Many small and mid-sized companies that want to adopt AI get stuck on the same first question: "How will this system use my customer data, and is it legal?" The good news is that compliance with Türkiye's KVKK (Personal Data Protection Law) and the EU's GDPR rests on a few core principles you can understand without being a lawyer. This article shares a practical checklist to review before you start a project.
Understand the core principles first
KVKK and GDPR share the same logic: you process personal data only for a specific purpose, only as much as needed, and only in a way the person is aware of. AI does not change this picture; it simply forces you to be more careful because it processes data faster and at larger scale.
- Purpose limitation: Use data only for the reason you collected it.
- Data minimization: Never feed the model fields it does not need (ID numbers, addresses, phone numbers).
- Retention: Do not keep data forever; set a deletion schedule.
- Transparency: Clearly tell people their data is used in an AI process.
The pre-project checklist
Answer the items below before buying an AI tool or starting a prototype. If you cannot say "yes" to all of them, you are not ready yet.
- Data inventory: Do you know which personal data you hold and where it lives?
- Legal basis: Do you have a clear basis for each processing activity (consent, contract, legitimate interest)?
- Privacy notice: Is your notice up to date and does it cover AI use?
- Data processor agreement: If you use a cloud or model provider, have you signed a data processing agreement?
- Cross-border transfer: If your data goes to a server abroad, are you sure it complies with the rules?
AI-specific risks
Unlike traditional software, AI introduces extra risks. Ignoring them is the most common mistake.
Training data leakage
If you train or feed your model with company documents, ask whether that data is stored in the provider's systems. Many enterprise providers commit in their contract not to use your data for model training; request this in writing.
Automated decisions
If an AI makes a significant decision about a person (credit, hiring, pricing), GDPR protects people's right to contest it and request a human review. Avoid fully automated critical decisions; keep a human in the loop.
Sensitive data
Special categories such as health, religion, or ethnicity require extra protection. Where possible, remove this data from AI processes entirely.
Compliance is not an obstacle but a design rule. A system that handles data correctly from the start is both cheaper and more trustworthy than one patched up later.
A practical way to start
For your first AI project, choose a use case with no personal data if you can: document summarization, internal documentation search, or answering general customer questions. This lets your team learn the technology while keeping compliance risk low. Once you build confidence, you can move into areas involving personal data with solid data governance in place.
Finally, compliance is not a one-time task. Review your data flows, contracts, and privacy notices at least once a year. AI tools change quickly, and your practices must stay current with them.
