used for training? | Retention control | Region choice | Contract and transfer tool needed |
|---|---|---|---|---|
| Consumer chat app (personal account) | Depends on user settings; company has no control | With the user | None | Not suitable for company data |
| Business plan (ChatGPT Enterprise, Claude Enterprise and similar) | Not by default, per provider statements | Admin settings | Limited, by plan | Data processing agreement, transfer basis |
| Direct API | Not by default, per provider statements | Provider policy; zero retention on some plans | US or Europe on some providers | Data processing agreement, standard contract and notification |
| Through a cloud provider (Azure, Google Cloud, AWS) | Per the cloud provider's terms | In your cloud account | Region selection available | Cloud agreement, transfer basis |
| Open model on your own servers | No, data stays with you | Fully yours | Wherever the server is | No transfer question if hosted in Türkiye |

For example, OpenAI states that data from its business products and API is not used for training by default and offers data residency options for eligible customers. Anthropic's API documentation states that retained data is not used for training without express permission and describes its zero data retention arrangement. These statements are a starting point, not a legal assessment.

Region and hosting choices are part of your [cloud infrastructure](/services/cloud-infrastructure-scalable-platforms/) design. Running an open model on your own servers removes the transfer question but moves the operating and security load to you.

## How do notice, consent and data minimisation work in practice?

**Notice.** If you process customer or employee data with an AI system, your privacy notice should say so: the purpose, the data categories, the recipients and the countries. If you run a chat assistant, tell users clearly that they are talking to an AI system.

**Legal basis.** Explicit consent is not the only option and is often not the best one. Whether performance of a contract, legitimate interest or another basis applies depends on the use case and should be assessed with your legal counsel.

**Data minimisation.** The most effective technical control is not sending the model more data than it needs. If a contract is being summarised, names and ID numbers can be masked before the text reaches the model. In [document analysis](/solutions/document-analysis/) projects, building the masking step into the pipeline is far easier than adding it later. In [LLM integration](/services/llm-integration/) work, prompt and response log retention is decided at the same stage.

This matters most for [finance and insurance](/industries/finance-insurance/) companies that handle large volumes of customer data. For [SMEs](/industries/smes/) without a compliance team, a short policy and a one-page tool inventory are a good start.

## Where should you start?

1. List the AI tools in use across the company, including those used on personal accounts.
2. Record which personal data each tool processes and which country it goes to.
3. Write a short usage policy and explain it with examples.
4. Collect each provider's training, retention and region statements.
5. Review the transfer basis, privacy notice and legal basis together with your legal counsel.

Corrplus does not give legal advice. We are the technical team that builds the requirements your counsel sets into your systems. In discovery we map data flows and AI use; in design we put masking, logging and provider choice in writing. See our [security, compliance and data ethics](/services/ai-governance/) service and our definition of [AI governance](/glossary/ai-governance/) for more.

## Frequently asked questions

### Can our staff use ChatGPT at work?

Yes, but you set the rules. A written policy should name the approved tools, the data types that must never be entered and whether a company account is required. Customer data typed into a free personal account creates processing and a transfer that you cannot control or document.

### Is sending data to an AI API a cross-border transfer under KVKK?

If the provider's servers are outside Türkiye and the request contains personal data, it is usually treated as a cross-border transfer. You then need one of the bases in Article 9 of Law No. 6698, such as a standard contract. Decide which one applies together with your legal counsel.

### If the provider does not train on our data, are we covered?

No. A no-training commitment is an important safeguard, but it is only one item. Retention period, processing region, sub-processors and the legal basis for transfer still have to be assessed and documented.

### Do standard contracts have to be notified to the authority?

Yes. Under Article 9 of the law, a standard contract must be notified to the Turkish Personal Data Protection Authority within five business days of signature. The authority also runs an online notification module. Plan the process together with your legal counsel.

## Sources

- [KVKK, Generative AI and Personal Data Protection Guide (in 15 Questions), Publication No. 113, November 2025 (Turkish)](https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/MTY5MjNmNmIwZWY3YTE.pdf)
- [KVKK, Guide on Cross-Border Transfer of Personal Data, Publication No. 48, January 2025 (Turkish)](https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/13711235-abb6-4b17-9a6b-0a68c1ad86c5.pdf)
- [KVKK, Cross-border transfer (Turkish)](https://www.kvkk.gov.tr/Icerik/2053/Yurtdisina-Aktarim)
- [Law No. 6698 on the Protection of Personal Data (Mevzuat, Turkish)](https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf)
- [Regulation (EU) 2016/679, the General Data Protection Regulation (EUR-Lex)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [Anthropic, API and data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention)
- [OpenAI, Business data privacy, security, and compliance](https://openai.com/business-data/)