Personal Data and AI Video: A KVKK Checklist for Brands

Using real people's photos, facial features or voice recordings as references in AI-based video production is a data processing activity under Turkey's Personal Data Protection Law No. 6698 (KVKK). Failing to run the required explicit consent mechanisms when using digital avatars in marketing campaigns or internal training videos can expose brands to heavy administrative fines and reputational damage.

Personal and Biometric Data in Synthetic Media

Under Article 3 of the KVKK, any information relating to an identified or identifiable natural person is personal data. When a portrait photo of an employee, executive or actor is uploaded and used to generate video, personal data is being processed.

Beyond that, scanning a person's unique facial features, mapping their expressions or analysing and cloning their voice frequencies moves the matter into biometric data. Because the law defines biometric data as 'special category personal data', the conditions for processing it are much stricter than for standard data.

When Do Face and Voice Data Count as Special Category Data?

Not every photo of a face is automatically biometric data, but when an AI video platform converts that image into mathematical vectors that can uniquely identify the person, biometric processing begins. Likewise, cloning a speaker's voice falls within the scope of biometric data.

Except for the exemptions set out in the law, special category data cannot be processed without the data subject's explicit consent. Feeding photos of employees or external models into AI video tools without permission on the grounds that they are 'company archive' is a clear breach of the law.

The Limits of Explicit Consent and the Duty to Inform

Explicit consent for AI video projects must not rely on general or vague wording. The consent form the person signs must clearly state:

• which AI algorithms will process the image and voice data,
• on which channels and for how long the video will be published,
• whether the data will be transferred to third-party service providers (AI platforms),
• that the person has the right to withdraw consent at any time.

A 6-Point KVKK Checklist for Brands

• 1. Biometric consent form: Has consent explicitly covering AI use been obtained from the person whose image or voice is modelled?
• 2. Privacy notice: Was the person told the purpose of processing, the retention period and their rights before processing began?
• 3. Platform security assessment: Have you checked whether the tool reuses data for model training? (Opt-out option.)
• 4. Overseas server check: If the AI service's servers are abroad, are the conditions of KVKK Art. 9 met?
• 5. Data deletion protocol: Is there a commitment to delete raw face and voice recordings from the platform once the video is finished?
• 6. Synthetic media label: Are viewers told that the video features an AI-generated person?

Cloud-Based AI Video Tools and Cross-Border Transfers

Almost all popular tools such as Sora, Runway, HeyGen, Synthesia and ElevenLabs run on US- or EU-based cloud infrastructure. Uploading the face or voice data of a person in Türkiye to these platforms counts as a cross-border data transfer under the KVKK.

Under the KVKK's current cross-border transfer rules, transfers to countries without an adequacy decision legally require signed standard contractual clauses (SCCs) or the person's specific explicit consent.

Conclusion and Safe Practice

AI-assisted video production brings major operational efficiency to marketing. But the speed the technology offers should never overshadow personal data security. With the right contracts, explicit consent mechanisms and trusted enterprise tools, you can stay protected from legal risk and still run innovative campaigns.

To learn more about data-driven digital strategy and corporate standards, get in touch with Elites.