Legal Glossary

An algorithm is a set of rules that defines, in sequence, the steps to be followed to reach a particular result; in law it mostly describes the logic by which software processes data to rank, recommend, score or produce decisions. There is no general statutory definition of an algorithm in Turkish legislation. The concept is, for example, made subject to transparency obligations, without being defined, in additional Article 4 of Law No. 5651 concerning social network providers.

Artificial intelligence is a general concept describing computer systems that produce outputs such as predictions, content, recommendations or decisions by making inferences from the data they receive and that can operate with a degree of autonomy. There is no general statutory definition of artificial intelligence in Turkish legislation. The official definition most often referred to is the definition of an AI system in Article 3/1 of the European Union Artificial Intelligence Regulation (EU) 2024/1689; this Regulation is not binding in Türkiye of its own force.

A data controller is a natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system. It is defined in Article 3/1-ı of Law No. 6698 on the Protection of Personal Data. The core obligations in the Law, such as informing data subjects, data security, responding to data subject applications and, where required, registering with the Data Controllers’ Registry (Veri Sorumluları Sicili), as a rule fall on the data controller.

A data processor is a natural or legal person who processes personal data on behalf of the data controller and on the basis of the authority given by the data controller. It is defined in Article 3/1-ğ of Law No. 6698 on the Protection of Personal Data. External service providers offering payroll, accounting, cloud hosting or call center services are in this position in many cases. The data processor does not itself determine the purposes and means of processing; the Law holds the data controller jointly responsible with the data processor for security measures.

Explicit consent is the approval that a person gives, on the basis of prior information and of their own free will, for data processing on a specific subject. It is defined in Article 3/1-a of Law No. 6698 on the Protection of Personal Data and appears in Article 5 as one of the conditions for processing personal data. Where another processing condition listed in the Law exists, explicit consent is not required. Consent that has been given can be withdrawn at any time; withdrawal has effect for the future.

Generative artificial intelligence refers to artificial intelligence systems that, through models trained on large datasets, produce new text, images, audio, video or software code in response to a user’s request. There is no statutory definition of this concept in Turkish legislation. The European Union Artificial Intelligence Regulation does not provide a separate definition either; it regards large generative models as a typical example of general-purpose AI models and provides for the marking of artificially generated content.

Personal data is any information that identifies a natural person, either directly or when combined with other information. It is regulated in Article 3/1-d of Law No. 6698 on the Protection of Personal Data and is based on a person whose identity is identified or identifiable. Name, identity number, contact details, photographs, voice recordings and location fall within this scope. Information relating to legal entities and data that has been anonymized in such a way that it cannot be linked to any person remain outside the protection of the Law.

Profiling is the automated processing of a person’s personal data in order to evaluate or predict characteristics such as work performance, economic situation, health, preferences, reliability, behavior or location. The Personal Data Protection Law No. 6698 (KVKK) contains no definition of profiling; the definition most commonly relied on is found in Article 4(4) of the EU General Data Protection Regulation (GDPR). The closest provision in Turkish law is the right to object to an adverse result arising exclusively from automated analysis (KVKK Article 11/1-g).