Customer data in AI tools: KVKK rules on transfers abroad

GDPR: transfers outside the EU

• Sending personal data to a recipient outside the EU/EEA is a transfer under Chapter V of the GDPR. It is allowed where the European Commission has adopted an adequacy decision for the destination country (Art. 45).[1][2]
• Adequacy decisions currently cover, among others, Japan, South Korea, Switzerland, the United Kingdom, and the United States for companies certified under the EU-U.S. Data Privacy Framework (decision of July 10, 2023). Turkey is not on the list.[2]
• Without an adequacy decision, an appropriate safeguard is needed, such as the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914 of June 4, 2021) or binding corporate rules (Art. 46).[1][3]
• The exceptions in Article 49 are for specific situations; the last-resort exception applies only to transfers that are not repetitive and concern a limited number of people (Art. 49(1)). Routing every customer message to an AI API is a regular flow, not an exception.[1]
• The GDPR also applies to businesses outside the EU that offer goods or services to people in the EU (Art. 3(2)). Transfer violations can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)).[1]

How can data be transferred?

• Personal data may be transferred abroad if one of the legal grounds for processing applies and there is an adequacy decision for the destination country (KVKK Art. 9/1).[4]
• The Turkish Personal Data Protection Board has not yet issued an adequacy decision for any country (kvkk.gov.tr, “Transfers Abroad” page).[7]
• Without an adequacy decision, one of these safeguards is required: the standard contract published by the Board, binding corporate rules approved by the Board, or a written undertaking with the Board’s permission (Art. 9/4).[4]
• The Board has published four separate standard contracts: controller to controller, controller to processor, processor to processor, and processor to controller. They must be used without changes.[6][5]

Notification, occasional transfers and fines

• A signed standard contract must be notified to the Turkish Data Protection Authority within five business days of the last signature, on paper, by registered e-mail (KEP) or by another method set by the Board (Regulation Art. 14/5).[5]
• Transfers that are not regular, happen once or a few times, and are not part of the ordinary course of business are occasional; the exceptions in Art. 9/6 can be used only for these (Regulation Art. 16/1). Sending every customer message to an AI API is a regular flow.[5][4]
• The law sets the administrative fine for failing to notify a standard contract at TRY 50,000–1,000,000 (Art. 18/1-d); these amounts are raised every year by the revaluation rate (Misdemeanors Law Art. 17/7).[4][8]

In practice

• Our practice noteRemoving fields such as customer names, phone numbers and addresses before uploading a file or text to an AI tool rarely changes the result, and it removes the transfer question altogether.
• Our practice noteIn the systems we build, personal data is masked before it reaches an AI API abroad; we make this the default.

Where does this come up?

• Auto-replying to WhatsApp messages with AI
• Transcribing and summarizing a meeting
• Building a monthly report from sales data
• Summarizing customer data without sending it to the cloud