There was no claim of responsibility for the attack, which came as Turkey wages an offensive against bases of the Turkish separatist Kurdistan Workers' Party (PKK) in northern Iraq.
US Secretary of State Mike Pompeo condemned the diplomat's killing, saying "there can be no justification for such acts of wanton violence".
At least one gunman fired on Turkish consulate workers in a restaurant in Ainkawa, a northern Arbil neighbourhood that hosts numerous restaurants and the consulate.
"A shooting in front of a restaurant in Arbil left a Turkish consulate employee and a civilian dead, and wounded a third person," said the Kurdish internal security forces, known as the Asayish.
A local police source told AFP the diplomat had been the Turkish vice consul and that the attacker had fled the scene.
A spokesman for the Iraqi foreign ministry condemned the attack.
Turkey's foreign ministry said an "employee" at its Arbil consulate was killed in a shooting outside the consulate.
"We are continuing our efforts with the Iraqi government and local authorities to find the perpetrators of this attack as quickly as possible," said Turkish President Recep Tayyip Erdogan.
His spokesman Ibrahim Kalin vowed "the necessary response will be given to those who committed this treacherous attack."
The Kurdistan Democratic Party (KDP), which now leads the regional government, enjoys good political and trade relations with Turkey.
But one sticking point is the PKK, which operates rear bases across Iraq's mountainous north.
The PKK is classified as a "terrorist" group by Turkey, the United States and the European Union because of the three-decade insurgency it has waged against the Turkish state.
Turkey has been conducting a ground offensive and bombing campaign since May in the mountainous northern region to root out PKK pockets.
Earlier this month, the PKK announced that one of those raids killed senior PKK leader Diyar Gharib Mohammed along with two other fighters.
- 'Heinous' attack -
====================
A spokesman for the PKK's armed branch denied the group was involved in Wednesday's shooting.
According to Turkish state media, the attacker carried two guns when he stormed the restaurant.
Witnesses in the city said checkpoints had been quickly set up inside and around the normally bustling district where the attack was staged.
The Kurdish regional government said an investigation had been launched and that it would "not tolerate damage to the security and stability of (Iraqi) Kurdistan".
In Baghdad, the UN mission to Iraq called for "maximum restraint" from all sides.
The US embassy offered its condolences to the Turkish mission after the "heinous" attack, calling for "the defence and safety of foreign diplomats and diplomatic missions in Iraq".
Several rocket attacks have targeted diplomatic missions in Iraq in recent months, including near the US and UK embassies in Baghdad's "Green Zone."
The US in May ordered all non-essential personnel at its Baghdad embassy and Arbil consulate to leave the country.
Authorities in Iraq, which is witnessing a period of relative calm since declaring victory against the Islamic State group in 2017, have pledged to protect embassies.