Data Protection In The Field Of Artificial Intelligence

With the rapid spread of artificial intelligence and its integration into every aspect of life, it has become imperative to establish a legal framework governing the secure and ethical development, deployment and use of artificial intelligence systems, taking into account the complexity and specific characteristics of this technology.

Aiming not only to promote the safe, transparent and human rights-respecting development of artificial intelligence technologies, but also to protect the general safety, rights and freedoms of users and society, the European Union’s Artificial Intelligence Act, which came into force on 1 August 2024, is the first detailed legal regulation in this field designed to ensure the ethical development of artificial intelligence and the protection of personal data (“AI Act”).

Unlike developments in the European Union, there is as yet no specific regulation on artificial intelligence in Türkiye. However, with the increasing prevalence of artificial intelligence applications in Türkiye, the establishment of legal and regulatory frameworks in this area has become one of the issues on the agenda.

Under the heading “2.1. Global Trends and Türkiye’s Interaction”, under the heading “Regulatory, Supervisory and Trustworthy Public Administration”, states: “Technological developments and the digitalisation process, which enable the collection, storage and processing of large volumes of data, necessitate the secure, reliable and ethical management of data applications, the development of comprehensive and innovative public policies and the enactment of legal regulations on issues such as personal data security and privacy, cyber security, artificial intelligence, digital competition and digital ethics”, demonstrates that digital transformation in Türkiye is approached not merely as an area of technological development, but also as a strategic policy area requiring a robust legal and governance framework. This approach demonstrates that Türkiye’s regulatory perspective is taking shape in line with the risk-based and people-centered model of the European Union; in particular, it points to the establishment of a legislative framework in the future that will be more holistic and take into account sectoral impacts, particularly in relation to artificial intelligence and the data economy.

Although there is as yet no legislation specific to artificial intelligence in Türkiye, there have been notable developments in the areas of data protection and cyber security. Emphasizing that, whilst generative AI applications offer innovative opportunities and benefits, they also entail certain risks from an ethical, legal and societal perspective, the Authority published the ‘Guide on Generative Artificial Intelligence and the Protection of Personal Data’ on 24 November 2025’ (“the Guide”) on 24 November 2025 to provide guidance for data controllers developing and using such applications.

The Guide focuses on systems trained on large datasets that can generate text, images, video, audio or code in response to a prompt; and not only defines the technology but also explains how risks such as ‘ ’ hallucinations, inconsistencies, bias, data privacy and security, intellectual property infringements and deepfakes should be addressed from a data protection law perspective. In this respect, the Guide can be regarded as a guiding compliance document for data controllers rather than a purely technical document.

Under the Guide, if data belonging to individuals resident in Türkiye is involved in the process during the training, evaluation, monitoring and use of generative AI systems, this activity should be regarded as a personal data processing activity within the meaning of the Personal Data Protection Law (KVKK). Furthermore, it is emphasized that merely claiming that only anonymous or pseudonymised data is used is not sufficient in itself; pseudonymisation itself constitutes a processing activity, and it must be objectively demonstrated through technical methods whether the data can genuinely be considered anonymous.

As the generative AI ecosystem is multi-layered, the Guidelines set out a critical principle regarding the determination of the roles of data controller and data processor, stating that the actual control over data processing and decision-making power should be the determining factor, rather than the contractual labels assigned to the parties. The Guidelines state that each step in the lifecycle of an AI system must be treated not as a single, unified process but as separate processes requiring individual assessment: the processing of data entered by the user to run the model, the use of this data in model development, the evaluation of the model’s output for personalisation purposes, or the use of the output for re-training the model – each stage requires its own separate legal basis analysis. The Guidelines contain important assessments showing that, with regard to AI systems, data controllers must not rely solely on a ‘single privacy notice + single legal basis’ approach when providing information to users.

The Guide specifically highlights three areas of compliance: transparency, the clear and separate fulfilment of the duty to provide information regarding the effective exercise of data subjects’ rights and data security, the provision of opportunities for individuals to make appeals and request a review in processes based on automated decision-making, the safeguarding of mechanisms for human intervention, the adoption of a ‘privacy by design’ approach, and the implementation of risk-based security measures.

The Authority has also prepared and published a book entitled “An Academic Perspective on Artificial Intelligence Technologies”, in which legal, technical and ethical issues relating to the protection of personal data in artificial intelligence technologies are assessed in their various dimensions by specialist academics.

In addition to the first artificial intelligence bill tabled in 2024, which annexed a very fundamental approach in line with the AI Act regulations, a new bill tabled in 2025 emphasized that the risks posed by artificial intelligence systems must be addressed within the framework of various laws, including the TCC, and proposed the introduction of penalty-focused regulations in numerous laws that directly refer to artificial intelligence.

The bill addresses priority issues regarding the protection of personal data in the context of AI applications, including the anonymity of data sets to be used, compliance with the principles of non-discrimination and lawfulness, transparency, auditability, and the prevention of risks such as inaccuracy, manipulation and hallucination, amongst others.

It is not expected that the bill in its current form will become law. There is no doubt that Türkiye is entering a transitional period in which the process of ‘regulatory maturation and alignment’ in the field of artificial intelligence law is gaining momentum. Although work on a comprehensive and standalone artificial intelligence law has not yet commenced, when legislative proposals, data protection law practices and the influence of European Union regulations are considered together, it is anticipated that Türkiye will, in the near future, establish a more holistic, risk-based artificial intelligence regulatory framework that is aligned with international standards, sectoral needs and technological developments.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.