Turkey - Personal Data Protection Guidelines

Overview

The "Recommendations Guide on the Protection of Personal Data in the Field of Artificial Intelligence" was prepared and published by the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu - KVKK) in September 2021 to provide guidance to developers, manufacturers, service providers and decision makers on how AI activities should be designed and implemented to comply with Law No. 6698. The Guide is advisory rather than legislative, but it frames the privacy considerations that should be embedded across the AI lifecycle and references international frameworks such as the OECD AI Principles and Council of Europe data protection guidance. It promotes privacy‑by‑design, risk‑based oversight, explainability, human oversight and strong technical and organizational safeguards to prevent harm to data subjects.

Definitions

The Guide defines core terms for the Turkish context, aligning with Law No. 6698 terminology: "personal data" (any information relating to an identified or identifiable natural person), "special categories" (sensitive personal data), "data controller" and "data processor" as per roles under the law, and an operational understanding of "AI system" as a lifecycle of systems that process data to make predictions, recommendations or decisions. It stresses that certain outputs or inferences from AI (including inferred sensitive attributes) may themselves constitute personal data under the law.

Governance and Institutional Framework

The Guide urges organisations to embed AI governance into their corporate or institutional data protection frameworks, appointing responsible owners and ensuring board‑level awareness. It recommends clear role allocation between controllers and processors, documented contracts addressing AI‑specific risks, internal approval gates (including DPIA sign‑off), and the creation of interdisciplinary review boards for high‑risk projects. It further recommends coordination with the national regulator (KVKK) and consultation with sectoral supervisors where projects may impact fundamental rights.

Key Focus Areas

Key focus areas described in the Guide include: (1) lawfulness and purpose limitation — defining specific, limited purposes and lawful bases for processing; (2) data minimization and quality — choosing datasets that are necessary and accurate, avoiding or reducing use of special categories; (3) privacy‑enhancing techniques — anonymization, pseudonymization, local processing and differential privacy where appropriate; (4) transparency and information provision — telling data subjects about AI use and meaningful information about automated decisions; (5) human oversight — enabling meaningful human intervention in automated decision‑making; (6) testing and validation — continuous model evaluation for bias, accuracy and drift; (7) security — technical measures including encryption, access control and secure model management; (8) accountability and documentation — records, logs and auditable trails for model training, datasets and decision rationales; and (9) redress and remedies — channels for individuals to query, appeal or seek correction. The Guide stresses particular caution for biometric processing, profiling for legal or significant effects, and public‑sector AI uses affecting individual rights.

Implementation Framework

Implementation is presented as a lifecycle approach: (i) concept and planning — assess necessity and alternatives (including non‑personal data); (ii) design and data collection — adopt privacy‑by‑design, define legal bases, and document datasets; (iii) training and testing — use representative data, test for bias and overfitting, maintain validation datasets and version control; (iv) deployment — enforce access, monitoring and human override; (v) monitoring and update — continuous post‑deployment evaluation for performance and privacy risks; and (vi) decommissioning — secure deletion/archiving and retention limit enforcement. Each phase should produce documentation and evidence for potential regulatory review.

Monitoring and Evaluation

The Guide recommends continuous monitoring mechanisms and periodic audits for AI systems, including automated alerts for performance drift, fairness metrics, and privacy breaches. It suggests publishing internal or sectoral audit summaries and encourages independent third‑party testing and certification where possible. Monitoring should include metrics on accuracy across protected groups, explainability testing and logging of model inputs/outputs to enable investigations of incidents.

Penalties, Liability, and Appeals

While the Guide itself is non‑binding, it clarifies that failure to meet Law No. 6698 obligations may lead to administrative fines and sanctions by the KVKK, and possibly civil or criminal liability under Turkish law. It advises organisations to maintain appeals and redress channels for data subjects, and to design systems to facilitate correction, objection and human review to reduce legal exposure.

Relationship to Other Instruments

The Guide explicitly links its recommendations to domestic law (Law No. 6698) and international instruments. It draws on and encourages alignment with the OECD AI Principles, Council of Europe guidance on AI and data protection, and EU data protection practice (GDPR-related guidance and EDPB/EDPS opinions). This alignment is intended to promote interoperability and support lawful cross‑border data flows with safeguards.

International Alignment

The Recommendations Guide aligns Turkey's data protection framework for artificial intelligence with established international standards and guidelines. During the drafting of the document, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) explicitly drew upon major international benchmarks. These reference frameworks include the "Guidelines on Artificial Intelligence and Data Protection" published by the Council of Europe Directorate General of Human Rights and Rule of Law, the "OECD Recommendations of the Council on Artificial Intelligence" prepared by the OECD, and the Council of Europe's "Draft Ethics Guidelines for Trustworthy AI".

In addition, the Guide references key European instruments in its foundational bibliography to encourage international consistency and interoperability. Specifically, it lists Council of Europe Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, the European Commission's White Paper on Artificial Intelligence, and European Data Protection Supervisor (EDPS) Opinion 4/2020 on the AI White Paper. By grounding its recommendations in these international frameworks, the Guide urges developers, manufacturers, service providers, and decision-makers to adopt design choices and privacy governance mechanisms that remain consistent with both domestic legal requirements under Law No. 6698 and broader international privacy principles.

Implementation Timeline

Sources and References