KVKK Compliance and Generative AI at Work: A Policy Guide

Using generative AI tools to summarize text, draft an email or put a report together has become an everyday habit at many companies. The question on managers' minds, though, is a simple one: what happens when an employee types customer or candidate information into these tools?

In Türkiye, the first document to consult on this question is the Guide on Generative AI and the Protection of Personal Data (in 15 Questions), published in November 2025 by the Kişisel Verileri Koruma Kurumu (KVKK, Türkiye's Personal Data Protection Authority). The guide aims to give data controllers direction on personal data processing activities in generative AI systems. In this article, we summarize the parts of the guide that concern in-house use and derive a policy outline from them. The article reports what the guide says; it is not a substitute for legal advice.

The Law is technology-neutral

The guide's starting point is clear: Law No. 6698 (Türkiye's Personal Data Protection Law) provides a technology-neutral framework and applies in every situation where personal data is processed. Generative AI systems fall within that scope as well. The processing conditions in the Law contain no explicit reference to AI; according to the guide, this does not mean that data cannot be processed with these tools, but that one of the existing conditions must be relied on.

The guide's examples make the difference clear. For a design agency that enters only general themes, such as a discount poster, and receives output containing no personal data, there is, as a rule, no personal data processing activity to speak of. By contrast, a tool that analyzes materials from past training sessions containing participants' names, images and voice recordings is treated as falling within the scope of the Law. The guide also underlines one further point: even if the input contains no personal data, the model's output can generate information about a real person, and this can count as data processing.

Anonymous data, on the other hand, falls outside the scope of the Law. According to the guide, however, the fact that data is genuinely anonymous must be demonstrated through technical methods and objective criteria; until anonymization is complete, the data retains its status as personal data.

Who is the data controller?

The guide's recruitment example is directly instructive for companies. A human resources department uses a language model that summarizes and scores candidates' CVs and application forms. Because the company decides which data is uploaded and how the output is assessed, a company that integrates a ready-made model into its own operations can be regarded as the data controller for this processing.

The guide adds two further warnings. First, roles are determined not by the wording of contracts but by the parties' actual control. Second, with "closed-access" models, the organization using the tool may not always have access to all information about the processing activities; this access to information is also taken into account when roles are determined.

A separate legal basis for each processing activity

According to the guide, running a language model can involve more than one processing activity: processing the user's input to run the model, using the same data to improve the model, and using outputs for personalization or improvement. A separate processing condition may need to be identified for each of them.

Other points that stand out from the guide:

• There is no hierarchy among the processing conditions in the Law. If a processing condition other than explicit consent exists, obtaining explicit consent on top of it can, according to the guide, be deceptive and amount to an abuse of rights.
• Explicit consent obtained for the use of AI does not cover the development of the model.
• Legitimate interest is not a blanket condition covering every kind of processing; it requires a balancing test.
• Being accessible on the internet does not mean that data can be used for any purpose. In the guide's words: "data that is freely accessible to everyone does not mean data that is open to being freely processed by everyone".
• For special categories of personal data, such as health and biometric data, the Law provides neither a contract condition nor a legitimate-interest condition; additional measures are required for such data.

Providers based abroad

The providers of a significant share of widely used tools are based abroad. According to the guide, if a data controller in Türkiye uses the generative AI system of a provider established abroad and personal data is transferred abroad in this way, the transfer must comply with Article 9 of the Law and with the regulation on transfers abroad published in the Resmî Gazete (Türkiye's Official Gazette) on 10 July 2024. The guide also refers to the Authority's separate "Kişisel Verilerin Yurt Dışına Aktarılması Rehberi" (Guide on the Transfer of Personal Data Abroad).

Accuracy of outputs and automated decisions

The guide points out that generative AI outputs can be incorrect, inconsistent, biased or misleading, and it draws attention to the risk of "hallucination". It recommends that outputs containing personal data be monitored regularly and, where necessary, supported by human oversight. According to the guide, if a model that summarizes customer complaints reflects personal data incompletely or incorrectly, this can amount to a breach of the accuracy principle.

When AI is involved in decision-making in areas such as recruitment, credit and insurance, the right under Article 11 of the Law to object to a result that goes against a person after analysis carried out solely by automated systems becomes important. The guide recommends caution in putting these systems into use if the risks cannot be sufficiently foreseen or managed.

Security measures and employee awareness

Under Article 12 of the Law, the guide lists technical and administrative measures by way of example. The ones that stand out for in-house use:

• Conducting a data protection impact assessment (as good practice),
• Technical controls against known vulnerabilities such as prompt injection and jailbreaks,
• Multi-factor authentication,
• Storing transaction records and system logs in a secure and auditable manner,
• Awareness and training processes for employees.

The part of the guide addressed to individuals can also be turned directly into an employee instruction. It recommends not sharing identifying data such as full name, address, phone number and ID details, or information about third parties; preferring anonymized and generalized wording; and reviewing privacy settings. It also stresses that information relating to health, finances and legal proceedings should not be shared.

An outline for an internal company policy

The headings below are a framework derived from the findings in the guide; each organization needs to adapt it to its own data inventory and to the assessment of its legal department.

1. Scope and approved tools. Specify which tools may be used, with which type of account and for which tasks.
2. Data classes. Clearly separate the information that may and may not be entered into the tools; create a clear "do not enter" list for special categories of personal data, customer and candidate information, and identifiers.
3. Record of purpose and legal basis. For every use case in which personal data is processed, document the purpose and the processing condition relied on, separately for each.
4. Assessment of transfers abroad. At the procurement stage, examine the provider's location and the mechanism the transfer relies on.
5. Output review. Make human approval mandatory for outputs that contain personal data or have consequences for an individual.
6. Automated decisions. In areas such as recruitment, position AI solely as a decision-support tool and define a route for objection.
7. Security and logging. Tie multi-factor authentication, access permissions and usage logs to the policy.
8. Training and review. Make employee training a regular activity; update the policy as tools and risks change.

Conclusion

The KVKK guide is not a document that bans generative AI; it shows how the principles of existing law apply to these tools. For companies, the real work is to translate these principles into the small decisions employees make every day: what gets typed into the tool, how the output is checked and where the data goes.

From Orient Global's perspective, the practical starting point is to first see which tools are actually in use at the company and which types of data are entered into them. A policy written before this inventory exists may stay on paper only; the inventory, in turn, gives both the legal department's assessment and employee training a concrete footing.

This article summarizes the content of the KVKK guide for informational purposes and is not a substitute for legal advice. For specific situations, consult your legal counsel.

#interimmanagement #forwarddeployedengineering