Some of your employees are very likely using AI chat tools already: drafting proposals, summarizing contracts, polishing customer emails. The text they paste into these tools often contains personal data and business information. Banning them rarely works; the use simply becomes invisible. Turkey's Personal Data Protection Authority makes the same point in its March 2026 document on generative AI in the workplace: purely prohibitive approaches are unlikely to work in practice, and an approach based on guidance and awareness is more appropriate.
A better path is an in-house assistant that works with your company's own documents and access rules and is designed with data protection in mind from the start. If your company operates in Turkey, for example through a subsidiary or a branch, the personal data processed there is subject to Turkey's Personal Data Protection Law No. 6698, known as KVKK. This article covers the questions to answer before building such an assistant, three basic setup options, a step-by-step plan and, if your group already works under GDPR, the differences that matter most.
This article is for general information only and is not legal advice; it reflects the situation as of October 18, 2026. Review your own data flows with your legal counsel.
What does an in-house AI assistant do?
Unlike a general chat tool, an in-house assistant bases its answers on your company's own sources: procedures, product documentation, proposal templates, support tickets, ERP reports. When a question comes in, it finds the relevant documents, generates the answer from them and shows which document it relied on. This method is called retrieval-augmented generation (RAG), and it makes the answer verifiable.
Company assistant
How many days in advance do I need to submit my annual leave request?
Under the leave procedure, you need to submit your annual leave request to your manager at least 10 business days in advance, using the leave form on the HR portal.
- Leave Procedure, section 2.1
- HR FAQ, p. 4
A well-built assistant sees only what the person asking is allowed to see. An employee without access to HR files cannot reach those files by asking the assistant either.
Typical use cases:
- Sales: drafting proposals from past offers and product documentation.
- Support: answering customer questions quickly, with sources, from product documentation.
- HR and new hires: looking up leave, expense and purchasing procedures.
- Management: getting periodic summaries and variance explanations from ERP data.
Answer these KVKK questions first
Which personal data will the assistant process?
If your documents contain employee names, customer contact details or email correspondence, the assistant processes personal data. Define in writing which categories of data, belonging to whom, will be processed and for what purpose. If you already keep a personal data inventory, adding the assistant to it is a good start. Because KVKK requires personal data to be relevant, limited and proportionate to the purposes of processing (data minimization, in GDPR terms), the safest path is to leave out any personal data the assistant does not need for its job.
Where will the data be processed, and does it leave Turkey?
Many cloud-based large language model services run in data centers abroad. The Authority's generative AI guide, published in November 2025, states plainly that if personal data is transferred through systems used via service providers established abroad, this must comply with Article 9 of the Law and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (the Transfer Regulation). According to the Authority's guide on transfers abroad, storing data in a cloud abroad can also count as a transfer.
Article 9, amended by Law No. 7499 and in force since June 1, 2024, ties transfers to the following routes, in this order:
Adequacy decision None yet
A decision by the Personal Data Protection Board (the Board), the Authority's decision-making body, for the destination country or sector. The Authority's website states that no such decision has been made yet.
- otherwise
Appropriate safeguards For regular data flows
A standard contract announced by the Board, binding corporate rules approved by the Board (within a group of companies) or a written undertaking with the Board's permission. The standard contract is used without changes and notified to the Authority within five business days of signing.
- otherwise
Occasional transfer Not for regular data flows
Listed exceptions for transfers that are not regular and happen once or a few times (called "incidental" in the Law's official English translation). Since September 1, 2024, explicit consent can serve as a basis for a transfer only in these cases.
The Transfer Regulation does not treat continuous transfers that are part of ordinary business activities as occasional, so the data flow of an assistant that runs every day is not occasional either. Either a safeguard such as a standard contract must be in place, or the processing of personal data must take place in Turkey. If the service processes data on your behalf, the relevant one of the Authority's four standard contract types is usually the "controller to processor" contract. As the Authority's generative AI guide points out, roles are determined by actual control over the data, not by the wording of the contract alone.
What does the service provider do with the data?
Check in the enterprise agreement whether the text you enter is used to train the model, how long it is retained and in which countries it is processed. Under KVKK the provider is usually a data processor, and the Authority's data security guide recommends setting up this relationship with a written contract. These terms often differ between free individual accounts and enterprise versions.
Have employees and customers been informed?
Article 10 of KVKK imposes a duty to inform: people must be told for what purpose their personal data is processed, to whom it may be transferred and what their rights are. If the assistant creates a new processing purpose or a new transfer, update your privacy notices.
Are the security measures sufficient?
Article 12 of the Law requires technical and organizational measures that provide an appropriate level of security to prevent unlawful processing of personal data and unlawful access to it, and to safeguard the data. If a service provider does the work for you, you are jointly responsible with the provider for these measures. If a data breach occurs, the Board's interpretation is that it must be notified to the Board without delay and at the latest within 72 hours of becoming aware of it.
The Authority's generative AI guide lists example measures in this area: privacy by design, data protection impact assessment, controls against attacks such as prompt injection, logging and employee training. These are examples, not a binding list. The design principles further below show what these measures look like in an assistant in practice.
KVKK and GDPR: what is different for an AI assistant?
KVKK was largely modeled on the EU's 1995 Data Protection Directive (Directive 95/46/EC), and the 2024 amendments brought its rules on special categories of data and on transfers abroad closer to GDPR. If your group already works under GDPR, much of this will feel familiar. For an AI assistant, these differences matter most:
| Topic | GDPR | KVKK |
|---|---|---|
| Transfers between the EU and Turkey | Turkey has no EU adequacy decision; transfers from the EU to Turkey need safeguards such as the EU standard contractual clauses | According to the Authority's website, the Turkish Board has not yet issued an adequacy decision for any country; transfers out of Turkey need, for example, KVKK's own standard contract, used unchanged and notified to the Authority |
| Explicit consent as a basis for transfers | A derogation for specific situations (Art. 49), interpreted restrictively according to the EDPB | Since September 1, 2024, only for occasional transfers |
| Data protection impact assessment (DPIA) | Mandatory for high-risk processing (Art. 35) | No statutory obligation; the Authority's generative AI guide lists it among recommended measures |
| Breach notification | Without undue delay and, where feasible, within 72 hours; not required if the breach is unlikely to result in a risk to individuals (Art. 33) | Without delay and at the latest within 72 hours (Board interpretation); the law sets no risk threshold |
In practice, this means your EU standard contractual clauses do not cover data leaving Turkey: if you rely on standard contracts, KVKK requires its own. Remote access from abroad can count as a transfer as well (see the setup options below). This article covers Turkish law. If GDPR also applies to the processing (Article 3 sets its territorial scope, for example through an establishment in the EU), it applies in parallel, and the EU AI Act may apply depending on how the assistant is used.
Three setup options
| Option | Control over the data | Setup and cost | Best suited for |
|---|---|---|---|
| Cloud model service under an enterprise agreement | Depends on the provider's commitments; if personal data is sent, the rules on transfers abroad apply | Fastest; pay as you go | Little personal data, or data that can be masked before sending |
| Model hosted in a data center in Turkey | Higher; data stays in Turkey (the KVKK rules on transfers to third parties within Turkey still apply) | Medium; servers and setup required | Workloads with a lot of personal data or strict contractual terms |
| Open-source model on your own servers | Highest; data does not leave the company | Hardware, setup and maintenance required | Sensitive data (health, finance, public sector) and organizations that want full control |
No single option is mandatory. A hybrid setup works for many companies: questions involving personal data run on the model on your own servers, while general work without personal data runs on the cloud service.
If you host in Turkey, there is one more point to watch: under the Transfer Regulation, making data accessible to a controller or processor abroad also counts as a transfer. Clarify in the contract where the provider's support team or subcontractors can access the data from. The same applies within your own group: if the IT team of a parent company abroad can access the assistant's data remotely, even just to view it for support or troubleshooting, that can count as a transfer as well.
Design principles of a secure assistant
Before a question is answered, it passes through several steps inside the assistant, and the security measures are built into these steps.
Question
The employee types the question in natural language.
Permission check
The documents the person may access are determined from the company's user directory.
Document search
Relevant passages are searched only within these documents.
Masking
Fields such as Turkish national ID numbers, phone numbers and IBANs are hidden before they reach the model.
Answer and log
The model generates the answer from these passages and shows its source; the question and the documents used are logged.
- Document-level permissions: the assistant works with the documents the person asking can already access; permissions come from the company's user directory (for example Active Directory or Google Workspace).
- Masking: fields such as Turkish national ID numbers, phone numbers and IBANs are masked before they are sent to the model.
- Logging and retention: who asked what and when, and which documents were used, is logged; how long the logs are kept is decided up front.
- Protection against prompt injection: instructions hidden in documents or emails can mislead the assistant. The actions the assistant can take are limited, and critical actions such as payments or deleting records require human approval.
- Citing sources and saying "I don't know": every answer shows the document it is based on; if the documents do not contain the answer, the assistant does not make one up but says it does not know.
Step-by-step setup plan
- Start with a single use case. Pick a measurable goal, for example the time the support team needs to answer product questions.
- Data inventory and classification. List the documents the assistant will use; mark which ones contain personal data and who can access them.
- Legal framework. Clarify the privacy notice, the transfer mechanism and the provider contract with your legal counsel.
- Architecture and setup. Choose the model and the hosting option; connect document search and permissions to the company's user directory.
- Pilot. Run it with one team for a few weeks; measure accuracy, usage and feedback.
- Rollout and training. Explain to employees what the assistant does and does not do, and which information must not be entered.
We support each of these steps, from use case analysis to setup, integration and team training. See our AI solutions for details; for KVKK compliance work and infrastructure security, our cybersecurity services are part of the process as well.
Frequently asked questions
We already comply with GDPR. Does that cover KVKK?
Not automatically. The principles are similar and much of your GDPR documentation can be reused, but KVKK has its own rules. For an AI assistant, one of the most relevant differences is transfers abroad: if you rely on standard contracts, KVKK requires its own, announced by the Board, used unchanged and notified to the Authority. The EU standard contractual clauses do not replace them.
Is it a KVKK violation if employees use ChatGPT?
What matters is not the tool but the data processed and the conditions. Use without personal data, such as polishing the language of a general text, is low risk. Sharing customer or employee data through individual accounts, on the other hand, can cause problems both for transfers abroad and for security. The Authority's workplace document also recommends setting a clear corporate policy, defining which tools may be used for which tasks, restricting access through corporate devices and role-based approaches, and informing and training employees.
Are open-source models good enough?
For most enterprise tasks, such as summarizing documents, answering questions with sources and classification, yes. For tasks that require multi-step reasoning, large commercial models are still ahead. That is why a hybrid setup is often the most balanced solution.
How long does setup take?
It depends on the scope. A pilot with a single team and a limited set of documents can be up and running within a few weeks; a company-wide rollout with permissions and training takes longer.
Sources
- Personal Data Protection Law No. 6698, English translation (KVKK)
- Law No. 6698, official Turkish text (mevzuat.gov.tr)
- Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Official Gazette, July 10, 2024; in Turkish)
- KVKK: Transfers abroad and the status of adequacy decisions (in Turkish)
- KVKK: Standard contracts (in Turkish)
- KVKK: Guide on transferring personal data abroad (January 2025; in Turkish)
- KVKK: Generative AI and personal data protection, a guide in 15 questions (November 2025; in Turkish)
- KVKK: Use of generative AI tools in the workplace (March 2026; in Turkish)
- KVKK: Recommendations on the protection of personal data in the field of AI (in Turkish)
- KVKK: Personal data security guide, technical and organizational measures (in Turkish)
- KVKK: Data breach notification (in Turkish)
- GDPR, Regulation (EU) 2016/679 (EUR-Lex)
- European Commission: Adequacy decisions