Check the post-amendment framework
Türkiye’s Personal Data Protection Authority publishes the amended personal data protection law and English translations of the 2024 transfer by-law and standard contracts. Start with those current materials rather than an older summary of Article 9. The authority provides separate contract forms for controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller transfers. The correct choice depends on the parties’ real roles, not the label preferred by a sales team.
Define the lab’s independent rights
Explain who collected the material, who determines the training purpose, and whether the laboratory can retain, combine, or sublicense it. Ask Turkish counsel to identify the processing conditions, transfer route, and any procedural requirements associated with the chosen safeguard. Do not insert an EU standard-clause attachment and assume the Turkish documentation is complete. Keep the Turkish source notices and agreements available alongside accurate working translations.
Prepare evidence for a narrow pilot
For Turkish-language corpora, document spelling normalisation, morphology-related annotation choices, regional coverage, and quality measurements. Keep copyrighted publications, employee records, and customer communications in separately reviewed source groups. A schema and synthetic sample allow technical evaluation while rights and transfer questions are resolved. The pilot agreement should identify the exact release, permitted experiment, recipient, access period, and handling of derived copies.
- Select roles from the actual purpose-and-control analysis.
- Verify current Article 9 safeguards and filing steps with counsel.
- Preserve mandatory standard-contract wording where applicable.
- Require review before adding recipients, sources, or training uses.
Review before release
Sources reviewed on 19 October 2026. This is a preparation checklist, not legal clearance, tax advice, or confirmation that an AI lab accepts suppliers from this jurisdiction. Ask qualified local counsel to review the actual dataset, collection history, proposed training purpose, recipient, and current rules before releasing personal data.