What is KVKK?
KVKK is Türkiye's Personal Data Protection Law, Law No. 6698, which sets the rules for processing personal data and the rights of individuals in Türkiye. It took effect in 2016 and is enforced by the Personal Data Protection Authority. Any AI or automation project that touches customer, employee or candidate data in Türkiye should be assessed against it.
Definition
KVKK is Türkiye's Personal Data Protection Law, Law No. 6698, which sets the rules for processing personal data and the rights of individuals in Türkiye.
What does KVKK require?
The law requires personal data to be processed lawfully, for specified purposes and proportionately. The company acting as data controller must inform individuals when collecting data (Article 10), rely on one of the legal conditions or on explicit consent, and take technical and organisational measures to protect the data (Article 12). Individuals have rights to access, correct and request deletion of their data (Article 11). Certain controllers must register with VERBIS, the data controllers’ registry.
KVKK in AI projects
Indexing company documents for RAG, collecting customer details through a chatbot, or moving data between systems with automation are all personal data processing. At the design stage, answer these questions: which data is processed, on what legal basis, in which country, for how long, and who can access it. If you use an AI provider abroad, the transfer rules in Article 9, revised in 2024, become central.
Where to start
Map your data, update your privacy notices and write a short usage policy for AI tools. This work is the foundation of AI governance. If you also process data of people in the EU, GDPR and possibly the EU AI Act apply. This page is general information; legal assessment should be done together with your legal adviser.
Related terms
- AI governanceAI governance is the set of policies, roles and processes that determine how an organisation selects, uses, oversees and manages the risks of its AI systems.
- EU AI ActThe EU AI Act is Regulation (EU) 2024/1689, which classifies AI systems in the European Union by risk level and sets obligations for providers and deployers accordingly.
- RAG (Retrieval-Augmented Generation)RAG (Retrieval-Augmented Generation) is an AI architecture that lets a language model retrieve relevant passages from a chosen document collection, such as a company's own documents, and use them as context before it writes an answer.
- ChatbotA chatbot is software that converses with users in text or voice on channels such as a website, WhatsApp or in-app messaging, answering questions and handling simple tasks.
Frequently asked questions
How does KVKK compare with GDPR?
KVKK was modelled largely on the EU's earlier data protection framework and shares many GDPR concepts, such as data controllers, legal bases and data subject rights. The details differ, for example on registration with the VERBIS data controller registry and on international transfers, so GDPR compliance alone is not enough.
What did the 2024 amendment change?
A 2024 amendment revised the conditions for processing special categories of personal data and the rules on transfers abroad. Cross-border transfers can now rely on adequacy decisions or appropriate safeguards such as standard contracts and binding corporate rules.
Let’s talk about your transformation
Tell us which work repeats every week. We will tell you honestly whether it is worth automating.
How we start
- A free first callWe pin down the problem and the goal together.
- A 2-week discovery sprintWe look at the data, the process and the tools, and decide where to start.
- A written proposalScope, architecture and timeline, in writing.