Turkey's data protection law (KVKK, Law 6698) does not mention artificial intelligence. It does not need to: a prompt containing personal data is processing, and a model running abroad is a transfer. Below is what the law asks, article by article, and what kind of mechanism it takes to be able to answer.
This page makes no compliance claim. It is not legal advice, it does not assert that any product makes an organization compliant, and it does not interpret the law on your behalf. It states what the legislation asks — with the article references and sources — and separates that from what a technical control can and cannot do. The determination is your legal team's.
All eight remaining questions depend on this one. An organization that cannot answer it is discussing its legal basis and its transfer regime in the abstract. Without measurement, the rest is assumption.
A customer name, a national ID, an IBAN, a health detail or the contents of a personnel file does not stop being personal data because it was typed into a chat box. Special categories are subject to a separate regime under KVKK art. 6.
KVKK art. 5 lists the conditions for processing: explicit consent, or one of the other enumerated grounds. For third-party data an employee pastes into a prompt on their own initiative, what that basis is remains a question the organization has to answer.
Most models in use run outside the country. KVKK art. 9 (as amended by Law 7499 art. 34, in force 01.06.2024) makes a transfer conditional on one of the art. 5/6 grounds plus an adequacy decision for the receiving country, sector or organization; where there is no adequacy decision, appropriate-safeguard mechanisms come into play.
KVKK art. 10 places a duty to inform on the data controller. Most organizations wrote their notice before transfers to AI services became routine.
KVKK art. 12(2) is explicit: where personal data is processed on the controller's behalf by another natural or legal person, they are jointly responsible for taking the required measures. The provider's own commitments do not remove your responsibility.
KVKK art. 11 gives the data subject the right to request information about their data and to ask for its correction or deletion. "Was my data sent to an AI model?" is a question that can be asked under that right.
KVKK art. 12(1) requires the controller to take "all necessary technical and administrative measures to provide an appropriate level of security" against unlawful processing and unlawful access. Writing a policy is an administrative measure; the technical measure has to be shown separately.
KVKK art. 4(2)(ç) lists proportionality among the general principles. Pasting an entire customer table to get one question answered may be connected to the purpose and still not be proportionate.
Four of the nine questions above cannot be answered by any product, ours included. Stating that plainly is the point of this page.
What a control can do is supply the factual input the other five questions need — what left, whose it was, where it went, what was stopped, and a record of it. That is a prerequisite for the legal work, not a substitute for it.
Named here for transparency about who wrote this page — and bounded by the section above.
How this differs from an AI gateway, and how it compares to named alternatives, is on the comparison page.
Article numbers and paragraph contents were checked against the official text of Law 6698 on mevzuat.gov.tr, and the article 9 amendment against the Authority's own publications, on 29 August 2026. Where the legislation is quoted, it is quoted; nothing here is paraphrased from memory.