KVKK in Brief — for AI Builders
Türkiye's data protection regime rests on Law No. 6698 on the Protection of Personal Data (KVKK), in force since 2016, supervised by the Kişisel Verileri Koruma Kurumu (the Authority) and its decision-making board, the Kurul. It is GDPR-adjacent in structure but not identical — assuming GDPR compliance transfers one-to-one is the most common mistake foreign AI vendors make.
The two roles your architecture must assign
- Veri sorumlusu (data controller) — determines purposes and means of processing. In an agent deployment this is normally the customer organization.
- Veri işleyen (data processor) — processes on the controller's behalf. A cloud LLM provider, a hosting company, or an integrator running the agent typically sits here, under contract.
Getting this split explicit in contracts matters because obligations (security measures, breach notification, registration) attach differently to each role.
Core principles (Art. 4)
Processing must be lawful and fair, accurate and current where necessary, for specified, explicit and legitimate purposes, relevant and limited to the purpose (data minimization), and retained no longer than needed. Every one of these has a direct architectural consequence for agents — see Deployment Patterns — KVKK-Aware Agent Architecture.
Lawful bases (Art. 5)
Processing requires açık rıza (explicit consent) unless one of the statutory exceptions applies — including: expressly provided by law; necessary for a contract; the controller's legal obligation; data made public by the subject; establishment or protection of a legal claim; and the controller's legitimate interest provided fundamental rights are not harmed. Special categories (health, biometrics, religion, etc., Art. 6) carry stricter rules.
A practical consequence: consent is the fallback, not the default design. Well-scoped agent use cases usually stand on contract necessity or legitimate interest — but that analysis must be documented per use case.
Where consent is the basis: a February 2026 Board decision (2026/347) requires the aydınlatma metni (notification text) and the açık rıza metni (consent text) to be two separate documents, not one bundled form. An agent onboarding flow that combines them into a single "accept" click is out of date. See KVKK + AI Developments — 2025 H2 to 2026 H1.
The obligations that follow the agent
- Aydınlatma yükümlülüğü (Art. 10) — data subjects must be informed about what is processed, why, and to whom it flows. If an agent introduces new processing, the privacy notices must say so.
- VERBİS — controllers above thresholds must register processing activities in the national registry.
- Security measures (Art. 12) — appropriate technical and organizational measures; the Kurul publishes guidance the market treats as the baseline. If they fail, Art. 12/5 starts a 72-hour breach-notification clock — see Breach Notification — the 72-Hour Rule for AI Incidents for what that means for an agent.
- Cross-border transfers (Art. 9) — the topic that decides most AI architecture debates in Türkiye; it changed materially in 2024. See Cross-Border Transfers After the 2024 Reform.
AI-specific guidance built on top of this
The principles above are the foundation; KVKK has since published guidance that applies them directly to AI systems: Generative AI Guide (15 Soruda) — What KVKK Actually Said (Nov 2025, generative AI specifically) and Etken Yapay Zekâ (Agentic AI) Guidance — KVKK's March 2026 Framework (Mar 2026, autonomous/multi-agent systems). Read this page first, then those.
---
Educational reference maintained by Avalanche AI — not legal advice. Verify against current official texts at kvkk.gov.tr before relying on it.