How to build a KVKK-compliant AI system in Türkiye

The decisive question in a KVKK-compliant AI system is not model quality — it is where the personal data goes. Every prompt sent to an LLM API hosted abroad is a cross-border transfer under Article 9 of Law No. 6698, and since the amendment that took effect on 1 June 2024 it needs a lawful basis of its own. Running the model on your own servers removes most of the problem before it starts.

This is a technical compliance framework, not legal advice. The statute and the Board’s practice evolve; have your setup verified by your own legal counsel.

Three questions, in this order

Most teams jump straight to the third question and then look for solutions in the wrong place.

Is there personal data in this flow? The definition in Article 3 is broad: any information relating to an identified or identifiable natural person. Support tickets, CVs, call-centre transcripts, purchase histories — even without a name, if the content makes someone identifiable, you are in scope. Health, biometric and membership data fall under the special-category regime of Article 6, where the bar is higher.
What is the lawful basis? Article 5 lists seven grounds besides explicit consent; performance of a contract, legal obligation and legitimate interest are the ones that usually carry weight. AI is a new purpose for processing — if you collected the data for something else, that original basis does not automatically stretch to cover the model.
Where does the data travel? That is where Article 9 arrives.

Cross-border transfer: the map after 2024

The old Article 9 relied on a list of “countries with adequate protection” that was never published, which pushed everyone into consent or ad-hoc undertakings. The structure introduced by Law No. 7499 moved noticeably closer to the European mechanisms:

Route	What it requires	Board approval	Reality in an LLM project
Adequacy decision	A Board decision covering a country, sector or international organisation	The decision is the Board’s own	The cleanest route; scope is narrow, so it rarely covers today’s providers
Standard contract	Signing the text published by the Board	No prior permission; notification to the Authority within five business days of signing	The most used route — but the provider has to be willing to sign
Binding corporate rules	Approved internal rules across a corporate group	Board approval	Intra-group only; no help with an external vendor
Undertaking	A bespoke commitment with the provider	Board permission	Slow, low predictability
Incidental transfer	Must not be regular, plus one of the listed grounds	—	A chatbot shipping every message abroad is not incidental

That last row matters. Incidental means exactly what it says: not routine. A production assistant sending thousands of prompts a day is by definition continuous — which is why “we added a consent checkbox” is a weaker foundation than it looks.

Why explicit consent is thin ice

Explicit consent, as defined in Article 3, must relate to a specific subject, be informed, and be given freely. Three practical consequences: it cannot be a condition of service, it can always be withdrawn, and in an employment context the power imbalance makes “freely given” arguable.

The real engineering question is what happens when consent is withdrawn. Which log lines, which vector index entries, which fine-tuning set still hold that person’s data? If you cannot answer within minutes, your consent mechanism exists only on paper. That is why we treat consent as a last resort, not a first choice.

Data minimisation is an architectural decision

The Article 4 principle — relevant, limited and proportionate to the purpose — is a direct technical constraint for teams building RAG. The common mistake is feeding the entire document pool into the embedding pipeline and leaving access control at the UI layer. If the vector index carries no permissions, the index itself is the leak.

What we build instead:

Field-level projection: the object sent to the model is a subset of the source record, not the record.
Pseudonymisation: identifiers replaced by tokens, with the reversal map stored separately and encrypted.
Permission-aware retrieval: every chunk carries its ACL label; filtering happens at query time.
A routing gate: prompts containing personal data go to the local model, the rest to the vendor API.

# LLM gateway — conceptual rule set
routes:
  - when: { contains_personal_data: true }
    target: on_prem_model      # no cross-border transfer
  - when: { contains_personal_data: false }
    target: vendor_api
redaction:
  patterns: [national_id, iban, phone, email]
logging:
  prompt: hash_only
  retention_days: 30
  purge_on_consent_withdrawal: true

A caveat worth stating plainly: pattern-based gatekeepers are not deterministic and will never catch personal data in free text with full reliability. Build them as one layer, never as the only one.

Data sovereignty: cutting the risk at the source

Run the model on the organisation’s own infrastructure and the Article 9 debate leaves the table — no transfer, no transfer law. The security duty under Article 12 and the principles of Article 4 still apply, of course, but the compliance surface shrinks to a machine you control.

Setup	Article 9 status	What it costs you
Overseas SaaS API	Transfer occurs; needs a lawful route	Contracts, notification, vendor diligence, sub-processor tracking
Cloud in Türkiye, closed model	Depends on the provider’s processing chain	Verifying the data genuinely stays in country
Open-weight model on your servers	No transfer	Hardware, model maintenance, versioning, evaluation

The progress of open-weight models over the past two years has made this choice realistic for most enterprise workloads. We describe what we do on the sovereignty and RAG side on our services page.

The disclosure duty stands on its own

The Article 10 duty to inform applies whether or not you rely on consent. What AI adds to the text: where the model runs, the recipient groups and country if data is transferred, which decisions are made automatically, and where human review enters. Article 11(g) gives individuals the right to object to an adverse outcome produced solely by automated analysis — so that objection needs a person and a process behind it. “The model said so” is not an answer.

Logs and retention

Record type	Risk	Our approach
Raw prompts and responses	Highest — free text can contain anything	Off by default; if enabled, masked and short-lived
Evaluation datasets	They tend to become permanent	Pseudonymised copy, versioned, separately access-controlled
Access and audit trail	Low but necessary	Kept long-term; metadata, not content
Vector index	Silent accumulation	Deleting the source record deletes the index entry; with pgvector in the same Postgres instance that is one transaction, with a separate store it is guaranteed through an outbox

Retention periods come from your retention and destruction policy, not from “as long as we need it”, and deletion runs on a schedule rather than on someone remembering.

The short path, step by step

Inventory the data: which fields reach the LLM, and from where.
Write down the Article 5 or 6 ground for each flow.
Flag every flow that leaves the country and pick an Article 9 route for it.
Move the flows that make transfer unnecessary onto a local model.
Bake projection, pseudonymisation and permission-aware retrieval into the architecture.
Update the disclosure text and any consent flow.
Write the logging and retention policy; automate the deletion.
Align your VERBİS registration (Article 16) with the new processing activity, and have counsel verify the whole picture.

How Albatros helps

We apply this in production as well: LEGAPALAS, which we build end to end, is a legal AI running on KVKK-compliant, ISO 27001-certified infrastructure — a concrete example of compliance requirements built into the architecture rather than bolted on.

We build AI systems that run on the client’s own infrastructure: open-weight or closed models hosted on your servers, with RAG and semantic search layers wired into your own documents and governed by your own permissions. The legal assessment belongs with your counsel; our job is building the architecture that assessment calls for. If that sounds like your problem, get in touch.