AI kit for legal and compliance teams under KVKK
A legal team starts using AI under KVKK, Turkey's data protection law, by classifying each text before it reaches a tool: send it if it has no personal data, mask it if it has identity, contact or financial data, keep it in-house if it has special-category data or a specific person's legal matter. This kit turns that rule into eight legal tasks, ready prompts, a pilot sheet and an editable usage policy.
The kit is in English, for legal and compliance teams of organisations operating in Turkey, including multinationals and law firms advising on KVKK. The prompts are in English and work on Turkish text. A Turkish edition is also available.
Try the free masking tool first.
- Contents
- PDF (13 pages), Excel workbook, Word policy template, prompts (TXT)
- Language
- English; Turkish edition available
- Price
- $19, pay what you want; one purchase covers one team
- Based on
- KVKK authority, guide on generative AI and personal data (15 questions), 24 November 2025
- Updated
The data rule: send, mask, keep in-house
- Keep in-house if the text has special-category data (KVKK Article 6), criminal or disciplinary information, or a specific person's legal matter (lawsuit, enforcement, notice, power of attorney).
- Mask, then send if it has identity, contact or financial data.
- Send if it has no personal data: a blank contract template, published legislation, a draft policy.
Masking is not anonymisation. While labels can be reversed, masked text can still count as personal data; the KVKK guide asks for anonymity to be shown with technical methods and objective criteria (p. 26). If the tool's provider is abroad, KVKK Article 9 on cross-border transfer applies as well (guide p. 48).
Questions about AI in a Turkish legal team
What does the KVKK guide on generative AI say?
The KVKK authority published a 15-question guide on 24 November 2025. It says that the law applies even when the prompt has no personal data but the output does (p. 25), that true anonymity must be shown with technical methods and objective criteria (p. 26), and that Article 9 applies when data goes abroad through providers based outside Turkey (p. 48). It advises individuals not to share health, financial or legal-matter information (p. 58).
How many days does a data controller have to answer a KVKK request?
Under KVKK Article 13 the controller concludes the request as soon as possible and within thirty days at the latest, free of charge. The kit's Excel sheet computes the deadline from the date received and flags overdue requests.
When must a personal data breach be reported to the KVKK Board?
KVKK Article 12/5 asks for notice to the person concerned and to the Board as soon as possible. The Board's decision 2019/10 of 24 January 2019 sets the Board notice at no later than 72 hours after the controller learns of the breach.
Get the kit
Turkish edition: Hukuk ve uyum ekibi için yapay zekâ kiti
Not legal advice. Related: Personal data and AI · Turkish KVKK classifier · Turkish PII masking model