KVKK in Brief — for AI Builders
Türkiye's data protection regime rests on Law No. 6698 on the Protection of Personal Data (KVKK), in force since 2016, supervised by the Kişisel Verileri Koruma Kurumu (the Authority) and its decision-making board, the Kurul. It is GDPR-adjacent in structure but not identical — assuming GDPR compliance transfers one-to-one is the most common mistake foreign AI vendors make.
The two roles your architecture must assign
- Veri sorumlusu (data controller) — determines purposes and means of processing. In an agent deployment this is normally the customer organization.
- Veri işleyen (data processor) — processes on the controller's behalf. A cloud LLM provider, a hosting company, or an integrator running the agent typically sits here, under contract.
Getting this split explicit in contracts matters because obligations (security measures, breach notification, registration) attach differently to each role.
Core principles (Art. 4)
Processing must be lawful and fair, accurate and current where necessary, for specified, explicit and legitimate purposes, relevant and limited to the purpose (data minimization), and retained no longer than needed. Every one of these has a direct architectural consequence for agents — see Deployment Patterns — KVKK-Aware Agent Architecture.
Lawful bases (Art. 5)
Processing requires açık rıza (explicit consent) unless one of the statutory exceptions applies — including: expressly provided by law; necessary for a contract; the controller's legal obligation; data made public by the subject; establishment or protection of a legal claim; and the controller's legitimate interest provided fundamental rights are not harmed. Special categories (health, biometrics, religion, etc., Art. 6) carry stricter rules.
A practical consequence: consent is the fallback, not the default design. Well-scoped agent use cases usually stand on contract necessity or legitimate interest — but that analysis must be documented per use case.
The obligations that follow the agent
- Aydınlatma yükümlülüğü (Art. 10) — data subjects must be informed about what is processed, why, and to whom it flows. If an agent introduces new processing, the privacy notices must say so.
- VERBİS — controllers above thresholds must register processing activities in the national registry.
- Security measures (Art. 12) — appropriate technical and organizational measures; the Kurul publishes guidance the market treats as the baseline.
- Cross-border transfers (Art. 9) — the topic that decides most AI architecture debates in Türkiye; it changed materially in 2024. See Cross-Border Transfers After the 2024 Reform.
---
Educational reference maintained by Avalanche AI — not legal advice. Verify against current official texts at kvkk.gov.tr before relying on it.