Insights and updates
From emerging regulation to deal mechanics, we write about the questions founders and investors actually ask: practical analysis you can put to work.
Every paste into a chatbot is a KVKK event, a potential trade-secret disclosure, or a client-confidentiality breach. Five decisions: tool tiers, data red lines, output ownership, disclosure, incident path: that make a policy people follow.
Turkey’s data protection authority ruled on 21 July 2026 that contact details obtained through referrals cannot be used for marketing without notice and explicit consent. Silence is not consent.
Recruitment AI is high-risk under the AI Act from December 2027: but KVKK Article 11, the 2026/921 biometrics standard, equal-treatment law and the AI Act’s emotion-recognition prohibition bind hiring systems today. Four layers, one table, eight steps.
Türkiye’s AI law is still a draft: but KVKK is deciding AI cases now. Automated decisions under Article 11, the 2026/921 biometrics template, and training-data compliance: a six-step review for AI products serving Turkish users.
Generative AI at work and KVKK: the controller’s responsibility, the right to object to automated decisions, and human-in-the-loop.
The 72-hour rule for data breaches: notifying the Board, informing data subjects, and a response plan that works in the crisis.
