AI and KVKK in Turkey: 10 checks before using generative AI with company data

To prepare for tomorrow’s meeting, the sales manager pastes the customer list and last year’s price quotes into a chatbot and gets a neat summary back. The HR specialist has CVs summarised the same way. Accounting uploads a spreadsheet “just to format it.” None of them means any harm, and none of them knows whether it is allowed. Company management then asks two things about AI and KVKK, the Turkish personal data protection law that governs such use: how do we get people to use these tools in an orderly way, and where does the data go?

Generative AI refers to AI systems that create new content such as text, images, audio or software code based on user input; from a KVKK perspective, the question is how personal data processed with these systems is handled under Law No. 6698. This article sets out ten checks based on the Authority’s guide, together with internal usage rules.

Does KVKK apply to AI? What does the KVKK generative AI guide say?

On 24 November 2025, Turkey’s Personal Data Protection Authority published its “Guide on Generative AI and the Protection of Personal Data (in 15 Questions).” The guide’s main message is this: personal data processed within AI systems must also be processed in line with the general principles in Article 4 of the Law (lawfulness and fairness, accuracy, specified and legitimate purpose, proportionality, storage limitation). The data controller’s obligation under Article 12 to take technical and administrative measures applies equally to AI use.

The guide stresses that roles are determined by actual control rather than by the contract. For example, if a company integrates an off-the-shelf model into its own recruitment process and itself decides which data is uploaded, for what purpose it is analysed and how the output is used, the company may be considered the data controller. In March 2026, the Authority also published a general assessment titled “Agentic AI,” raising the need to address more autonomous AI systems separately from a personal data perspective.

Generative AI KVKK checklist: 10 questions

Three points to watch when applying the checks

• Separate notices: The guide considers it important to give separate, clear notice for processing done to use the AI interface and processing done to improve the system. You cannot make this distinction without reading your provider’s data use terms.
• Transfers abroad: If you use the AI service of a provider based abroad, the guide asks for this to be assessed in line with Article 9 of the Law and the related regulation. Find out from the contract and documentation in which country the provider processes data.
• Risk assessment: The guide mentions a data protection impact assessment as an example of good practice for AI systems. It does not present it as mandatory; however, a written risk assessment before starting a new use, even a short one, turns the ten checks into a document.

Which uses need less attention, and which need more?

Internal AI usage policy: six rules for employees

1. Do not enter data that identifies a person, such as full name, address, phone number, ID or bank details, into tools that have not been approved.
2. Do not upload information about third parties such as customers, employees or candidates to these tools without informing them.
3. Do not write sensitive topics such as health, financial situation or legal proceedings into the tool.
4. Where possible, describe the case in general terms instead of using names, dates and locations.
5. Find out from IT and legal which tools are approved and where the data goes.
6. Verify AI output before using it as your own decision; report any suspected data leak immediately.

Copy-pasting into general chat tools: where it works and where it breaks

Pasting text into a general chat tool is fast and needs no setup or integration; for drafts, summaries and brainstorming without personal data it is often enough. Used with company data, however, it breaks in three places: the data goes to a provider outside the organisation’s control and nobody knows where it ends up; no corporate record is created of who asked what; and because employees select and paste the data by hand every time, the risk of errors and leaks arises again and again.

Where does Enterprise AI (Fero) stand on these checks?

Fero, the YazSis Enterprise AI solution, is designed to give controlled access to authorised business data instead of having employees paste data. In Fero, the AI does not write SQL; data is accessed only through 17 defined read-only business tools, and no ad-hoc queries are run. KPIs, percentages and differences are calculated in the back end, and the model cannot state a number that is not in a tool result. The application connects to the database with a read-only account, so data cannot be changed; screens are built from 13 approved components. This design directly answers check 8 (permission type) in the list above.

Let us also be clear about the limits. Today, MySQL is the data source that works out of the box; other sources are handled as part of the project. We also do not say “the data never leaves the company”: depending on how the AI model works, questions and summaries of tool results may go to an external AI service; which information may go out and which provider is used must be clarified during the project. That is why checks 5, 6 and 9 must be answered in writing before the project starts. The general framework of our approach to running AI with company data and processes is on the Artificial Intelligence page: limit data and access rights, match the use to a real business problem, connect the output to the workflow, and monitor quality and human oversight.

If you would like to evaluate read-only, tool-based AI use with your company data, you can see how Fero works and request a live demo on the Enterprise AI page.