Chatbots, image and voice recognition systems, generative AI tools, and automated scoring or profiling applications are being rapidly integrated into everyday business processes. Most of these systems process personal data belonging to customers, employees, or third parties during their training and operation. The use of AI tools does not remove the obligations under Law No. 6698 on the Protection of Personal Data ("KVKK"); on the contrary, as the volume and complexity of data processing grows, so does the importance of these obligations.
The general principles set out in Article 4 of the KVKK — lawfulness and fairness, accuracy, processing for specified and legitimate purposes, proportionality, and limited retention — apply equally to AI projects. The principle of proportionality in particular is often in tension with the tendency of AI systems to collect as much data as possible for better performance; the data processed must remain limited to what is necessary for the purpose. Using personal data to train or operate an AI model must be based on one of the processing conditions listed in Articles 5 and 6 of the KVKK, and the data controller must inform data subjects about this processing activity under Article 10. Where the AI service runs on a server or through a provider located abroad, the KVKK's rules on cross-border data transfer must also be separately assessed.
The right, found in the EU's General Data Protection Regulation (GDPR), not to be subject to a decision based solely on automated processing has no direct equivalent under the KVKK; this calls for additional care in automated decision-making processes such as credit scoring, recruitment pre-screening, or risk assessment. Non-binding guidance documents published by the Personal Data Protection Board on artificial intelligence also recommend prioritizing data minimization, transparency, and human oversight. Businesses using AI tools should prepare an inventory showing which personal data is processed for which purpose, update their privacy notices and data processing agreements to cover AI use, and clearly regulate data transfer and security obligations in their contracts with vendors.