Call recording and AI assistants under Turkish data protection law (KVKK)

Is call recording personal-data processing under KVKK?

Yes. The caller’s voice, number, words and any transcript or summary made from them relate to an identifiable person, and Law No. 6698 on the Protection of Personal Data (KVKK) treats collecting, recording, storing and deleting them as processing. AI transcription and summarisation are part of that processing.

If a business answers its own customers’ calls through a software service, the business is, as a rule, the data controller for those calls and the provider is the data processor. Administrative fines for duties such as giving notice are directed at the data controller, while the processor shares responsibility with the controller for data-security measures. A written data-processing agreement with your provider is therefore advisable.

When and how must callers be informed?

Article 10 of KVKK requires notice at the time data is collected. The Personal Data Protection Board’s principle decision 2026/347 of 18 February 2026 states plainly that notice must be given before processing starts, whatever the legal basis. On the phone, that means informing callers in the first sentences, before recording and transcription begin.

The Board accepts layered notices: a short first layer on the call, with a route to the full text. In decision 2024/1361, however, the Board refused to treat a brief warning that did not meet Article 10’s minimum elements as valid notice, and imposed a fine. So the short announcement should always say how to reach the full notice, such as a web address or a link sent by SMS. If the caller speaks another language, repeating the notice in that language and in plain words is sensible. For 2026, the administrative fine for breaching the duty to inform ranges from TRY 85,437 to TRY 1,709,200.

• Example first layer: “I am an AI assistant speaking on behalf of [company]. This call is recorded and transcribed to handle your request and for service quality. Full details are at [web address].”
• Name the business on whose behalf the assistant speaks (the data controller)
• State the purpose of recording and transcription
• Point to the full privacy notice
• Give the notice before recording starts, in a language the caller understands

Why does a recording notice matter under criminal law?

Article 133(2) of the Turkish Penal Code punishes anyone who records a non-public conversation they take part in without the consent of the other speakers with imprisonment from six months to two years or a judicial fine. Unlawfully disclosing such a recording carries a heavier penalty under paragraph 3.

Case law from the Court of Cassation is not uniform. The defence most often relied on in practice is that a person who hears a recording notice and stays on the line has given implied consent. That defence only exists if the notice was actually given, which makes a clear announcement at the start of the call the first and cheapest safeguard under both KVKK and criminal law.

Notice or explicit consent: which do you need?

Notice and explicit consent are different things, and principle decision 2026/347 sharpened the line between them. A privacy notice informs; you do not ask people to “accept” it, at most to confirm they have read and understood it. Where processing does not require consent, consent should not be requested. Where it does, a separately titled consent text with its own declaration is used.

Which legal basis covers call recording, for example legitimate interest or explicit consent, is a question of interpretation that depends on the business and the purpose of recording. Make that decision with a lawyer and write the notice to match. If special categories of data, such as health information, come up often on calls, the additional conditions and safeguards under Article 6 of KVKK also need separate assessment.

Does an AI assistant have to say it is AI?

Under Article 8(2) of the Distance Contracts Regulation, anyone calling a consumer for sales must state at the start of the call their identity, the identity of anyone they are calling on behalf of, and the commercial purpose of the call. Law No. 6563 likewise requires the message to say on whose behalf it is sent. Article 18(8) of the advertising regulation published in the Official Gazette on 1 July 2026 and in force since 1 August 2026 requires clear disclosure of AI use that significantly affects consumer decisions, and of digital characters that cannot be distinguished from humans.

No general provision was identified that directly requires disclosing AI on inbound customer-service calls, but presenting the assistant under a human name sits uneasily with the principle of good faith and the ban on misleading commercial practices. In practice, the safest approach on both inbound and outbound calls is for the assistant to say in its first sentence that it is AI and on whose behalf it speaks. That single sentence covers notice, evidence of consent to recording, identity and purpose, and AI disclosure.

What consent rules apply to AI outbound calls (İYS)?

Law No. 6563 on the Regulation of Electronic Commerce expressly includes voice messages made by phone, call centres, automatic dialling machines and smart voice-recording systems in its definition of commercial electronic messages. Promotional calls made by an AI assistant fall within it. Calling consumers for such purposes requires prior consent that is registered in the national Message Management System (İYS).

Tradespeople and merchants are exempt from prior consent, but merchant numbers must still be registered in İYS as merchants and checked for opt-outs before contact. Opt-outs must be processed within three business days. Whether self-employed professionals such as doctors with private practices, lawyers or accountants fall within the merchant exemption is a matter of interpretation and should be confirmed with a lawyer. Purely informational messages such as an appointment confirmation or payment notice can be sent without consent, but adding a campaign or discount line turns them into commercial messages.

How should recordings be retained, deleted and protected?

Recordings and transcripts should be kept only as long as their purpose requires, then deleted, destroyed or anonymised. The Regulation on Deletion, Destruction or Anonymisation of Personal Data provides for periodic destruction at least every six months and for destruction records to be kept for at least three years. Failing to delete data whose processing conditions no longer apply can amount to an offence under Article 138 of the Turkish Penal Code, via Article 17 of KVKK. Data-subject requests must be answered within thirty days at the latest.

On security, access to recordings should be limited by permission and logged. A data breach must be notified to the Board within 72 hours. If recordings or transcripts are transferred to a service abroad, regular transfers need the Board’s standard contract, notified to the Authority within five business days of signing; explicit consent can only support occasional transfers. Employees whose calls are monitored or reviewed should be informed as well. If the assistant uses a cloned voice of a real person, the view that voice timbre can be biometric data makes it prudent to obtain explicit consent directly from the voice owner.

For businesses using Xaly, a few practical points apply. In outbound campaigns, the assistant says on whose behalf it is calling and that it is AI at the start of the call; prior consent is declared when a list is uploaded, and commercial calls require a check against İYS. Callback attempts are capped, and people who ask not to be called are added to a list and never called again. Live listening is silent to the customer, only people you authorise can access recordings, and recording and retention rules are agreed with you during setup. We recommend including recording and AI disclosure in your greeting.