Most AI projects work with customer, employee or candidate data: chatbot conversations, CRM records, support tickets. That is why data protection and AI is a design issue to address at the start of a project, not at the end. Fixes made later are both costly and risky.
This guide gives a general overview of the obligations of Turkey's Personal Data Protection Law (Law No. 6698, known as KVKK) that stand out in AI projects, common mistakes and a practical checklist you can use before a project starts. The content is for general information; we recommend getting your legal advisor's opinion for your own scenario.
Where is personal data processed in AI projects?
Personal data can be processed throughout the project's life cycle, not just at a single point. The first step is to make these points visible.
- Data collection: Chatbot conversations, forms, call recordings and emails.
- Knowledge sources: The documents and records the AI consults when generating answers.
- Model and service providers: The cloud services and AI APIs where data is processed.
- Logs and reporting: Conversation histories, analytics dashboards and exported reports.
Key principles of the law in AI projects
The law's general principles apply to AI projects as well. The table below summarizes the concrete questions these principles turn into within a project.
| Principle / obligation | Question to ask in the project |
|---|---|
| Purpose limitation and proportionality | Which data does this scenario actually need? |
| Legal basis | On which processing condition does the processing rely; is explicit consent required? |
| Duty to inform | Are users informed about how their data is processed? |
| Data security | How are access rights, encryption and logging handled? |
| Cross-border transfer | Is data processed on a server abroad, and which transfer mechanism is relied on? |
| Retention and deletion | How long are conversation logs kept and how are they deleted? |
Turkey's Personal Data Protection Authority has also published recommendations on protecting personal data in the field of AI. These recommendations offer a good starting framework for projects on topics such as data minimization, transparency and risk assessment.
AI services abroad and data transfer
Many AI models and cloud services run on servers abroad. In that case, personal data may be transferred abroad and the law's cross-border transfer provisions come into play.
What to watch in practice
Find out in which country the provider processes data, whether it uses data for model training and which contractual safeguards it offers. Amendments made in 2024 defined mechanisms such as standard contracts for cross-border transfers; determine which mechanism suits you together with your legal advisor.
Minimizing data is the strongest safeguard
Never sending unnecessary or special categories of data, such as ID numbers or health information, to an AI service removes much of the risk from the start. Use masking and anonymization wherever possible.
Common mistakes
- Having the chatbot ask users for more information than necessary.
- Not updating the privacy notice to cover the use of AI.
- Turning a blind eye to employees copying customer data into unapproved AI tools.
- Not setting a retention period for conversation logs.
- Not reviewing provider contracts for data processing terms.
A 5-step checklist before the project starts
- Create a data inventory: List which personal data the project uses, where it comes from and where it is processed.
- Determine the legal basis: Clarify the legal ground for each processing activity.
- Design notice and consent flows: Add the points where users are informed and, if needed, give consent.
- Assess service providers: Check server location, data use terms and the transfer mechanism.
- Write access, retention and deletion rules: Document who can access which data and when logs are deleted.
Privacy-conscious AI projects with All Inn Agency
All Inn Agency's AI integration service designs projects around data minimization, role-based access and transparent data flows, and prepares the technical documentation your legal advisor needs for their assessment. We organize your data infrastructure through our data and automation work.
To see whether your data is ready for a project, take a look at our data preparation checklist. Let's assess your project together: talk to the assistant on the homepage or reach us via the contact page.
Frequently asked questions
Not in every case; it depends on the legal ground the processing relies on. For example, information needed to answer a request may rely on a different processing condition, while processing for marketing usually requires explicit consent. Consult your legal advisor for your specific scenario.
You can, but if personal data is transferred, you must rely on a mechanism that complies with the law's cross-border transfer provisions. Reducing or masking personal data before sending it to the service lowers the risk significantly.
If AI use introduces new processing purposes, recipient groups or transfers, the privacy notice needs to be updated to cover them.
Yes. Data copied into unapproved tools can leave your control. Create a written usage policy that defines which tools can be used with which data, and inform the team.
Logs should be kept only as long as needed for the purpose they are processed for. Set the retention period according to the purpose and legal obligations, and put a process in place to delete logs when it expires.
Addressed at the start, it causes no significant delay; on the contrary, it prevents costly changes later. The real delay happens when compliance is noticed close to launch.
Move your workflow forward with a measurable goal
Let's clarify which process you want to improve together. From needs analysis to a delivery plan — let's talk through the roadmap.