This page summarises where the EU Artificial Intelligence Act and data protection law meet. It is based on the publications of Prof. Dr. Murat Volkan Dülger listed at the end. The legislation and decisions cited were checked against official sources on 1 November 2026.

The AI Act and data protection law apply side by side

The AI Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024. It entered into force on 1 August 2024 and its provisions apply in stages. Its technique is that of product safety legislation: AI systems are classified by risk, and obligations fall on the provider, who develops the system and places it on the market, and on the deployer, who uses the system under its authority.

The AI Act does not affect the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) (Art. 2(7) AI Act). An AI system that processes personal data is subject to both regimes: the AI Act governs the system itself, the GDPR governs the processing carried out with it. There are two exceptions to this principle: Article 4a on processing special categories of data to detect bias, and Article 59 on processing in regulatory sandboxes.

Scope for companies established in Türkiye

The AI Act applies to providers placing systems on the EU market irrespective of where they are established (Art. 2(1)(a)). Providers and deployers established in a third country are also covered where the output produced by the system is used in the Union (Art. 2(1)(c)). A company in Türkiye that uses a system only in Türkiye, with no output used in the EU, is not subject to the AI Act. Companies that offer systems on the EU market, or that serve EU clients with AI-supported services whose output is used there, are covered.

Natural persons who use AI in the course of a purely personal, non-professional activity are not deployers (Art. 2(10), Art. 3(4)).

Prohibited practices

The prohibitions in Article 5 have applied since 2 February 2025. Several concern personal data directly: creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage; emotion recognition in the workplace and in education institutions (except for medical or safety reasons); biometric categorisation that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation; assessing a person's risk of committing a crime based solely on profiling or personality traits; and real-time remote biometric identification in publicly accessible spaces for law enforcement, subject to narrow exceptions.

The Digital Omnibus added two prohibitions: generating or manipulating realistic intimate images, video or audio of an identifiable person without that person's explicit consent, and generating child sexual abuse material. They apply from 2 December 2026. Breaches of the prohibitions carry administrative fines of up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)).

The timetable after the Digital Omnibus

The AI Act was amended by Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (Digital Omnibus on AI), published in the Official Journal on 24 July 2026 and in force since 27 July 2026. Obligations for the high-risk systems listed in Annex III now apply from 2 December 2027 instead of 2 August 2026; obligations for high-risk systems covered by product legislation (Annex I) apply from 2 August 2028. The transparency obligations in Article 50 have applied since 2 August 2026.

High-risk systems and impact assessments

Annex III classifies certain uses as high-risk in the areas of biometrics, critical infrastructure, education, employment, access to essential public and private services (including creditworthiness and life and health insurance), law enforcement, migration and border control, and the administration of justice and democratic processes. These are areas in which personal data are processed intensively.

Two different assessments are involved. The data protection impact assessment is based on Article 35 GDPR; deployers of high-risk systems use the information supplied by the provider under Article 13 of the AI Act to carry it out (Art. 26(9)). The fundamental rights impact assessment is governed by Article 27 of the AI Act and is not required of every deployer, only of bodies governed by public law, private entities providing public services, and deployers of systems used for creditworthiness and for life and health insurance. Since the Digital Omnibus, a deployer may cross-refer to the relevant sections of the data protection impact assessment, or include them, when carrying out the fundamental rights impact assessment (Art. 27(4)).

Turkish Law No. 6698 on the Protection of Personal Data (KVKK) contains no obligation corresponding to Article 35 GDPR. In its Guide on Generative AI and Personal Data Protection, published in November 2025, the Turkish Personal Data Protection Authority notes that the Law does not require it, but considers a data protection impact assessment useful where the processing may have significant consequences for the lives of the persons concerned (Guide, p. 44).

Special categories of data for bias detection

The Digital Omnibus deleted Article 10(5) and inserted Article 4a. Providers of high-risk systems may exceptionally process special categories of personal data to the extent strictly necessary for detecting and correcting bias, subject to appropriate safeguards. The first condition is that bias detection and correction cannot be effectively achieved by processing other data, including synthetic or anonymised data. The provision has applied since 27 July 2026.

Automated decisions and the right to explanation

Article 22 GDPR gives a person the right not to be subject to a decision based solely on automated processing which produces legal effects concerning them or similarly significantly affects them. In SCHUFA (C-634/21, 7 December 2023), the Court of Justice held that the automated establishment of a credit score by a credit information agency is an automated decision within the meaning of Article 22 where a third party draws strongly on that score to establish, implement or terminate a contractual relationship.

The AI Act adds a further right. Where a decision based on the output of a high-risk system listed in Annex III produces legal effects or similarly significantly affects a person, that person may obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and of the main elements of the decision (Art. 86). Deployers of Annex III systems that make or assist in making decisions about natural persons must inform those persons that they are subject to the use of the system (Art. 26(11)).

The Turkish counterpart is Article 11(1)(g) KVKK, which gives the right to object to an outcome to the person's detriment arising from the analysis of the processed data exclusively by automated systems. The Authority's guide reads this right as also allowing the person to ask for the grounds of the decision to be reassessed, and not only to contest the outcome (Guide, p. 52).

Model training and web scraping

In Opinion 28/2024 of December 2024, the European Data Protection Board stated that AI models trained with personal data cannot in all cases be considered anonymous and that this must be assessed case by case. For a model to be anonymous, the likelihood both of extracting personal data used in training directly from the model and of obtaining such data through queries must be insignificant. The Opinion makes the use of legitimate interest as a legal basis subject to a three-step test: identifying the legitimate interest, assessing the necessity of the processing, and balancing it against the rights and freedoms of the persons concerned.

According to the Turkish Authority's guide, where publicly shared social media content is collected by web scraping to train a language model, the controller cannot rely on the ground that the data were made public by the data subject (Art. 5(2)(d) KVKK), because the persons concerned did not make them public for the purpose of developing AI models. The fact that the data are publicly available may, however, be taken into account in the balancing test under legitimate interest (Art. 5(2)(f)) (Guide, p. 44). Where generative AI services of providers established abroad are used and personal data are transferred abroad, the transfer must comply with Article 9 KVKK and the Regulation on the Procedures and Principles for Transferring Personal Data Abroad (Guide, p. 48).

The position in Turkish law

Türkiye has no law that regulates AI directly; bills are pending before the Grand National Assembly. The report of the Assembly's AI Research Commission, released in March 2026, proposed the establishment of a Turkish AI Authority. The Türkiye Artificial Intelligence Action Plan (2026-2030) was put into effect by Presidential Circular No. 2026/9 (Official Gazette of 18 August 2026, No. 33344). The Council of Europe Framework Convention on Artificial Intelligence (CETS No. 225) was opened for signature in Vilnius on 5 September 2024; as of 1 November 2026 Türkiye has not signed it and the Convention has not yet entered into force.

Personal data issues in AI applications are therefore resolved under Law No. 6698: the conditions for processing (Arts. 5 and 6), transfers abroad (Art. 9), the duty to inform (Art. 10), the rights of the data subject (Art. 11) and data security (Art. 12). The Authority's 2021 Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence and its November 2025 guide explain how these provisions apply to AI.

Assessment

In a 2019 paper, Prof. Dr. Murat Volkan Dülger identified four points of tension between AI and data protection law: the tendency to collect as much data as possible, the derivation of new data from existing data, the strain on the purpose limitation principle when data are processed for purposes not known at the outset, and the spread of automated decision-making. In the same paper he proposed that risk assessments take account of the specific features of AI and big data, that data protection be built in from the design stage, that synthetic data be used to avoid unnecessary processing, and that it be settled from the outset who the controller is.

The AI Act has turned some of these proposals into binding rules. Article 4a confines the processing of special categories of data for bias detection to cases where synthetic or anonymised data will not do, and impact assessments have become mandatory for high-risk systems. In Dülger's view, the problem in Turkish law is not an absence of rules but uncertainty about how rules not written for AI apply to AI. The right to object in Article 11(1)(g) KVKK also falls short of the protection reached under Article 22 GDPR and in SCHUFA, since it gives no right not to be subject to an automated decision, only a right to object to an adverse outcome.

In Dülger's view, Türkiye should not choose between the market-led model of the United States, the state-led model of China and the rights-based model of the EU, but build a framework from within its own constitutional order and legal concepts. This does not mean that the AI Act can be ignored: given the weight of the EU market and the Customs Union, the Act will in practice apply to Turkish companies offering systems in the EU. The first step should be to sign and ratify the Council of Europe Framework Convention on Artificial Intelligence, which provides a rights-based minimum standard.

The AI Act itself should not be transposed into Turkish law as it stands. It is internal market and product safety legislation; its risk-based approach makes certain interferences with fundamental rights acceptable as long as procedural requirements are met. Moreover, the text was substantially amended before it began to apply. Its rights-based core, however, may serve as a guide for Turkish law: a narrow list of prohibitions covering uses incompatible with human dignity, the fundamental rights impact assessment, and a right to explanation backed by an effective remedy. The product safety part should be dealt with separately within the framework of the Customs Union.

Dülger's general approach is not to prohibit AI but to ensure that it is used in a controlled way that is open to oversight, since a prohibited technology is often still used, only outside any control. He therefore proposes keeping prohibitions to a narrow core and regulating other risky uses through authorisation, conditions, records, transparency, the right to object and independent oversight. For real-time facial recognition in publicly accessible spaces, too, he proposes an authorisation regime: the purposes of use should be listed in statute; use should as a rule require a court decision; in urgent cases it may begin on the order of a public prosecutor, to be submitted for judicial approval within twenty-four hours; and every use should be recorded.

The legislation and sources cited and their status for Türkiye

The legislation and sources cited on this page are listed below with their full titles and their legal status for Türkiye. For texts not in force in Türkiye, the list states why they are cited and in which cases they may nevertheless bind persons in Türkiye.

  • Turkish legislation: Law No. 6698 on the Protection of Personal Data (KVKK; Official Gazette 7.4.2016, No. 29677) and the Regulation on the Procedures and Principles for Transferring Personal Data Abroad (Official Gazette 10.7.2024, No. 32598). In force and binding in Türkiye.
  • EU AI Act: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024. In force in the EU since 1 August 2024. Since Türkiye is not an EU member, it is not in force in Türkiye and does not bind Turkish authorities or courts. It does, however, bind providers and deployers in Türkiye that place systems on the market or put them into service in the EU, or whose systems' output is used in the EU (Art. 2(1)(a) and (c)). Because Türkiye is an EU candidate country and is required, within the Customs Union, to align its technical legislation on products, the Act is also cited as a model for Turkish legislation.
  • Digital Omnibus: Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026, amending the AI Act; in force in the EU since 27 July 2026. Its status for Türkiye is the same as that of the AI Act.
  • General Data Protection Regulation (GDPR): Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. Applies in the EU since 25 May 2018; not in force in Türkiye. It binds companies in Türkiye that offer goods or services to persons in the EU or monitor their behaviour in the EU (Art. 3(2)). Since the KVKK was modelled on EU data protection law, the GDPR and EU case law are cited for comparison.
  • Court of Justice of the EU, SCHUFA (C-634/21, 7.12.2023): interprets Art. 22 GDPR; does not bind Türkiye. Cited for comparison with Art. 11(1)(g) KVKK.
  • European Data Protection Board (EDPB; the body of the EU data protection authorities), Opinion 28/2024, December 2024: addressed to EU supervisory authorities; does not bind Türkiye. Cited for comparison with the Turkish Authority's approach to the same issues.
  • Turkish Personal Data Protection Authority, Guide on Generative AI and the Protection of Personal Data (in 15 Questions), Publication No. 113, November 2025; Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence, 2021: they reflect the interpretation of the Turkish data protection authority. Not being a law or regulation, they are not binding, but they show how the Law is interpreted in the Board's practice.
  • Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225), opened for signature on 5 September 2024: not yet in force; Türkiye has not signed it. It therefore does not bind Türkiye. Cited because it is the first binding international treaty on AI of the Council of Europe, of which Türkiye is a founding member.
  • Presidential Circular No. 2026/9 on the Türkiye Artificial Intelligence Action Plan (2026-2030) (Official Gazette 18.8.2026, No. 33344): in force; as a circular it is addressed to the public administration and creates no direct obligations for private persons.
  • Report of the AI Research Commission of the Grand National Assembly of Türkiye (March 2026) and AI bills pending before the Assembly: not binding; cited to show the current state of the regulatory debate in Türkiye.

Related publications

Status of the law: 1 November 2026. This page provides general information and does not replace legal advice on a specific case.