# KVKK-Compliant AI: What Should Organizations Look Out For? - Published: 2026-10-27 - Source: https://www.cbot.ai/kvkk-compliant-ai-what-should-organizations-look-out-for/ In generative AI, voice AI and chatbot projects, KVKK compliance should be addressed from the first day of design, not after the system is finished. Five core principles, a five-step roadmap and frequently asked questions for organizations. A customer calls their bank's voice AI agent to check their credit card balance. The AI answers within seconds, the customer does not wait and the request is completed. But what happens to the customer's personal data along the way? Is the call recorded? Where is the data processed? Can the AI use this information for other purposes? As generative AI (GenAI), [voice AI](https://www.cbot.ai/cbot-speech-overview/) and [chatbot technologies](https://www.cbot.ai/messaging-workflow-ai-agents/) transform customer experience, they raise an important question for organizations: **How should AI systems be designed to comply with KVKK, Türkiye's Personal Data Protection Law?** The [Generative AI and Personal Data Protection Guide](https://www.kvkk.gov.tr/Icerik/8547/uretken-yapay-zeka-ve-kisisel-verilerin-korunmasi-rehberi-15-soruda) published by Türkiye's Personal Data Protection Authority sets out an important framework for protecting personal data while AI systems are developed and used. **The core message is clear: KVKK compliance is not a detail to check once an AI project is finished. It is something to address from the very first design decision.** ## Are AI Systems Subject to KVKK? Yes. If AI systems process personal data, these activities fall within the scope of [Personal Data Protection Law No. 6698](https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5). Processing personal data does not only mean storing it. Collecting data, analyzing it, transferring it to other systems or using it so that the AI can generate a response can all count as data processing. For example, if [a bank's](https://www.cbot.ai/industries-banking/) AI agent accesses a customer's account details, [an insurer's](https://www.cbot.ai/insurance-private-pensions/) chatbot reviews policy information, or a contact center's voice AI system processes customer calls, personal data protection obligations apply. What matters here is less the AI model being used and more which data the system processes, for what purposes and under what conditions. ## 5 Core Principles for KVKK-Compliant AI ### 1. Process Only the Data You Need AI projects often assume that more data always leads to better results. When personal data is involved, however, this approach can create unnecessary risk. [Article 4 of KVKK](https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5) requires personal data to be processed for specific, explicit and legitimate purposes, and in a way that is relevant, limited and proportionate to those purposes. For example, an AI agent that checks a customer's order status may not need access to that customer's entire purchase history. Organizations should therefore decide in advance which data will be passed to AI systems. Data minimization supports KVKK compliance and reduces the security risks that come with unnecessary data access. ### 2. Know Where Your Data Is Processed One of the most critical questions in generative AI applications is [which infrastructure](https://www.cbot.ai/deployment-options/) processes the data. Especially when cloud-based [large language models](https://www.cbot.ai/what-is-an-llm-and-how-does-it-work/) are used, personal data may be shared with third-party service providers or transferred abroad. That is why organizations need to ask their service providers the following questions: - In which countries is personal data processed and stored? - Who can access the data? - Is customer data used to train models? - How long is the data kept, and how is it deleted? - If data is transferred abroad, which legal mechanism does the transfer rely on? [Article 9 of KVKK](https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5) sets specific conditions for transferring personal data abroad. **Keeping data in a secure cloud environment does not, on its own, mean KVKK compliance.** The legal basis for processing, the conditions of transfer and the responsibilities of each party also need to be assessed. ### 3. Ensure Transparency and Human Oversight When customers interact with an AI-powered system, they should be able to understand the purposes for which their personal data is processed. Under [Article 10 of KVKK](https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5), data controllers have a duty to inform. This duty also applies to processes that use AI. The role of AI should be clearly defined, especially in areas such as credit assessment, insurance transactions or the classification of customer requests. In addition, [Article 11 of KVKK](https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5) gives individuals the right to object to outcomes against them that result from analysis carried out exclusively by automated systems. For this reason, it is important for organizations to put [human oversight and objection mechanisms](https://www.cbot.ai/ai-governance-safety/) in place according to the nature of the decision. ### 4. Design KVKK-Compliant Voice AI and Chatbot Systems Because voice AI agents and chatbots communicate directly with customers, they are among the applications where personal data security is most visible. For example, a bank's [voice AI agent](https://www.cbot.ai/on-premise-voice-ai-for-banks/) should apply appropriate identity verification checks before sharing account details. AI used in a contact center should process call recordings only within defined purposes and retention periods. **When designing KVKK-compliant voice AI systems, the following points deserve particular attention:** - The purposes for which call recordings and transcripts are processed - How identity verification and access rights are managed - Masking sensitive information where needed - Whether call data is used in model development - How data is stored, deleted and shared with third parties There is an important detail here: a voice recording is not special category personal data in every case. However, processing voice data with biometric methods to uniquely identify a person can bring additional obligations that apply to special category personal data. The Personal Data Protection Authority's [generative AI guide](https://www.kvkk.gov.tr/Icerik/8547/uretken-yapay-zeka-ve-kisisel-verilerin-korunmasi-rehberi-15-soruda) highlights the importance of applying data protection principles throughout the life cycle of AI systems. At CBOT, we have been working on [enterprise AI](https://www.cbot.ai/cbot-platform-overview/) and voice AI technologies since 2015. Our experience in banking, finance, retail and customer service has shown us something important: **Data security in AI depends not only on the choice of model, but also on how the system is integrated into the organization's infrastructure.** That is why voice AI and chatbot projects should address [secure integrations](https://www.cbot.ai/integrations/), data access controls and enterprise data management together. ### 5. Audit Security Continuously Data security in AI systems does not end when the application goes live. Models are updated, new data sources are added and systems are integrated into different business processes. Each of these changes can create new security risks. [Article 12 of KVKK](https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5) requires data controllers to take the technical and administrative measures needed to keep personal data secure. In this context, organizations should regularly review access controls, data flows, retention policies and security tests. In generative AI systems in particular, measures should also be taken against attacks that use [manipulative prompts to trigger unauthorized data sharing](https://www.cbot.ai/resources/playbooks/voiceaiplaybook/security-and-compliance/). ## How Should Organizations Start KVKK-Compliant AI Projects? KVKK compliance should not be seen as the responsibility of legal or information security teams alone. Technology, operations and business units need to work together. Here is a five-step roadmap for enterprise AI projects: **1. Build a data inventory.** Identify which personal data the AI system accesses, where it comes from and for what purposes it is processed. **2. Clarify the legal basis.** Assess processing activities under [Articles 5 and, where relevant, 6 of KVKK](https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5). Remember that not every processing activity has to rely on explicit consent. **3. Assess the technology infrastructure.** Review the models, service providers and integrations in use, as well as any potential transfers of data abroad. **4. Build security into the design.** Plan measures such as data minimization, masking, access control and log management from the start of the project. **5. Monitor and audit continuously.** Regularly assess model updates, data flows and security risks. This approach matters especially in sectors that process large volumes of personal data, such as [banking](https://www.cbot.ai/industries-banking/), [insurance](https://www.cbot.ai/insurance-private-pensions/), [telecommunications](https://www.cbot.ai/telecom/), [retail and e-commerce](https://www.cbot.ai/retail-e-commerce/). ## Conclusion: Trustworthy AI Starts with the Right Data Management Measuring the success of AI projects only by automation rate, response time or cost advantage is not enough. How personal data is protected is also an important part of success. The Personal Data Protection Authority's [Generative AI and Personal Data Protection Guide](https://www.kvkk.gov.tr/Icerik/8547/uretken-yapay-zeka-ve-kisisel-verilerin-korunmasi-rehberi-15-soruda) makes it clear that data protection principles must be considered across the entire life cycle of these systems. At CBOT, we believe that sustainable success in enterprise AI depends as much on [trustworthy data management](https://www.cbot.ai/not-the-model-but-sovereignty-the-new-line-of-division-for-artificial-intelligence-in-banking/) and well-designed processes as on strong technology. Because what will set organizations apart in the future is not only how effectively they use AI, but **how responsibly and reliably they manage it.** ## FAQ ### What is KVKK-compliant AI? KVKK-compliant AI refers to AI systems whose personal data processing is designed and managed in line with the applicable provisions of Law No. 6698. Compliance depends not only on the technology, but also on the purposes of processing, the legal basis, security measures and organizational processes. ### How is KVKK-compliant voice AI developed? In voice AI systems, the purposes and legal basis for processing call recordings should be defined, access rights limited, retention periods set and the necessary security controls applied. Identity verification and third-party integrations should also be assessed. ### Can chatbots use customer data to train AI? Using customer data to train models can be a separate processing activity. Its legal basis, purpose, the data minimization principle and other relevant KVKK obligations should be assessed separately. ### Can data in AI systems be transferred abroad? Yes, but transferring personal data abroad must meet the conditions in Article 9 of KVKK. The cloud infrastructure or AI provider being used does not remove these transfer obligations on its own.