TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
stance on the application of this exemption to health data processing for scientific purposes, relying on this exemption may not be possible, especially consider - ing the commercial nature of such activities, which creates legal uncertainty. In terms of the open health data space, the By-law on Personal Health Data stipulates that the data con - tained in systems used by organisations affiliated with the Ministry of Health, with a consideration on regulations related to data privacy and security, shall be made accessible to everyone through a dedicat - ed website with the aim to ensure transparency and accountability in the healthcare system, guide policies and strategies for healthcare service delivery, support scientific research in the health sector, and facilitate the development of health-related products and ser - vices. Lastly, according to the By-law on the Protection and Processing of Data Within the Social Security Institution (SSI), data obtained by the SSI may be anonymised and transferred upon the Institution’s approval, for purposes such as the development of health and social security policies, the protection of public health, the preparation of statistics, and scien - tific or academic research. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Türkiye does not currently have an AI law but is focused on regulating AI in the future, setting goals for a comprehensive legal framework and AI governance in line with international trends, including the EU’s AI Act, as outlined in its strategy documents. In addition, the DP Law does not establish a specific regime for processing activities carried out through AI systems. However, the DPA has issued specific guidance titled “the Guideline on Generative Artificial Intelligence and Personal Data Protection (AI Guideline)”. The AI Guideline provides clarifications on how to ensure compliance with the DP Law in processes involving generative AI. The AI Guideline provides recommen - dations aimed at facilitating transparency in the devel - opment, deployment, and use of generative AI, and it recommends a human oversight mechanism, but it does not establish a risk-based regime. Consequently,
the AI Guideline serves as a resource for those devel - oping, deploying, and using generative AI. However, a few statements in the AI Guideline appear to have potential to give rise to uncertainty in practice. The DPA has also published a guidance titled “Use of Generative AI Tools in Workplaces”, which highlights key risks related to the use of third-party generative AI tools, such as data protection, information security, trade secrets, and inaccurate outputs, and provides governance recommendations for companies, without introducing specific legal obligations. Lastly, in March 2026, the DPA accomplished a guideline in AI governance by issuing its Guideline on Agentic Artificial Intelligence “Agentic AI Guideline”, indicating DPA’s growing emphasis on setting clar - ity for autonomous systems. The Board’s dedication to providing more clarity through technical definitions and classifications, such as the distinction between integrated Agentic AI systems and task-specific AI Agents, is demonstrated in the Agentic AI Guideline. The Agentic AI Guideline is firmly based on the Law’s core data protection principles, even if it provides a more detailed examination of these technologies through sectoral examples in healthcare and finance. The DPA gives organisations a road map for navigat - ing data controller responsibilities in the era of digital agents by reiterating that even the most autonomous systems must adhere to fundamental obligations, such as transparency, purpose limitation, and human oversight, rather than departing from accepted norms. 1.6 Data Breach Requirement There is no explicit definition of “data breach” under the DP Law. However, the obligation to notify the DPA arises “in the event that personal data is obtained by others through unlawful means”, pursuant to the DP Law. Considering this explicit provision, it can be interpreted that data breach notification under the DP Law is limited solely to the breach of the data’s con - fidentiality; therefore, it could be argued that, unlike the GDPR, the loss of data integrity or availability is not regulated as a breach that triggers a notification obligation within the framework of the DP Law. Despite this, it is observed that in the DPA’s Breach Notification Form, “data integrity” and “data access/
515 CHAMBERS.COM
Powered by FlippingBook