KVKK ile bulut yapay zeka API’si cari verisinde nasıl çakışır?

**Short answer:** KVKK art. 9 on transfers and art. 11/1-g on automated decisions collide with account data on a cloud AI API. Inference abroad is also a transfer. Not legal advice — a spine-design question. ## What this page is for When an owner says “we send it to the API, we signed a DPA, done,” three jobs mix. The contract, which field went, and the automated decision. This page draws the second and the third. [API / local](/blog/api-bulut-yerel-model-2026-isletme-nerede/) is residency. This page is how an account breaks on that residency. It is not “what is AI technology.” Bağer is not a law firm. You mark which field walks which door, on [Sistem Yarat](https://www.bagertek.com/sistem-yarat/). This page is not advice. ## Two articles, one box Art. 9: transfer of personal data abroad. Explicit consent, adequate protection, or the other grounds in the law — the firm reads. Your job is to see that a transfer is happening. If OpenAI, Anthropic, or Google inference sits abroad, pasting a name, phone, or invoice number into the box is a transfer. “We are summarizing” does not close that door. Art. 11/1-g: a person has the right to object to automated decisions that produce legal effects or similarly significant effects about them. An agent cutting a due date, closing an appointment without a person, a credit-like score — a gate question. A draft is separate, a decision is separate. A DPA is wall decoration if there is no field list. National ID does not go, an order number can — write it down. If it is not written, staff paste anyway — [shadow](/blog/golge-yz-nedir-personel-chatgptye-musteri-yazar-mi/). | Field | Door | Wrong | | --- | --- | --- | | Name + order no. | A simplified API may | A raw account ledger | | National ID, discharge, full IBAN | Local / does not go | “There is a DPA, send it” | | Automated due date / appointment | A human gate | An autonomous close | | Transcript | Summary simplified, raw at home | 800 records abroad | ## Where they collide The collision is the account going to two jobs at once. A collections agent pours the full balance into the API on a Nakit Nabız queue. Satış Hafızası extracts an “expensive” label abroad. Both are transfers. [Collections](/blog/tahsilatta-yz-geciken-cariyi-nasil-siraya-alir/) builds the queue; this page is which field that queue carries. A healthcare card is sharper. If a lab PDF lands in a Cowork folder, a transfer + special-category reading opens. The firm reads. Your job is that reminder text does not carry a raw file — [healthcare](/blog/saglikta-yz-randevu-hasta-karti-cerrahi-degilse/). Computer use sees a national ID while reading an old screen. [Computer use](/blog/computer-use-nedir-ekran-uzerinden-is-nasil-yurutulur/) is a bridge. The field that appears is written onto the list. ## One concrete accounts desk A 12-person field team. Accounting pastes an Excel into Luna: “summarize this account’s balance.” The old way: a DPA PDF in a folder, no field list. The real job: the balance is simplified (a code + days late), title and IBAN stay home, the agent suggests a queue, a person calls. The measure is not “how many DPAs we signed.” The measure: did a raw account go into the box, was an automated decision made without a person, is there a log. I will not write a fine amount here. A second concrete: a call summary. 40 transcripts are not dumped into a [1 million token](/blog/1-milyon-token-baglam-arsiv-excel-pdf-ne-yapar/) window. The label stays home, the summary is simplified. ## Where Bağer sits No packaged KVKK product. Field list, door, approval are visible in the [YZ functions](https://www.bagertek.com/yz-fonksiyonlari/) vitrine. The [catalog](https://www.bagertek.com/katalog/) is not a DPA folder. The approval gate is yours. If an appointment is born, it writes the [Appointment](https://www.bagertek.com/appointment/) calendar. The Mağaza Pilot rule: automation runs, the last approval is yours. “We did a DPA” is not delivery. Delivery: the field written, the transfer visible, the decision on a person. ## Does on-prem erase this collision It lowers residency risk and raises operating load — [on-prem](/blog/kobi-2026-on-prem-yz-mi-bulut-api-mi/). Most SMEs start on the cloud with simplified data + a DPA. Starting is not pouring the raw ledger. EU art. 50 transparency is a separate stack — [AI Act](/blog/ab-ai-act-2-agustos-2026-seffaflik-turk-firmayi-baglar-mi/). A KVKK transfer does not cancel the “this is AI” sentence. The Akbank hub story pulls shadow to a center — [AI Hub](/blog/akbank-ai-hub-nedir-sorumlu-yz-neden-merkezlestirilir/). The SME counterpart is inventory + one spine. The [catalog](https://www.bagertek.com/katalog/) is not where the article text sits. It is where your field list sits. The firm reads, the card writes. Cutting is right. A third concrete: a field salesperson pastes a Places list into their own Plus, the visit note stays there. Transfer + shadow on the same day. The [field](/blog/saha-satisinda-ajan-excel-listesini-neden-kapatir/) page wants the same balance on the phone; a third box does not open. A consent checkbox does not replace a field list. Consent is not read as “send everything.” The firm reads. Your job is to write which field went. If it is not written, consent and a DPA are both wall decoration. The [catalog](https://www.bagertek.com/katalog/) is not the consent text; it is the field list. A fourth concrete: a collections SMS. Before the agent prints “it will land on Friday” onto the account’s phone, it looks at the field list. The phone may go, the IBAN does not. If it does not go, Nakit Nabız still builds the queue; it is not a blind SMS, and it is not a blind API either. ## Common mistakes - Treating a DPA as a field list. - Not counting inference abroad as a transfer. - Letting the agent cut a due date or appointment without a person. - Pasting a raw Excel into the box. - Pouring a transcript pile abroad as a “summary.” - Forgetting the list because you said on-prem. ## August 2026 note KVKK art. 9 practice and the adequate-country list slide. On publish day look at a firm reading. This page is not advice. ## Next step Mark which field will not go into the box, on [Sistem Yarat](https://www.bagertek.com/sistem-yarat/). - [API, cloud, local](/blog/api-bulut-yerel-model-2026-isletme-nerede/) - [On-prem or cloud API](/blog/kobi-2026-on-prem-yz-mi-bulut-api-mi/) - [Shadow AI](/blog/golge-yz-nedir-personel-chatgptye-musteri-yazar-mi/)