KVKK-Compliant AI: What Should Organizations Look Out For?
In generative AI, voice AI and chatbot projects, KVKK compliance should be addressed from the first day of design, not after the system is finished. Five core principles, a five-step roadmap and frequently asked questions for organizations.
A customer calls their bank's voice AI agent to check their credit card balance. The AI answers within seconds, the customer does not wait and the request is completed. But what happens to the customer's personal data along the way? Is the call recorded? Where is the data processed? Can the AI use this information for other purposes?
- Is the call recorded?
- Where is the data processed?
- Is it used for other purposes?
As generative AI (GenAI), voice AI and chatbot technologies transform customer experience, they raise an important question for organizations: How should AI systems be designed to comply with KVKK, Türkiye's Personal Data Protection Law?
The Generative AI and Personal Data Protection Guide published by Türkiye's Personal Data Protection Authority sets out an important framework for protecting personal data while AI systems are developed and used.
The core message is clear: KVKK compliance is not a detail to check once an AI project is finished. It is something to address from the very first design decision.
Are AI Systems Subject to KVKK?
Yes. If AI systems process personal data, these activities fall within the scope of Personal Data Protection Law No. 6698.
Processing personal data does not only mean storing it. Collecting data, analyzing it, transferring it to other systems or using it so that the AI can generate a response can all count as data processing.
- Collection
- Analysis
- Transfer
- Response generation
- Retention and deletion
For example, if a bank's AI agent accesses a customer's account details, an insurer's chatbot reviews policy information, or a contact center's voice AI system processes customer calls, personal data protection obligations apply.
What matters here is less the AI model being used and more which data the system processes, for what purposes and under what conditions.
5 Core Principles for KVKK-Compliant AI
Process Only the Data You Need
AI projects often assume that more data always leads to better results. When personal data is involved, however, this approach can create unnecessary risk.
Article 4 of KVKK requires personal data to be processed for specific, explicit and legitimate purposes, and in a way that is relevant, limited and proportionate to those purposes.
For example, an AI agent that checks a customer's order status may not need access to that customer's entire purchase history.
Organizations should therefore decide in advance which data will be passed to AI systems. Data minimization supports KVKK compliance and reduces the security risks that come with unnecessary data access.
Know Where Your Data Is Processed
One of the most critical questions in generative AI applications is which infrastructure processes the data.
Especially when cloud-based large language models are used, personal data may be shared with third-party service providers or transferred abroad.
That is why organizations need to ask their service providers the following questions:
- In which countries is personal data processed and stored?
- Who can access the data?
- Is customer data used to train models?
- How long is the data kept, and how is it deleted?
- If data is transferred abroad, which legal mechanism does the transfer rely on?
Article 9 of KVKK sets specific conditions for transferring personal data abroad.
Keeping data in a secure cloud environment does not, on its own, mean KVKK compliance. The legal basis for processing, the conditions of transfer and the responsibilities of each party also need to be assessed.
Ensure Transparency and Human Oversight
When customers interact with an AI-powered system, they should be able to understand the purposes for which their personal data is processed.
Under Article 10 of KVKK, data controllers have a duty to inform. This duty also applies to processes that use AI.
The role of AI should be clearly defined, especially in areas such as credit assessment, insurance transactions or the classification of customer requests.
In addition, Article 11 of KVKK gives individuals the right to object to outcomes against them that result from analysis carried out exclusively by automated systems.
For this reason, it is important for organizations to put human oversight and objection mechanisms in place according to the nature of the decision.
Design KVKK-Compliant Voice AI and Chatbot Systems
Because voice AI agents and chatbots communicate directly with customers, they are among the applications where personal data security is most visible.
For example, a bank's voice AI agent should apply appropriate identity verification checks before sharing account details. AI used in a contact center should process call recordings only within defined purposes and retention periods.
When designing KVKK-compliant voice AI systems, the following points deserve particular attention:
- The purposes for which call recordings and transcripts are processed
- How identity verification and access rights are managed
- Masking sensitive information where needed
- Whether call data is used in model development
- How data is stored, deleted and shared with third parties
There is an important detail here: a voice recording is not special category personal data in every case. However, processing voice data with biometric methods to uniquely identify a person can bring additional obligations that apply to special category personal data.
Call recording and transcript
Personal dataProcessed within a defined purpose, retention period and access rights.
Biometric voice identification
Special category personal dataWhen voice is processed to uniquely identify a person, additional obligations apply.
The Personal Data Protection Authority's generative AI guide highlights the importance of applying data protection principles throughout the life cycle of AI systems.
At CBOT, we have been working on enterprise AI and voice AI technologies since 2015. Our experience in banking, finance, retail and customer service has shown us something important: Data security in AI depends not only on the choice of model, but also on how the system is integrated into the organization's infrastructure.
That is why voice AI and chatbot projects should address secure integrations, data access controls and enterprise data management together.
Audit Security Continuously
Data security in AI systems does not end when the application goes live.
Models are updated, new data sources are added and systems are integrated into different business processes. Each of these changes can create new security risks.
Article 12 of KVKK requires data controllers to take the technical and administrative measures needed to keep personal data secure.
In this context, organizations should regularly review access controls, data flows, retention policies and security tests.
In generative AI systems in particular, measures should also be taken against attacks that use manipulative prompts to trigger unauthorized data sharing.
How Should Organizations Start KVKK-Compliant AI Projects?
KVKK compliance should not be seen as the responsibility of legal or information security teams alone. Technology, operations and business units need to work together.
- Legal
- Information security
- Technology
- Operations
- Business units
Here is a five-step roadmap for enterprise AI projects:
Build a data inventory
Identify which personal data the AI system accesses, where it comes from and for what purposes it is processed.
Clarify the legal basis
Assess processing activities under Articles 5 and, where relevant, 6 of KVKK. Remember that not every processing activity has to rely on explicit consent.
Assess the technology infrastructure
Review the models, service providers and integrations in use, as well as any potential transfers of data abroad.
Build security into the design
Plan measures such as data minimization, masking, access control and log management from the start of the project.
Monitor and audit continuously
Regularly assess model updates, data flows and security risks.
This approach matters especially in sectors that process large volumes of personal data, such as banking, insurance, telecommunications, retail and e-commerce.
Conclusion: Trustworthy AI Starts with the Right Data Management
Measuring the success of AI projects only by automation rate, response time or cost advantage is not enough. How personal data is protected is also an important part of success.
- Automation rate
- Response time
- Cost advantage
- Personal data protection
The Personal Data Protection Authority's Generative AI and Personal Data Protection Guide makes it clear that data protection principles must be considered across the entire life cycle of these systems.
At CBOT, we believe that sustainable success in enterprise AI depends as much on trustworthy data management and well-designed processes as on strong technology.
Because what will set organizations apart in the future is not only how effectively they use AI, but how responsibly and reliably they manage it.