What ethical duties apply to data providers under the Draft AI Guidelines?

The Draft Concept of Artificial Intelligence (AI) Ethics Guidelines released for public consultation by the Ministry of Communications. Furthermore, Digital in August 2025 designates data providers as one of four categories of Sector Actors. The draft does not establish an isolated section for data providers. instead, it binds them to general Sector Actor duties regarding data bias mitigation, personal data protection, intellectual property, and self-assessments. This document remains a consultation draft and is not yet enacted law.

Who qualifies as a data provider

The draft defines a Data Provider as any entity that provides data for the training, testing. Alternatively, Validation of an Artificial Intelligence model (Definition point 5). Alongside AI developers, AI system providers, and AI system operators, data providers belong to the Sector Actor category (Definition point 3 and Chapter IV).

Under this definition, a clinic or hospital that supplies clinical check-up records or medical imaging to train, test. Alternatively, Validate an AI model qualifies as a data provider.

Core duties applicable to data providers

• Data bias mitigation (Chapter V point 1. Chapter VII.1): Sector Actors must reduce bias in training datasets and algorithms. Table 1 mandates representative, relevant, and context-appropriate data, prohibiting biased data that risks unlawful discrimination.
• Personal data protection and minimization (Chapter V point 7. Chapter VII.1): Sector Actors must comply with personal data protection laws. The draft emphasizes obtaining explicit consent from data subjects for AI model training and strictly observing data minimization principles.
• Intellectual property rights (Chapter V point 9): Sector Actors must respect copyrights. Furthermore, Database rights, execute clear data-sharing agreements for third-party datasets, and avoid unauthorized use of local cultural expressions.
• Data source transparency (Table 1): Safeguards require disclosing key information regarding training data origins, potential biases, and technical system limitations.
• Lifecycle risk management (Chapter VIII point 2). Sector Actors are responsible for implementing risk management throughout all AI lifecycle stages via periodic audits and continuous monitoring.

Self-assessment and regulatory status

Sector authorities prepare a self-assessment checklist that Sector Actors must complete (Chapter IX.1). Key assessment points examine privacy protection methods, including data minimization and explicit data subject consent (Table 2 item 4).

The draft proposes a transition period of up to two years once formally promulgated (Chapter X). Until formally enacted, these provisions remain consultative and do not create independent statutory obligations.

Legal basis

• Draft Concept of Artificial Intelligence Ethics Guidelines (Ministry of Communications. Furthermore, Digital, public consultation draft August 2025, not yet in force): Definition points 2, 3, and 5. Chapter IV. Chapter V points 1, 7, and 9. Chapter VII.1. Chapter VII.2 Table 1. Chapter VIII point 2. Chapter IX.1 (Table 2 item 4). Chapter IX.2. and Chapter X.
• Law Number 27 of 2022 on Personal Data Protection: Article 20 paragraph (2).