Turkish DPA Issues Guidance on Agentic AI and Data Protection, Turkey, April 2026

On April 15, 2026, the Turkish Personal Data Protection Authority (KVKK) published a guidance document titled "Agentic Artificial Intelligence (Agentic AI)" on its official website. The document is not a binding regulation under Law No. 6698 on the Protection of Personal Data, but represents the DPA's formal position on how existing data protection obligations apply to agentic AI systems. The publication has no prior consultation period and constitutes soft-law guidance currently in force.

The controlling legal framework is Law No. 6698 on the Protection of Personal Data, which sets out the general principles of lawfulness, accuracy, proportionality, and purpose limitation for all personal data processing in Turkey. The Guidance invokes these principles in the context of agentic AI architectures. Article 4 of the KVKK Law enumerates the core processing principles and provides the interpretive basis for the DPA's assessment that agentic AI systems generate new layers of personal data — including inferred and derived data — that must meet the same lawfulness and accuracy standards as directly collected data.

The Guidance identifies four primary compliance areas for organizations deploying agentic AI. First, it treats derived and inferred data — outputs generated by correlating multiple datasets — as personal data subject to full KVKK compliance. Second, it requires that accountability among AI developers, providers, and deploying organizations be clearly allocated and documented, given that responsibility may fragment across multi-agent architectures. Third, it mandates a risk-based governance approach incorporating privacy by design and privacy by default. Fourth, it treats data accuracy not merely as a technical quality matter but as a direct requirement under Article 4(1)(d) of the KVKK Law, meaning that erroneous AI-generated outputs used in individual assessments may constitute unlawful processing.

Organizations deploying or building agentic AI solutions in Turkey must reassess their data inventories, legal basis documentation, vendor contracts, and human oversight mechanisms. Staff giving advice through agentic AI tools — particularly in financial services, insurance, and HR — face the most direct exposure, as individual assessments based on inaccurate AI outputs engage KVKK liability. The Guidance signals that the DPA will assess agentic AI systems across their full data lifecycle, including model outputs and downstream decisions, not solely the handling of input data.

The DPA imposes no compliance deadline or transition period in this Guidance. Open questions remain on how KVKK obligations interact with the EU AI Act for Turkish operators with EU-facing operations, and on the standard of human oversight the DPA will require in practice. Parallel DPA announcements concerning Grok and Google Assistant in February 2026 indicate active supervisory attention to AI-related data processing across multiple product categories.

Our firm advises on data protection law, AI governance, and regulatory compliance across Turkish and EU jurisdictions. We maintain a dedicated partner network covering cross-border AI and data matters and welcome inquiries from operators deploying or procuring agentic AI systems. Our work covers AI governance assessments, KVKK compliance reviews, data processing agreement drafting, AI regulatory advice, agentic AI liability analysis, privacy by design implementation, and cross-border data transfer structuring.

Source: Kisiel Verileri Koruma Kurumu (KVKK), "Agentic Artificial Intelligence (Agentic AI)" Guidance, published April 2026. Official source: https://www.kvkk.gov.tr — confirmed April 16, 2026. Controlling statute: Law No. 6698 on the Protection of Personal Data, Article 4(1)(a)-(e).

The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.