KVKK's generative AI guide read for hotels: what it covers and what to take to your adviser

Türkiye's Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, the regulator for the KVKK law) published "Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi (15 Soruda)" on 24 November 2025. It is guidance, not a new rule: 15 questions on how the existing personal data law (KVKK, Law No. 6698) applies to generative AI. Hotels should read questions 5, 9, 10, 11, 12 and 13, and take the rest to their adviser.

A front desk supervisor pastes a guest's complaint into a chat tool to draft a polite reply. The message carries a name, a room number, a stay date and a health detail. That single action is the situation the KVKK guide is written about. After reading this article you will know which of the guide's 15 questions touch your hotel's daily work, what the guide says on each, and which decisions belong to your legal adviser rather than to you.

What is the KVKK generative AI guide?#

It is a guidance document, not a new law. Türkiye's Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, KVKK), the regulator for personal data, published "Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi (15 Soruda)" on its website on 24 November 2025, and the PDF cover reads "Yayın No: 113, Kasım 2025". The Authority says it prepared the guide to guide the actors who act as data controllers in personal data processing across the life cycle of generative AI systems.

The format is 15 numbered questions, each answered in prose, from "what is generative AI" to "what can parents do". It is a reading document, not a checklist of duties. The law it interprets, Law No. 6698, predates generative AI and does not mention it. The guide explains how that law applies; it does not add a duty or grant a permission. Throughout this article, "the guide says" means exactly that, never "the law now requires".

The guide builds on an earlier document, "Yapay Zekâ Alanında Kişisel Verilerin Korunmasına Dair Tavsiyeler" (KVKK Publication No. 76, April 2025), which the November guide cites for its definitions of AI developer and AI service provider. The primary text is worth opening because Turkish coverage is mostly law-firm summaries written for companies in general, and your adviser will work from the guide's own wording on consent, transfers and transparency.

Which of the 15 questions touch daily hotel work?#

Six of them do: question 5 on risks, question 9 on legal grounds, question 10 on transfers abroad, question 11 on transparency, question 12 on data subject rights and question 13 on security. The rest explain the technology or address individuals rather than controllers.

Consider the staff drafting example again. A message pasted into a chat tool can carry a name, a room number, a stay date and a complaint. Questions 6, 9, 10 and 11 all bear on that one action, which is why a staff rule matters more than a tool choice. The same logic applies to a guest-facing assistant on the hotel website or in a guest app: question 11 states that people who interact with systems such as chatbots should clearly know they are communicating with a generative AI system.

Analysing reviews, OTA messages, complaint logs or call transcripts to find recurring problems feels anonymous, but question 6 asks whether personal data are in fact processed, and free text often carries identifiers. Generating marketing copy or images from guest photographs, reviews or staff material is also covered: question 9 states that data a person has made public may be processed only in line with their intention in making it public, and that data anyone can access is not data anyone may freely process.

When choosing a tool, question 7 on controller and processor and question 10 on transfers decide what the contract must contain and what the provider must disclose. Keep the frame right: the guide is not a ban list. It asks the hotel to answer, for AI, the same questions it already answers for any other processing of personal data. For what staff may share, write the rule down in your own AI policy and have it reviewed by your adviser.

What does the guide say about legal grounds for processing?#

The guide says processing through a generative AI system must rest on at least one of the limited processing conditions in Article 5 of Law No. 6698, or Article 6 for special categories of data, that the conditions have no hierarchy, and that a condition should be identified separately for developing a model, running it and using its outputs. The starting point is plain: the Law does not refer to AI, but it applies whatever the technology.

Three activities, three conditions. Developing a model, running it and using its outputs can each be a separate processing activity, so a hotel that only uses a tool is answering a narrower question than the provider that builds one. Consent does not travel: explicit consent given for using a generative AI system does not cover developing it.

Contract performance has a boundary. It can cover processing a user's inputs to provide a chatbot service, but not using user data to develop large language models or to serve personalised ads. Legitimate interest is neither a last resort nor a catch-all; the guide asks for a two-stage assessment with a balancing test, and calls a data protection impact assessment useful where systems can significantly affect people's lives, while noting the Law does not require one.

What the hotel can do without a lawyer: for each AI use, write down what data go in, what comes out, who receives them and for what purpose. That description is the input your adviser needs, and it is the hotel's job, not the adviser's.

What does the guide say about transfers abroad?#

The guide says a transfer abroad needs one of the processing conditions plus an adequacy decision, or a condition plus one of the appropriate safeguards in Article 9 of the Law, provided the data subject can exercise their rights and seek effective remedies in the destination country; failing both, only the incidental cases the Law lists are allowed. Transfers are also governed by the Regulation on the Procedures and Principles for Transferring Personal Data Abroad, Official Gazette of 10 July 2024, No. 32598.

The sentence that lands on hotels is this: where data controllers operating in Türkiye use generative AI systems through service providers established abroad, and personal data are transferred abroad through those systems, the transfer must be carried out in line with Article 9 and that Regulation. Many chat tools process outside Türkiye; that is a fact to establish with the provider, not a conclusion to draw here.

Reframe the buying question. Not "is this tool good" but "where is it processed, by whom, under which contract, and what safeguard is offered". Do not confuse the question with residency marketing: a provider saying data are stored in one country does not answer where processing happens or which subcontractors are involved. Whether a specific tool and a specific data flow meet the framework is a legal judgement for your adviser, and this article does not make it.

For the tool-selection side, see our business account checklist for hotel AI chat tools.

What does the guide ask about transparency, guest rights and security?#

It asks the hotel to inform people separately and explicitly about processing for using a generative AI system and about processing for developing systems and models, to tell people when they are talking to a generative AI system, and to keep the rights in the Law working in practice. The duty to inform applies, and the guide names the Communiqué on the duty to inform, Official Gazette of 10 March 2018, No. 30356.

Two notices, not one. The guide says it is important to inform people separately and explicitly about processing for using a generative AI system or its interface, and about processing for developing systems and models, and to inform them again if the purpose changes. Where processing rests on explicit consent, informing people and obtaining consent are done separately, in plain language; a consent box does not replace an information notice.

Reach and clarity matter. The notice should be easy to reach in the system interface, and people interacting with a chatbot should clearly know they are communicating with a generative AI system. Data not obtained from the person, such as a forwarded message or a public review, still triggers information within a reasonable time.

On rights, the guide states that the rights in Article 11 apply to generative AI systems and that practical difficulties do not make them inapplicable. It singles out the right to object to a result against the person arising from analysis done exclusively by automated systems, and says the rights cover training data, fine-tuning data, information in model outputs and content in user queries. Its practical recommendations are systematic records, traceability tools such as data mapping and data labelling, and privacy by design and by default. Question 13 on security sits in the same group.

For the wider KVKK duties behind this, see our KVKK guide for hotels.

What goes into a one-page reading note for the hotel's KVKK file?#

One page with three parts: what the guide is, which of its questions touch the hotel's own AI uses, and the open questions the adviser must answer. It is a record of reading and of facts, not a legal opinion.

The header carries the guide title, publisher, publication date 24 November 2025, publication number 113 and the kvkk.gov.tr address, so a later reader can check the same text. The body carries an inventory of the hotel's AI uses today, each with the data that go in, the tool, where it is processed and who inside the hotel may use it. For each use, note the guide's questions that apply and the hotel's current answer, or the word "open". An honest "open" is worth more than an invented answer.

The open questions for the adviser go in dated, with the answer written back in when it arrives. This is how the note stays alive instead of becoming a document nobody opens. Use a review trigger rather than a calendar date: revisit when a use changes, a new tool is adopted or a provider changes its terms. What must not appear: no "we are compliant" statement, no legal conclusion the adviser has not given, no claim of certification. The guide is guidance, and the note should read like one.

What to do next#

Open the guide's PDF (opens in a new tab) on the Authority's website, list the hotel's AI uses on one page with the data, the tool and the processing location for each, and take that page to your adviser. The guide supplies the questions, the hotel supplies the facts, and the adviser supplies the judgement. The staff rule and the adviser question list, covered in our article on KVKK questions for your adviser, are the two documents that come out of it.