AI and KVKK: What to Watch When Working with Personal Data at Work

The basic rule on AI and KVKK is this: when you enter personal data into an AI tool, you are processing that data, and the obligations of Law No. 6698 on the Protection of Personal Data (KVKK, Turkey's data protection law) apply. That means you need to know which data goes into which tool, on what legal basis and with what security measures. In practice, the most effective safeguards are removing personal data before it goes into a tool, choosing tools with enterprise-grade terms and giving employees written rules.

This article is for general information only and is not legal advice. For an assessment specific to your situation, consult a KVKK specialist or a lawyer. We also recommend following the announcements and guidance on AI published by the Personal Data Protection Authority (KVKK's regulator).

Why AI and KVKK need to be considered together

AI tools, especially chat-based ones, are easy for employees to reach for throughout the day. A sales rep might use one to summarize customer correspondence, an HR specialist to compare résumés, an accounting clerk to tidy up an invoice list. In each case, personal data such as names, contact details, or health or financial information may have been passed to the tool.

From a KVKK standpoint, several questions come up:

• Is there a valid legal basis for processing this data for this purpose?
• Were the people concerned informed that their data would be processed this way?
• If the tool's servers are abroad, has the data been transferred outside Turkey?
• Does the provider store the data or use it to train models?
• Have the necessary technical and administrative measures been taken?

Key concepts: a quick refresher

Personal data and special categories of personal data

Any information relating to an identified or identifiable natural person is personal data. Categories listed in the law, such as health, biometric data, religious belief and union membership, are special categories of personal data and are subject to stricter conditions. Entering an employee's medical report or a candidate's disability status into an AI tool therefore carries especially high risk.

Data controller and data processor

Your company is the data controller: it decides why and how the data is processed. In most enterprise scenarios, the company providing the AI tool acts as a data processor on your behalf. That relationship should be governed by a contract, and the provider is expected to take adequate security measures.

Cross-border transfers

Many popular AI services process data on servers outside Turkey. KVKK's cross-border transfer provisions were updated by an amendment in 2024, which set out specific mechanisms for transfers. It's important to work out with a specialist which mechanism fits your situation.

The riskiest things employees do most often

• Pasting customer email threads complete with names and contact details
• Uploading a batch of résumés and asking for a candidate comparison
• Having spreadsheets containing customer or staff lists analyzed
• Having documents with health, salary or performance information summarized
• Using tools the company hasn't approved, through personal accounts

Most of this isn't malicious; employees just want to get their work done faster. The problem is that the rules are unclear. That's why setting clear, workable rules is more effective than banning the tools outright.

Practical safeguards: an AI and KVKK compliance checklist

Use the list below as a starting point for governing AI use inside your company:

1. Take inventory: Find out which teams use which AI tools, and for what.
2. Create an approved tools list: Identify tools whose data processing terms have been reviewed, and ask that others not be used with business data.
3. Classify your data: Spell out which data must never be entered into tools (e.g., special categories of data, national ID numbers, financial account details).
4. Build an anonymization habit: Make it standard practice to replace names, numbers and addresses with placeholders like [CUSTOMER] and [PHONE].
5. Review contracts: For enterprise tools, check the data processing agreement, retention periods and model training terms.
6. Review your privacy notices: If you carry out AI-assisted processing, assess whether your privacy notices cover it.
7. Update your VERBİS records: If you're required to register with VERBİS (Turkey's data controller registry), reflect the new processing activities.
8. Train employees: Use a short, example-driven session to explain what's allowed and what isn't.
9. Define an incident procedure: Set out what to do, and whom to notify, when sensitive data is entered by mistake.

An anonymization example

A simple example for your employees makes the rule concrete:

Don't write this:
"Ayşe Yılmaz (0532 xxx xx xx) is complaining that her order is late.
Write her a reply."

Write this instead:
"[CUSTOMER] is complaining that their order is two days late.
Write a short reply that apologizes and offers a solution."

The reply is just as good, and the personal data never enters the tool.

Automated decisions and the data subject's rights

Article 11 of KVKK gives data subjects the right to object to an outcome against them that arises from their data being analyzed exclusively by automated systems. This provision is especially important where AI is part of a decision-making process.

For example, a system that rejects an application based solely on an AI score, automatically screens out a candidate, or lowers a customer's credit limit without human review directly triggers this right. The practical advice: for decisions with significant consequences for people, use AI as a tool that makes recommendations, let an authorized employee make the final call and keep a record of that review. Also define a clear process for how people can submit objections and information requests.

When integrating AI into your own systems

If you're integrating AI into your CRM, support system or internal applications, compliance should be part of the design from the start. That's far easier than fixing it later. The main points to address:

• Limiting the data sent to the model to the minimum the task requires
• Masking personal data before it's sent to the model
• Securing the model provider's data retention and training terms by contract
• Keeping access permissions and processing logs
• Assessing the impact of automated decisions on the people affected

In the AI integrations we build at Weras Labs, we address measures like data minimization and masking at the design stage. We always stress, though, that the legal assessment should be done together with the client's legal counsel.

Documentation matters as much as technical measures. A short document recording which categories of personal data the integration processes, which services the data is sent to, how long it's kept and which security measures are in place makes life much easier during internal audits and any complaint or investigation. Update it with every significant change to the project.

Conclusion

AI and KVKK aren't at odds, but careless use creates serious risk. Knowing which tools are in use, stripping personal data before it goes into them, working with approved tools and giving employees clear rules makes most of that risk manageable. For questions specific to your situation, always get advice from a legal professional.