With your permission we use Google Analytics to understand how the site is used. There are no other non-essential cookies. Cookie policy

ENTR
Free call
Book a free call

Generative AI data protection checklist

For each of twelve steps, choose where you stand: yes, partly or no. The list shows what is done, what is missing and the next three steps. The steps follow a working order based on the generative AI guide of Türkiye’s data protection authority (KVKK). The result is not a compliance statement; it prepares the conversation with your legal counsel.

1 / 12 · InventoryIs there a list of the AI tools used in the company, including those used with personal accounts?
2 / 12 · InventoryFor each tool, is it recorded which personal data is processed, for what purpose and to which country it goes?
3 / 12 · Usage rulesIs it written down which tools may be used with a company account and which are not allowed?
4 / 12 · Usage rulesIs the data that must never be entered (health data, national identity numbers, contracts, salary details) written down?
5 / 12 · PeopleHave these rules been explained to staff with examples or a short training?
6 / 12 · PeopleIs it clear who is told, and how, when personal data is entered into a tool by mistake?
7 / 12 · Provider and transferDo you hold your providers’ current statements on training use, retention and regions?
8 / 12 · Provider and transferIs the country the data goes to documented, and has the basis for transfer abroad been settled with your legal counsel?
9 / 12 · Transparency and legal basisDoes your privacy notice say that personal data is processed with AI?
10 / 12 · Transparency and legal basisHas a legal basis (contract, legitimate interest, explicit consent and so on) been set for each use?
11 / 12 · Technical controlsAre fields such as names and identity numbers removed or masked before they reach the model?
12 / 12 · Technical controlsDoes a person read AI output before it goes to a customer?

Where you stand

0 / 12 answered

Your status builds here as you answer.

This list is not a compliance statement or a legal opinion; it is a working order based on the generative AI guide Türkiye’s data protection authority (KVKK) published in November 2025. Assess the result together with your legal counsel. Your answers are recorded without your identity.

How does the list work?

  • The twelve steps follow the working order of the checklist post: inventory first, then rules, provider, transfer, transparency and technical controls.
  • The next steps shown are the first three you answered "no" to, then those you answered "partly".
  • There is no score and no "compliant" result; you get the number of steps done, partly done and open.
  • The list describes no new obligation; it puts in order how the existing rules apply to generative AI.

Sources

What does this list not show?

  • Whether you comply with KVKK or GDPR. That is a legal assessment made with your contracts and your use cases.
  • Which transfer basis or legal basis fits your situation.
  • Obligations under the EU AI Act or sector legislation.
  • Whether the answers are right; the list rests on what you report.

KVKK and generative AI: a checklist AI governance Corporate AI training

Next toolAI readiness assessmentCompliance is one of five areas. See how ready the company is on goals, data, process and people too.Open the tool All tools

Frequently asked questions

Is this list legal advice?

No. The list is a working order based on the authority’s generative AI guide, and shows what is ready and what is missing. The transfer basis, the privacy notice and the legal basis should be assessed with your legal counsel. Corrplus does not give legal advice.

Does the KVKK generative AI guide create a new obligation?

No. The guide explains how the existing rules apply to generative AI: identifying the controller and the processor, the general principles, the conditions for processing, transfers abroad, transparency, data subject rights and data security.

Does the list apply to companies outside Türkiye?

The steps follow Türkiye’s data protection law, KVKK. Most of them (an inventory, usage rules, provider statements, a transfer basis, a clear privacy notice) are common practice under GDPR as well, but the legal detail differs; confirm with your legal counsel which law applies to you.

Are my answers stored?

Yes, without your identity. The answers you choose are recorded so we can see how the tool is used, without your name, email or IP address, and are deleted after 12 months. If you ask for the result by email, the address you type is taken separately for that request and kept as a contact request.

Let’s talk about your transformation

Tell us which work repeats every week. We will tell you honestly whether it is worth automating.

Book a free call

How we start

  1. A free first callWe pin down the problem and the goal together.
  2. A 2-week discovery sprintWe look at the data, the process and the tools, and decide where to start.
  3. A written proposalScope, architecture and timeline, in writing.
Book a free call