The “Implementation Guide on the Protection of Personal Data in Lawyers’ Professional Activities”, jointly prepared by the Turkish Personal Data Protection Authority (KVKK) and the Union of Turkish Bar Associations, was published on 22 September 2026.
The guide covers the personal data side of our profession from start to finish and is well worth reading in full. Here I want to focus on its section on generative AI.
On pages 120–122, the Authority does not hesitate to name ChatGPT, Claude and Gemini. It states that when a client file, case documents or any document containing personal data is uploaded to these tools, the data is processed on the service provider’s infrastructure; and that if the provider is established abroad, or its servers or sub-processors are located abroad, this may be regarded as a cross-border transfer within the meaning of Article 9 of the Personal Data Protection Law.
The guide tells us what to look at: the tool’s terms of use, its privacy policy, where the data is stored and in which countries it is processed, the provisions on sub-processors, and any cross-border transfer mechanisms.
The most striking part, however, is this: even if the provider is established in Turkey and the data is processed in Turkey, sending the file to that provider may still constitute a transfer under the Law. It is therefore necessary to act in accordance with Article 8 and to assess separately the legal basis, the purpose, the categories of data transferred and the proportionality of the transfer.
In other words, from a data protection perspective, AI is not simply a question of “domestic or foreign”. We need to know which AI provider we share which data with, and we need to put this in writing.
The guide also refers to four separate publications of the Authority on artificial intelligence: “Use of Generative AI Tools in the Workplace”, “Information Note on Chatbots (the ChatGPT Example)”, “Generative AI and the Protection of Personal Data – A Guide in 15 Questions” and “Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence”.
My advice to colleagues: read at least this section.
Sources
- KVKK & Union of Turkish Bar Associations, Implementation Guide on the Protection of Personal Data in Lawyers’ Professional Activities (PDF, in Turkish; generative AI section on pp. 120–122)
- KVKK announcement of the guide (in Turkish)
- Union of Turkish Bar Associations announcement (in Turkish)
- Personal Data Protection Law No. 6698 (official English translation by KVKK, including the 2024 amendment to Article 9)
- Law No. 6698, official Turkish text (mevzuat.gov.tr)
The four KVKK publications on artificial intelligence referred to in the guide (PDFs, in Turkish):
- Use of Generative AI Tools in the Workplace (2026)
- Information Note on Chatbots (the ChatGPT Example) (June 2025)
- Generative AI and the Protection of Personal Data – A Guide in 15 Questions (November 2025)
- Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence (April 2025)
