KVKK and Artificial Intelligence: What Do Companies Do?
Automatically translated
WriterArtificial intelligence is used in a large number of business processes, from everyday operations to human resources, customer service marketing. In particular, productive AI tools become easy accessible, enabling employees to create text without any technical infrastructure investment, document analysis, data classification and speed up different business processes. However, this convenience brings a new responsibility for companies: the use of KVKK and AI is managed together.
The customer list of a employee may result in the processing of personal data and even transferring of CVs, employee information, contracts or email contents to an AI tool, depending on the nature of the used system and processing activity. Personal Data Protection Authority (KVK) published in 2025 “The Guide to the Protection of Artificial Intelligence and Personal Data” and published in 2026 a comprehensive framework for the risks in this field with the “Use of Artificial Intelligence Tools” documents.
Why Does Artificial Intelligence Use Important From KVKK Angle?
The relationship of artificial intelligence systems with personal data is not limited only to data upload to the system. Personal data can be processed in different stages during the development, training, testing and use of an artificial intelligence system.
KVKK’s productive AI guide also takes into account that artificial intelligence systems should be evaluated within the Law of personal data processing activities performed throughout the life cycle.
For example, hundreds of employees of a human resources can analyze in an artificial intelligence tool, summarise customer complaints of the customer service team into a model or create different data processing activities to upload a contract with personal information within the law department to the artificial intelligence tool.
What Risks Are From Artificial Intelligence Data Privacy?
Uncontrolled sharing of personal data
User inputs are an important source of data in artificial intelligence tools. Employees can transfer personal data-containing content into the system without being aware of their work.
More sensitive data such as name, surname, phone number, email address or customer information, as well as employees’ performance information, health information or financial information may also be subject to artificial intelligence use.
Where To Know The Data
During the use of an artificial intelligence service, the company’s data can take care of what infrastructure or what service provider is processed.
In cases where foreign service providers are used, companies need to look at not only the service contract, but not data processing conditions and personal data are transferred abroad.
Use of Data to Improve Artificial Intelligence Systems
Some artificial intelligence services may be associated with the development of the content that users provide or the improvement processes of the model. Therefore, it is important to review the data policies and contractual conditions of the service that companies use.
The technical structure of the service used to act through a single general rule should also be evaluated.
Companies First Exchange Artificial Intelligence Inventory
One of the most important steps that can be taken in terms of KVKK compliance is the determination of artificial intelligence tools used in the company.
The use of artificial intelligence in many institutions does not only consist of systems controlled by the IT department. Marketing employees can use content production tools, software teams code assistants, human resources workers candidate analysis tools, sales teams, different artificial intelligence services for customer communication.
Therefore, companies are looking for answers to the following questions:
What AI tools are used?
What departments are using these tools?
Which purpose is used?
What types of data are transferred to the system?
Is personal data transferred?
Are custom-qualified personal data processed?
Does data be transferred to third parties?
Does data work abroad?
What is the data processing terms of the service provider?
Who controls the results created by artificial intelligence?
How Can Employees Prevent Uncontrolled Artificial Intelligence Use?
Shadow Artificial Intelligence Risk
2026 of KVKK “The Use of Artificial Intelligence Tools” The third party and public productive artificial intelligence tools of employees in the document are focused on the use of corporate policy outside. Institution, such uncontrolled use “gölge artificial intelligence ” taking care of the risks that may arise by evaluating under the header.
Shadow artificial intelligence can be considered as the use of artificial intelligence tools that the company does not officially approve or manage.
For example, by uploading customer complaints of a employee to a personal AI account, the summit may occur outside the company’s data processing processes. In this case, the company may be difficult to detect where data is sent or how the service provider processes data.
Artificial Intelligence Policy Prepared
Creating an open and understandable AI usage policy for employees of companies is therefore important. The purpose is not to completely ban artificial intelligence, to carry its use into a controlled corporate framework.
At least in the policy, the following topics may be addressed:
What AI tools can be used,
What tools can not be used,
where personal data may be processed,
Rules to apply for personal data specific,
Sharing of confidential company information,
Use of customer information,
controlling artificial intelligence outputs by human,
Procedure to be monitored in data security breaches,
List of approved artificial intelligence services.
Why Does Data Minimization In Artificial Intelligence Use Important?
One of the basic data protection principles in terms of KVKK is that personal data is connected, limited and measured for certain, open and legitimate purposes and for the purpose they operate. This approach attaches importance to the use of artificial intelligence.
For example, if a customer email from an AI tool is asked to fix it in terms of grammar, it may not always be necessary to transfer all personal information contained in the entire email to the system.
Companies should not only use the data needed in order to be possible, unnecessary personal information should not be sent to the AI system and mask data with appropriate technical methods.
Anonymousization And Masking Can Be Evaluated
Implementation of anonymousization, masking or similar data minimization methods on data to be transferred to the AI tool can reduce risk in some scenarios.
For example, the use of identifiers such as “Customer A” instead of actual customer names may be assessed to remove the phone number or address information required for analysis and transfer only to the system required text.
However, since the data is subject to technical and legal conditions that may not be considered anonymous, it does not mean that only the deletion of names is automatically becoming anonymous.
More Attention on Private Personal Data
Health information, biometric data, genetic data, union membership and similar Home private qualified personal data KVKK predicts a more special protection regime.
The transfer of such data to artificial intelligence systems can create higher risk than ordinary text or data analysis.
AI usage scenarios of companies operating in human resources, health, finance, security and so on have to be more detailed assessment.
For example, the health reports of employees can not be assessed at the same risk level of correction in terms of grammar of a public text with a productive artificial intelligence tool.
Data Transfer to Artificial Intelligence And Overseas
Foreign Transfer Control in Artificial Intelligence Services
One of the issues that may be overlooked in the use of corporate AI is the transfer of personal data abroad.
Changes made in 2024 in Article 9 of Law No. 6698 A new system was created in the transfer of personal data abroad. The changes continued the transition process for certain provisions of the old system while entering into force as of 1 June 2024.
There are different types of transfer mechanisms such as having a qualification decision or providing appropriate assurances within the new system.
Role of Standard Contracts
Data transfer abroad standard contracts also arranged as one of the appropriate methods of assurance.
KVKK states that the standard contracts should be notified within five business days from signing. In order to make this notice, an online module was also created by the Institution.
Artificial Intelligence Outputs Should Be Controlled By Human
It does not mean that a result created by artificial intelligence appears correctly, its necessarily is true.
This is important in terms of personal data. A artificial intelligence system classifies people, assess candidates, create customer profiles or otherwise produce results for individuals, companies need to ignore human audit.
The artificial intelligence guide of KVKK emphasizes the importance of addressing artificial intelligence systems with a transparent, auditable, safe and human-centered approach.
Therefore, it is important to create appropriate human control mechanisms instead of automatic final decision-making of artificial intelligence outputs in decision processes that affect people directly.
How to Install Corporate Governance For Artificial Intelligence Use?
Artificial intelligence is only a subject that can be left to the responsibility of the IT department. Corporate AI management You may need to work with law, information security, KVKK compliance teams, human resources, IT and business units in the model.
Role of Law And Compliance Teams
Legal and compliance teams can contribute to the evaluation of artificial intelligence systems in terms of personal data processing activities.
It will be useful to examine the service contract, data processing conditions, data storage policy, overseas transfer mechanism and other terms, especially before purchasing a new AI service.
Role of Information Security Teams
Information security teams can evaluate technical controls, access authorizations, data loss prevention mechanisms, logging and so on security processes.
This two areas can be addressed together, not only the KVKK compliance, but also contribute to the general information security of the company.
Etken Artificial Intelligence Brings New Risks
It may not be enough to focus only on classic chat robots on artificial intelligence.
KVKK, March 2026 “Etken Artificial Intelligence (Agentic AI)” Published a separate document. The institution pays attention to the increased otonomi level of these systems and the protection of personal data processing capacity.
Artificial intelligence systems, It only refers to systems that can run multiple steps to achieve specific goals instead of responding to a single command from the user, acting according to environmental conditions and start autonomous action in certain sizes.
This development brings a new question in terms of companies: When artificial intelligence is only a tool that analyzes data and interacts with different systems, which data can be accessed and performed?
Therefore, in the future, it may be necessary to evaluate access authorizations and transactions with artificial intelligence tools, not only prompt and data sharing.
Applicable KVKK And Artificial Intelligence Control List For Companies
Companies may use the following basic steps as a checklist while evaluating the use of artificial intelligence:
Set artificial intelligence tools used in the organization.
Identify which department of each vehicle is used.
Classification data types that are transferred to AI systems.
Evaluate the use of personal and private qualified personal data.
Check the data processing conditions of the service provider.
Check whether data is transferred abroad.
Determine the required overseas transfer mechanism.
Create an open AI usage policy for employees.
Select certified AI tools.
Prevent sensitive data from transferring to the system without control technical and administrative measures.
Provide human control for artificial intelligence outputs.
regularly review the use of artificial intelligence.
Evaluate the risks that new AI technologies can create.
Give employees regular data privacy and AI awareness training.
Frequently Asked Questions
Can companies Use Artificial Intelligence Tools like ChatGPT?
Basic issue in terms of KVKK is not the use of the AI tool, but personal data processing activities performed during this use. Companies should evaluate the features of the system they use, processing purpose, data type, legal basis, security measures and transfer size abroad if necessary.
Is It Prohibited to Use Artificial Intelligence of Employees?
Instead of a general ban, controlled and the rules may be more functional to create a designated use policy. The document on the use of productive artificial intelligence in the workplaces of KVKK aims to promote corporate awareness and conscious use.
Is Customer Data Installable to Artificial Intelligence?
The transfer of customer data to the artificial intelligence system is automatically free or prohibited. Data processing purpose, legal reason, data minimization, security, terms of service provider and if necessary, transfer provisions outside the country should be evaluated together.
Who is the KVKK Liability in Artificial Intelligence Use?
In the event of somut, it is necessary to evaluate according to the roles of the company and other actors. Companies cannot eliminate their liability under KVKK in terms of their personal data processing activities.
Can I Completely Remove KVKK Risk For Artificial Intelligence Company?
No. It does not mean that a artificial intelligence tool is technically safe, that the company performs all its obligations under KVKK. Legal basis, purpose, measured, transparency, data secureSubjects such as domestic transfer should also be evaluated if necessary.
Writer
