Turkey's data protection law has no AI-specific chapter, yet existing obligations apply in full to AI applications. The difference is that breaches here are easier and less visible.
01. Processing Purpose
Sending personal data to a model is itself a processing activity. The purpose must be defined in advance and stated in the privacy notice. "Analysis with artificial intelligence" is not specific enough on its own.
02. The Transfer Question
If you use a cloud-based model, data is transferred to the provider. Cross-border transfer conditions apply; region selection or a local model simplifies this step.
03. Automated Decisions
Decisions with significant consequences made about a person by a fully automated system need particular care. Human oversight and an objection mechanism must be designed in.
04. The Right to Erasure
When a data subject requests deletion, that request must reach every layer: source system, search index, log records and any cache. In RAG deployments the search index is the most frequently missed.
05. Data Minimisation
Don't send more data to the model than needed. Masking and field selection reduce both compliance risk and cost.
06. Record Keeping
Which data went to which system for which purpose must be recorded. In a breach investigation those records are the only concrete evidence the organisation holds.