KVKK-Compliant AI API Usage: Turkey's 2025-2026 AI Guidance and an Enterprise Compliance Checklist

KVKK-compliant AI API usage rests on three pillars: masking personal data before the request leaves your application, establishing a valid cross-border transfer mechanism (a standard contract, or explicit consent in narrow incidental cases) or choosing a provider whose contracting entity is in Turkey, and turning the expectations in KVKK's three new 2025-2026 guidance documents into written internal policy.

The picture has sharpened considerably over the past year: since November 2025, Turkey's Personal Data Protection Authority has published three separate guidance documents — on generative AI, on agentic AI, and on generative AI use in the workplace. The question is no longer "may we use AI" but "how do we document it and make it auditable". This guide brings together the current framework, practical technical safeguards and an itemized compliance checklist for teams integrating AI APIs.

Important note: this article is general information, not legal advice. Always validate your specific data processing scenario with your legal team or a KVKK consultant.

How Does KVKK Regulate AI? Three New Guidance Documents (2025-2026)

The Authority's approach to AI is no longer a single set of general principles; between November 2025 and June 2026 it published three separate documents that make its expectations concrete. None of them is binding secondary legislation, but together they are the most current reference for what the regulator will look at in oversight — which narrows the room for an "we did not know" defense.

Document	Date	Focus	What it means for API users
Generative AI and Personal Data Protection Guide (in 15 Questions)	November 2025	Generative AI lifecycle, processing conditions, data subject rights, cross-border transfers	Personal data typed into a prompt is a processing activity: it needs an inventory entry, a legal basis and privacy-notice coverage
Agentic AI (Etken Yapay Zekâ)	March 2026	Autonomous agents processing unforeseen data, black-box transparency, accountability	In agent architectures: least-privilege tool and data access, human oversight at critical steps, step-level logging
Use of Generative AI Tools in the Workplace	June 2026	Shadow AI, internal policy, employee awareness, human review	An approved-tools list, rules on what data may be entered, and employee training are now explicit regulator expectations

The common thread: using AI is permitted, but undocumented, policy-free use is the risk. The 15-Questions guide explains how the general principles (purpose limitation, data minimization, proportionality) apply to generative systems; the Agentic AI paper treats agents' ability to create new tasks and pull in new data on their own as a distinct risk class; and the workplace announcement makes clear that much of the compliance burden is organizational, not technical.

Cross-Border Transfers: Explicit Consent or Standard Contract?

Sending personal data to an AI API whose servers are abroad is, in most scenarios, a cross-border data transfer under Article 9 of KVKK and requires a valid transfer mechanism. The transfer regime overhauled in 2024 has three layers: transfers to countries covered by an adequacy decision; absent that, appropriate safeguards (signing the standard contract published by the Authority — with a notification obligation to the Authority after signing —, binding corporate rules, or a written undertaking); and only for incidental (one-off) cases, exceptions such as explicit consent.

Two points are routinely missed in practice:

• Continuous API traffic is not "incidental". A production integration pushing thousands of requests a day is hard to rest on the explicit-consent exception; consent can also be withdrawn at any time, and the burden of proof is yours. Explicit consent is a narrow exception, not a primary mechanism.
• The standard contract carries operational load. You need the foreign provider to sign the Authority's template, you must notify on time, and you must track changes in the sub-processor chain — and whether the provider will even sign that template is a procurement question of its own.

That is why the two most robust engineering strategies shrink or eliminate the transfer question altogether: mask personal data before the API call so that no personal data leaves the country at all, and/or work with a provider whose contracting entity is in Turkey and whose data processing terms are built around Turkish regulation. Decide which mechanism fits your specific flow together with your legal team; this section is not legal advice.

Technical Safeguards: Masking, Prompt Hygiene and Logging

The most effective KVKK safeguard is making sure personal data never reaches the API in the first place. In most enterprise scenarios the model needs the task, not the identity: summarizing a support ticket does not require the customer's name, phone number or national ID. A simple masking step in your application layer, before the prompt is built, implements data minimization and shrinks the cross-border question at the source:

import re

def mask(text: str) -> str:
    text = re.sub(r"\b\d{11}\b", "[NATIONAL_ID]", text)
    text = re.sub(r"\b0?5\d{9}\b", "[PHONE]", text)
    text = re.sub(r"[\w.+-]+@[\w-]+\.[\w.]+", "[EMAIL]", text)
    return text

prompt = mask(ticket_text)  # only the masked version is sent

Complementary prompt hygiene rules: do not copy free-text fields into prompts verbatim; never embed real customer records in system prompts; use synthetic data in test environments; in RAG pipelines, scan documents for personal data before indexing. Placeholders can be re-mapped on your side after the response returns.

The second pillar is your logging policy: if prompt and response logs contain personal data, they are themselves a data asset under KVKK. Prefer metadata only (timestamp, model, token counts, cost) over full text; if full text is required, log the masked version; define a retention period with automatic deletion; restrict access by role and log the access itself. The third pillar is the employee dimension — exactly what the Authority's June 2026 workplace announcement is about: the typical source of an incident is not malice but convenience, an employee pasting a raw customer list into an unapproved chat tool. Publish a short internal policy with an approved-tools list, prohibited data types and concrete examples, and make the training part of onboarding.

A KVKK Compliance Checklist for Companies Using AI APIs

The list below translates the expectations of the three guidance documents into the day-to-day practice of a company integrating an AI API. Adapt each item to your own scenario and make the final assessment with your legal team:

1. Add it to the inventory: every AI integration — SaaS tool, API or in-house build — goes into the data processing inventory as a separate activity.
2. Fix the roles contractually: in most scenarios you are the data controller; the provider's processor role and its obligation to process only on your instructions belong in writing.
3. Record the legal basis: document the processing condition you rely on for every flow carrying personal data; for special categories, the default should be "do not send to the API".
4. Update privacy notices: flows where customer data is processed by AI must be covered explicitly.
5. Choose the transfer mechanism: for a foreign provider, put an appropriate safeguard such as the standard contract in place and calendar the notification duty — or choose an architecture where personal data never leaves the country.
6. Build the masking layer: national IDs, phone numbers, e-mail addresses and similar fields are masked automatically in the application layer before any API call.
7. Write down the logging policy: what is logged, how long it is kept, who can access it — all three answers in one document, with automatic deletion enforced.
8. File the provider's commitments: the "your data is not used for training" commitment, retention/deletion policy and sub-processor list belong in your vendor file in writing.
9. Put human oversight into agents: in autonomous agent flows, apply least privilege to tool and data access, require human approval for irreversible steps, and log agent steps (the core expectation of the March 2026 Agentic AI paper).
10. Employee policy and training: publish an internal policy with the approved-tools list, data types banned from prompts and shadow-AI rules; repeat the training periodically.

The first five items sit with legal and compliance, the last five with engineering and HR — KVKK compliance is not a single team's job.

How It Works on Onysoft: Local Contracting Entity, E-Invoicing and the Technical Setup

What simplifies the compliance picture on Onysoft AI Gateway is the architecture itself: for contracts, privacy notices and billing, your counterparty is a legal entity in Turkey — Izmir-based Onysoft Veri Merkezi A.S. The platform runs data processing practices aligned with Turkish regulation, and data sent to the API is not used for model training. On the procurement side, corporate e-invoices (e-fatura) are issued and payment is in Turkish Lira; no foreign card, overseas payment method or VPN is required. In practice this turns procurement and contracting rounds that can take months with foreign providers into days. Our Anthropic Claude Partner Network membership is an additional verifiable third-party signal you can file in your vendor assessment.

Technically, a single OpenAI-compatible API gives you 708+ models from more than 60 providers; in existing code only the base_url changes. Combined with your masking layer, a typical call looks like this:

curl https://api.onysoft.com/v1/chat/completions \
  -H "Authorization: Bearer sk-ony-YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "google/gemini-3.6-flash",
    "messages": [{"role": "user",
      "content": "Summarize this ticket: [CUSTOMER_NAME] is waiting for a reply at [EMAIL] about a product return..."}]
  }'

A question we hear often: does routing through a local layer cost you performance? Our live production data says it is not an issue in practice:

Metric	Value
Average end-to-end response time	3.8 seconds
Fastest response	0.3 seconds
Sample	6,959 successful requests
Period	Last 14 days

Measured: August 5, 2026 — api.onysoft.com live catalog

Pay-as-you-go pricing means no subscription commitment; you can pilot with a workflow low in personal data, try the behavior with synthetic data in the Playground, and follow the API documentation for integration steps. The 24/7 Turkish-language support team can also help with KVKK and procurement questions.

Last updated: August 5, 2026 · Data: api.onysoft.com live catalog