Generative Artificial Intelligence And Personal Data Protection Guidelines: Key Compliance Obligations For Companies Using Generative AI Systems

I. Overview of the Generative Artificial Intelligence and Personal Data Protection Guidelines

On 24 November 2025, the Turkish Data Protection Authority (Kişisel Verileri Koruma Kurumu – "DPA") published the Generative Artificial Intelligence and Personal Data Protection Guidelines (the "Guidelines"). The document represents the DPA's first comprehensive attempt to address the data protection implications of generative artificial intelligence ("Generative AI") systems under Law No. 6698 on the Protection of Personal Data ("DP Law").

Rather than introducing new binding rules, the Guidelines aim to interpret existing personal data protection principles in light of rapidly evolving Generative AI technologies. In doing so, the DPA examines how personal data is processed at each stage of a generative AI system, from the initial development and training phase to deployment and day-to-day use. The Guidelines place particular emphasis on transparency, accountability,