The use of artificial intelligence in the public sector: personal data, transparency and human oversight

Article 4 of the Law on the Protection of Personal Data states that personal data may only be processed in accordance with the procedures and principles set out in laws, and lists the principles that must be observed. These principles apply equally to artificial intelligence projects:

• Being lawful and in accordance with the rules of good faith
• Being accurate and, where necessary, up to date
• Being processed for specific, explicit and legitimate purposes
• Being relevant to, limited to and proportionate with the purposes for which they are processed
• Being retained for the period laid down by the relevant legislation or required for the purpose for which they are processed

Article 11 of the Law grants the data subject the right to object to the emergence of a result against them arising solely from the analysis of the processed data through automated systems. A public institution using artificial intelligence in service delivery must design from the outset an application and review channel through which this right can actually be exercised.

In its document "Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence," published in 2021 by the Personal Data Protection Authority and reissued in April 2025 as KVKK Publication No. 76, the Authority offers separate recommendations for developers, service providers and decision-makers. Although the document is not a binding regulation, it reflects the Authority's approach in this field.

General recommendations include carrying out a privacy impact assessment where a high risk is anticipated for the protection of personal data, preferring anonymisation methods where the same result can be achieved without processing personal data, and determining the data controller or data processor status of stakeholders at the start of the project. For developers, the recommendations include using the minimum data necessary, continuously monitoring the accuracy of the model, granting individuals the right to object, and designing products that ensure individuals are not subjected to a decision based solely on automated processing.

This recommendation addressed to decision-makers is the principle most directly applicable to public institutions. The document also recommends that the principle of accountability be observed at all stages, and that sufficient resources be allocated to monitor whether artificial intelligence models are used for a different context or purpose than intended.

The National Artificial Intelligence Strategy (2021-2025) was put into effect by Presidential Circular No. 2021/18, published in the Official Gazette of 20 August 2021, No. 31574. Following this period, Presidential Circular No. 2026/9, dated 17 August 2026, was published in the Official Gazette of 18 August 2026, No. 33344. The circular requires that Turkey's Artificial Intelligence Action Plan (2026-2030), prepared under the coordination of the Ministry of Industry and Technology, be implemented in line with the principles of human-centredness, reliability, ethical responsibility, digital sovereignty and sustainable development, and that public institutions carry out the tasks assigned to them in the plan.

The plan also provides for the establishment of a National Artificial Intelligence Ethics Board, which will publish practical guidance on matters including human oversight; for KVKK compliance to be strengthened so as to cover the obligation of explainability in automated decision-making processes; and for guides, checklists and standard templates to be published for artificial intelligence systems developed or procured in the public sector. The plan also provides for a senior official responsible for artificial intelligence transformation to be appointed in public institutions, with institutions then required to prepare a three-year Artificial Intelligence Roadmap within 12 weeks. Some of these provisions will be given concrete form through guides to be published later.

The European Union's (EU) Artificial Intelligence Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024. The Act addresses systems at four risk levels: unacceptable risk, high risk, transparency risk and minimal risk. Although not directly applicable in Turkey, its risk-based approach provides guidance for public institutions.

Among the high-risk areas listed in Annex III of the Act is access to essential public services and benefits; the assessment by public authorities of a person's eligibility for essential public benefits and services falls within this scope. Education, employment, law enforcement, migration and the administration of justice are also included in the same annex. Deployers that are bodies governed by public law are required to carry out a fundamental rights impact assessment before putting such a high-risk system into use (Article 27). Article 14 requires that the person responsible for oversight be able to disregard, override and stop the system's output; Article 26 requires the deployer to keep the system's logs for at least six months.

The timeline for entry into application is staggered. The prohibited practices and the obligations on artificial intelligence literacy apply from 2 February 2025, and the rules on general-purpose artificial intelligence models from 2 August 2025. Regulation (EU) 2026/1744, which amends the Act and entered into force on 27 July 2026, postpones the date of application of the rules on the high-risk areas listed in Annex III to 2 December 2027, and for systems embedded in products to 2 August 2028.

The OECD's AI Principles, adopted in 2019 and updated in May 2024, also count transparency and explainability, robustness and security, and accountability among their core principles.

The documents above draw a common framework. Before procuring or developing an AI-supported system, the institution must put the answers to the following questions in writing: