Are AI agents compliant with KVKK? The 2026 guide

Published: October 19, 2026

The short answer: KVKK regulates how data is processed, not the agent

Law No. 6698 has no separate protection regime specific to artificial intelligence systems. That does not mean agents fall outside the Law. If an agent touches information that identifies a real person, such as name and surname, ID number, phone, e-mail, voice recording, location, customer or employee information, behavioural data, health or biometric data, that operation is assessed under the KVKK provisions. What matters is not the name of the technology; it is whether personal data is processed, for what purpose, and on which legal basis. So the question to ask is not 'is the agent compliant' but 'how does this agent process data'. The same agent works compliantly when set up correctly and produces a breach when set up wrongly. There are three points to look at: which data the agent accesses, where it sends the data (a system inside the company, or a model abroad) and what the user is told. Below we go through, in order, the role of the company using the agent, the five core obligations, the hallucination risk and a checklist to pass before going live.

What role does the company using the agent have under KVKK

In 2026 the Personal Data Protection Authority published its Agentic AI guide, which deals directly with artificial intelligence agents. The guide acknowledges that the data processing activity is spread across the developer, the deployer and other actors, and that apportioning responsibility becomes harder when a breach occurs. It does not offer this difficulty to anyone as an excuse either. The equivalent in Turkish practice is clear: whatever the model provider behind the agent does, the data controller towards the customer and the employee is the company using the agent. When the agent sends an e-mail, issues an invoice or transfers data on behalf of the company, it is this company that is held to account. The guide asks for two more things: recording agent flows in the processing inventory, and building human oversight from the design stage, not as an approval button added afterwards. The Authority's list of measures also includes clarifying the roles between developer and deployer as a separate item. At this point chatbots and agents must not be confused. A chatbot produces an output, and a human decides what to do with that output. An agent takes a goal and acts across multiple systems without a human in between: it creates a shipment, sends an e-mail, adds a note to the CRM. In classic artificial intelligence what is managed is output risk; with an agent, action risk is added to that. A bot that gives a wrong answer embarrasses the company; an agent that takes a wrong action sends the company's money.

Five core KVKK obligations for an AI agent

Information notice and legal basis: explicit consent is not always required

What the agent does: it takes data from the user, processes it and often carries it to other systems. The user does not see this flow; the information obligation in Article 10 of the Law exists precisely to remove this invisibility. The company must give the user a short information notice at the first contact with the agent. On the legal basis side, Article 5 of the Law recognises other grounds besides explicit consent, such as performance of a contract and legal obligation. If the work the agent does fits one of these grounds, explicit consent is not separately required. The point to watch is the continuity of the basis: the guide says that new data uses emerging as the task progresses can break the link with the initial legal basis. Data collected for support flowing into sales scoring is the typical example of this break. The basis must be re-checked for every new purpose.

Data minimisation and retention period

What the agent does: the risk the guide puts first is the scope of processing widening as the task progresses. The agent reads every field in the CRM 'to be helpful' and reaches for data beyond its purpose. What the company has to do: Article 4 of the Law requires data to be relevant to the purpose, limited and proportionate. Giving the agent only the fields needed for the task is the practical equivalent of this principle. Collecting more customer or employee data than needed on the grounds that it may be used in artificial intelligence later creates a problem in terms of purpose limitation and proportionality; the model being able to benefit from more data does not grant a right to unlimited collection. The same article requires data to be kept only for the period set out in legislation or necessary for the purpose. For conversation records this period must be determined and written down. For agents that touch special categories of data such as health or biometric data, Article 6 of the Law comes into play.

Cross-border transfer: LLM APIs are the biggest risk point

What the agent does: it sends the prompt and attached documents to a model outside the company. The point often overlooked is this: the commands entered into the system and the files uploaded can also contain personal data. An employee uploading a contract containing a customer's name, address and contact details to an external artificial intelligence tool with the instruction 'find the risks' amounts to processing personal data and, depending on the conditions, transferring it to a third party or abroad. What the company has to do: know where the model the agent connects to runs, and assess this flow as a transfer. Entering third parties' data into artificial intelligence tools can constitute a breach of KVKK; for this reason a written artificial intelligence use policy is needed inside the company.

Security and breach notification

What the agent does: it accesses systems through tool calls and widens the attack surface. The guide counts data disclosure through input manipulation as a separate risk; an agent exceeding its authority and leaking data through prompt injection runs straight against the data security obligation in Article 12 of the Law. What the company has to do: giving a goal without giving limits is like handing an intern the company card and saying 'increase sales'. Leave irreversible operations to a human and routine ones to the agent; enforce the prohibition at the action gate, not on paper. An agent with no approval threshold can send money or leak data overnight. On audit day, what is believed is not what you remember but what you recorded; that is why agent logs are the first foundation of breach management. The sentence 'we have a stop button' is empty if it has not been tested: who will stop it, in how many seconds, and what happens afterwards should be written down and rehearsed on a calm day.

Is the AI agent hallucination problem a KVKK risk, and how is it solved

Yes, it is a KVKK risk. The guide counts hallucination among personal data risks and ties it to the accuracy principle in Article 4 of the Law. An address, balance or record detail the agent makes up means processing personal data incorrectly. In multi-step flows the problem grows: fabricated information in the first step spreads through the chain and turns into an action at the fifth step. The guide's list of measures gives the framework for the solution. First, continuous oversight of data accuracy; the information the agent produces should be checked regularly, not once. Second, a human-centred approach and human oversight in three stages: development, deployment and post-use. Third, an appropriate level of transparency and explainability. Telling the user that the answer was generated automatically does not relieve the company of responsibility; the company is the data controller. Still, this disclosure serves the guide's transparency expectation and the information obligation in Article 10. Agents do not break by exploding; they break by drifting over time, and only the company that monitors catches the early signals.

An AI assistant for the sales team: working with CRM data

A sales assistant is most exposed to two risks: purpose drift and profiling. If the assistant enriches prospect data, that is a new processing purpose and must be added to the inventory, the information notice and the legal basis assessment. The second risk is profiling and inference. Calendar, e-mail and meeting transcript data that look innocent on their own turn into a comprehensive file on a single person when combined. The guide's methodological choice is decisive here: the assessment is made not over individual operations but over the holistic working of the system. The right to object to automated outcomes and the proportionality principle draw the limits of these files. A separate note for the meeting summarisation function: video and audio recordings are personal data under the Law. The assistant should not process this data without the recorded counterparty being informed. The practical limit is this: the assistant may prepare a draft proposal, but it should not reach for special categories of data such as health, or customer information beyond its purpose.

Commissioning custom AI software: what to put in the contract

When working with an external developer firm, the responsibility section of the guide sets the backbone of the contract. Even if data processing is spread between the developer and the deployer, the one responsible towards the customer is you. The contract must therefore spell out the data controller and data processor roles; which data the model provider and the developer will touch, and for what purpose, must not be left vague. Carry the guide's measures into the acceptance criteria. Privacy by design and by default and privacy enhancing techniques (PET) are among the measures the guide expects; if these are part of the acceptance test, you avoid the problem of the approval button that someone tries to add later. Building human oversight at the design stage, logging actions and an approval threshold for irreversible operations should go on the same list. The company that follows the guide voluntarily today will be ready tomorrow when an inspector opens the same text in an audit.

Frequently asked questions

Is it a KVKK breach for the agent to connect to a model abroad such as ChatGPT?

Not a breach in itself, but it counts as processing personal data and, depending on the conditions, transferring it to a third party or abroad. Uploading a document containing a customer's name, address and contact details to an external artificial intelligence tool falls within this scope. The company needs to assess this flow under KVKK and create a written artificial intelligence use policy for its employees.

Who is responsible if the agent produces false information (hallucination)?

The company, as data controller, not the model provider. The Authority's guide counts hallucination as a personal data risk that threatens the accuracy principle.

How is the information notice given for a chat assistant on a website?

Article 10 of the Law governs the information notice and Article 11 the user's rights. The notice should tell the user that they can learn whether their data is processed, whether it is used in line with its purpose and whether it is transferred to third parties, and that they can request correction and deletion. The text should be accessible from the chat window and the assistant should record incoming deletion requests.

How long can the conversation records the agent keeps be retained?

Article 4 of the Law does not set a fixed period; data is kept for the period laid down in legislation or for as long as the processing purpose requires. The purpose determines the period, the company puts it in writing and deletes records whose period has expired.

If you want to see your agent's KVKK compliance before going live, send your data flow diagram to the horoz.ai team; we will mark at which step cross-border transfer and at which step consent is required and return a written checklist to you.