If an AI system processes personal data, every data protection rule still applies: you need a defined purpose and a lawful basis, you use only the data you need, you tell people, you keep the data secure and you delete it when its time is up. AI does not change these obligations. What it changes is how hard it becomes to see where the data goes, how long it stays and who handles it.
This article walks through 10 checks to run before personal data goes anywhere near an AI project. They cover KVKK, Türkiye's data protection law, and the EU's GDPR in general terms. In our AI consulting work we put these checks on the table on day one of technical design, because privacy added later is both expensive and incomplete.
This is general guidance, not legal advice. Work through your specific case with a lawyer.
How do data protection laws apply to AI projects?
Both KVKK (Türkiye's Personal Data Protection Law No. 6698) and GDPR treat any information about an identified or identifiable person as personal data. A customer email, a call recording, a résumé, an invoice or a support ticket all qualify. Sending that data to a language model, loading it into a vector database or training a model on it is processing under both laws.
That is why the roles need to be clear from the start:
- Data controller: the party that decides why and how data is processed. In most projects, that is your company.
- Data processor: the party that processes data on your behalf, such as a model provider, a cloud service or the team that builds the system.
- Data subject: the person whose data is processed: a customer, an employee or a job applicant.
The core principles carry over unchanged: lawfulness and fairness, accuracy, a specific and legitimate purpose, processing that is relevant, limited and proportionate, and retention only for as long as needed. Each check below applies one of them to AI.
Which 10 checks should you run before using personal data with AI?
Run this list with your team once before the project starts and again before go-live.
- Are the purpose and lawful basis written down? "Improve customer service" is too broad. Write something specific, such as "classify support tickets by topic." Then decide which lawful basis the processing rests on: performance of a contract, a legal obligation, legitimate interests or explicit consent, among others. Consent is not the only option, and it is often not the best one.
- Do you know exactly which data you are using? List every field the model will see: name, phone, address, order history, free-text notes. Free-text fields carry the most risk, because a customer may have typed a health condition or an ID number into a support message. Special categories such as health, biometric data, religious beliefs or union membership are subject to much stricter conditions under both laws.
- Are you using more data than you need? A model does not need a customer's name to work out what a ticket is about. Mask the data, replace identifiers with pseudonyms or, where possible, anonymize it before it reaches the model. Truly anonymized data falls outside both KVKK and GDPR; pseudonymized data is still personal data.
- Have people been told? Your privacy notice should state clearly that data is processed in an AI-assisted system, for what purpose and who receives it. If you rely on consent, it must be specific, informed and freely given, and it should not be made a condition of using a service.
- What does the vendor do with the data? Read the model provider's contract and data policy. Is your data used to train models? How long is it kept? Who can access it? Enterprise tiers and free consumer tiers can differ sharply here. Sign a written agreement with every processor that spells out the security obligations.
- Does the data leave the country? Most cloud-hosted models run on servers outside Türkiye, and often outside the EU. Under KVKK this is a cross-border transfer with its own rules; a 2024 amendment introduced tools such as standard contracts, which must be notified to the Turkish authority. Under GDPR, transfers outside the EU need a mechanism such as an adequacy decision or standard contractual clauses. Get the processing region confirmed in writing.
- Who can access what? An assistant that works with company documents should answer each user only from documents that user is allowed to see. Otherwise a detail from an HR file can surface as the answer to a sales rep's question. Role-based permissions, encryption, access logs and secure storage of API keys are the baseline.
- How long is data kept, and how is it deleted? AI systems pile up data in unexpected places: prompt logs, chat histories, vector indexes, error logs and backups. Set a retention period for each one, and plan how you will remove a person's data from all of them when they ask for erasure.
- Does the model make decisions about people? KVKK gives people the right to object to an adverse outcome that results solely from automated analysis of their data, and GDPR restricts decisions based solely on automated processing that significantly affect them. For hiring, credit, pricing or account closures, treat the model's output as a recommendation and leave the final call to a person. Assume the model can be wrong or biased, and spot-check its outputs regularly.
- Are you ready for requests and breaches? People can ask whether their data is processed and request correction or erasure. KVKK requires a response within thirty days at the latest; GDPR generally within one month. If a breach occurs, both regimes expect the authority to be notified within 72 hours. Update your records of processing, and your VERBİS entry if you must register in Türkiye.
Which AI uses need extra care?
Not every AI use carries the same risk. Be stricter in these scenarios:
- Employees pasting data into general chat tools: the most common and least visible risk. Write a one-page rule on approved tools and data that must never go into them.
- Assistants that work with company documents: in systems that search documents and pass them to the model as context, permission checks belong in the retrieval step. We explain this architecture in What Is RAG?
- Training or fine-tuning a model on your own data: once a model has learned from data, taking it back out is very hard. Clean the training data first, strip personal data and record which dataset was used.
- Audio and video recordings: transcribing or summarizing calls and meetings is processing personal data. If a voice or face is used to identify someone, you may be dealing with biometric data, a special category.
- Agents with system access: agents that send emails, update records or reach customer data need least-privilege access. See our article on autonomous AI agents.
When does GDPR apply, and where does it go further than KVKK?
If you offer goods or services to people in the European Union or monitor their behavior, GDPR can apply to you even if your company is based in Türkiye. GDPR and KVKK grow from the same approach, and all ten checks above hold under both. In some areas GDPR is more detailed:
- A data protection impact assessment (DPIA) is mandatory for processing likely to pose a high risk.
- The required contents of the controller–processor agreement are listed explicitly.
- The right not to be subject to decisions based solely on automated processing, where they significantly affect a person, is set out on its own.
- Breaches must be reported to the supervisory authority within 72 hours of becoming aware of them.
The EU also has the AI Act, a regulation specific to AI systems that is being applied in phases. If you have users in both Türkiye and the EU, taking the stricter rule as your baseline is easier than running two processes. For the security foundations, see our cybersecurity checklist.
Data the model never sees is data that can never leak.
Frequently asked questions
Is it illegal to paste customer data into a general chat tool?
Not automatically, but lawful basis, transparency, cross-border transfer and vendor storage are usually unclear. The safest rule is that personal data never goes into tools without an enterprise agreement.
Do KVKK and GDPR apply if we work with anonymized data?
Data that can no longer be linked back to a person in any way is outside their scope. Deleting the name is rarely enough, though; an address, a date or details in free text can make a person identifiable again.
Does getting consent solve everything?
No. Consent can be withdrawn, cannot be tied to a service and does not exempt you from the other principles. For most business processes, contract performance or legitimate interests is often a better fit.
If we run the model on our own servers, do the obligations go away?
They do not go away, but they shrink. Cross-border transfer and third-party vendor risk largely disappear, while purpose, minimization, security, retention and data subject rights still apply in full.
Where to start?
Pick one process you want to handle with AI and answer these ten questions in writing for that process. Every question you cannot answer goes on the agenda for the next project meeting. That short document gives your legal and technical teams a shared language.
If you want to plan an AI project that works with personal data on a secure architecture, get in touch.