Source: Mondaq

Mondaq reports that the Turkish Personal Data Protection Authority (KVKK) has published a detailed guideline on "Generative Artificial Intelligence and Personal Data Protection" in December 2025. The document provides a legal framework for developers, service providers, and users of generative AI systems within Turkey, emphasizing compliance with the Law on the Protection of Personal Data (LPPD). The KVKK highlights that the processing of personal data for training large language models must be based on a valid legal ground, and that "legitimate interest" does not grant unlimited permission for indiscriminate data scraping. Developers are urged to implement "privacy by design" and "privacy by default" principles from the earliest stages of model development.

The guidelines specifically address the rights of data subjects, including the right to information and the right to object to automated processing. Service providers are required to provide clear and accessible privacy notices explaining how user inputs are used for further model training and to offer "opt-out" mechanisms. Additionally, the KVKK underscores the importance of data minimization and the use of anonymization techniques to reduce the risk of re-identification. This move is part of Turkey's broader effort to harmonize its digital regulations with global trends, ensuring that the development of AI technologies does not compromise the privacy rights of its citizens while providing a stable regulatory environment for the domestic tech industry.