KVKK for AI Phone Assistants: Call Notices and Recordings

An AI phone assistant produces personal data on every call: audio recordings, transcripts, call summaries and booking details. That is why the notice, legal basis, transfer, retention and security rules of KVKK, Turkey’s Law No. 6698 on the Protection of Personal Data, apply just as they do in a traditional call center. In practice it means a short notice at the start of the call, a full privacy notice, a retention period set by purpose for each type of data, and a map of the service providers that process the conversation.

In this article we look at the data an AI phone call creates, how to give notice on the phone, copy-ready notices for clinics, restaurants and car service centers, transfers to model providers, retention and destruction, data subject rights and a checklist.

This article is general information, not legal advice. Decide on your privacy notice and legal bases together with a lawyer who specialises in KVKK. Last checked: 2026-10-22.

What personal data does an AI phone call create?

Law No. 6698 (in Turkish) defines personal data as “any information relating to an identified or identifiable natural person” (our translation). A single call handled by a voice agent creates several kinds of it:

If you use recordings to recognise people, for example to verify identity with a voiceprint, the biometric data that Article 6 of the Law treats as a special category may come into play; assess that use separately.

The duty to inform: what should be said on the phone?

Under Article 10 of the Law, when personal data is collected the data controller must tell the data subject: the identity of the controller and of its representative, if any; the purposes of processing; to whom and for what purpose the data may be transferred; the method and legal basis of collection; and the rights listed in Article 11.

Article 5 of the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform (in Turkish) sets out the principles for giving notice orally, by voice recording or through a call center. The most useful ones for a phone assistant:

• The notice does not depend on a request; it is given even if the caller does not ask.
• The burden of proving that notice was given lies with the data controller.
• Where processing relies on explicit consent, notice and consent are handled separately.
• The purpose must be specific, explicit and legitimate; vague, general wording should not be used.
• The legal basis, meaning which condition in Articles 5 and 6 you rely on, must be stated clearly.
• The purpose of transfers and the groups of recipients must be stated.
• It must be stated clearly whether data is collected wholly or partly by automated means.
• No incomplete, misleading or false information may be given.

For outbound calls, also look at Article 6 of the Communiqué: where data was not obtained from the data subject and will be used to contact them, notice is given at the first contact.

Reading a full privacy notice on the phone wears callers out. Many businesses use a layered approach: a short notice at the start of the call, with the full text kept on the website and its address given in the notice. Check with your lawyer whether this is sufficient for you.

The KVKK Board’s decision 2022/224 (in Turkish) offers guidance. In a complaint about a bank’s call center, the Board found that the privacy notice had been offered in the call center and that the person had ticked the box on a web form, and concluded that the duty to inform had been met; it also restated that the burden of proof lies with the controller. In the same decision, however, sharing the caller’s phone number with a third party was found unlawful because it did not meet the elements of explicit consent, and an administrative sanction was imposed on the bank. Two lessons follow: giving notice is not the same as obtaining consent, and an “okay” in the middle of a conversation is not consent to everything. Write a rule into your voice agent’s instructions never to share caller details with third parties.

Copy-ready call notices

The texts below are a starting point. Fill in the bracketed fields, decide the legal basis with your lawyer and remove the recording sentence if you do not record. The voice agent can say the notice itself, or it can be played as a recorded announcement. In practice the notice would be in Turkish; the Turkish edition of this article has the Turkish wording. See also our greeting and after-hours announcements.

Clinic

Welcome to [Clinic name]. I'm the clinic's AI assistant.
This call is recorded and transcribed to handle your appointment request
and to monitor service quality. Your data is processed by [Legal entity]
on the basis of [legal basis] and may be shared with the infrastructure
providers we use. Your name and phone number are enough for an appointment;
please don't share details about your health. Privacy notice and your rights:
[web address]. If this is an emergency, please call 112 now.

Restaurant

Thank you for calling [Restaurant name]. I'm the restaurant's AI assistant.
This call is recorded and transcribed so we can take your reservation.
Your data is processed by [Legal entity] on the basis of [legal basis] and may
be shared with the infrastructure providers we use. More information and
your rights: [web address]. How can I help you?

Car service center

Welcome to [Service center name]. I'm our AI assistant.
This call is recorded and transcribed so we can book your service appointment;
for this I'll take your name, phone number and your car's number plate.
Your data is processed by [Legal entity] on the basis of [legal basis] and may
be shared with the infrastructure providers we use. Privacy notice and your
rights: [web address].

Keep notices short and test them by listening over a real phone line. A long notice can make callers hang up, which is why leaving the detail to a web page matters.

Recordings, transcripts and summaries: legal basis and proportionality

Article 5 of the Law says personal data may, as a rule, be processed with explicit consent, but that consent is not required where, among other things, processing is expressly provided for by law, necessary to enter into or perform a contract, necessary for the controller’s legal obligation, necessary to establish or protect a right, or necessary for the controller’s legitimate interests provided it does not harm the data subject’s fundamental rights and freedoms. Details collected to book an appointment and a recording kept for quality control serve different purposes; write down the basis you rely on for each.

Article 4 requires data to be relevant, limited and proportionate to the purpose. For a voice agent, that means asking only for what it needs to complete the task. Think twice about whether it really needs to collect long, sensitive strings such as ID or card numbers by voice.

One more detail: Article 11 gives people the right to object to an outcome against them that arises from analysis of their data exclusively by automated systems. If you score calls purely with AI and, for example, decide never to call certain leads back, build that right into your processes.

Transfers to model providers and abroad

A voice agent is rarely a single piece of software. It usually combines telephony infrastructure, a speech-to-text model, a large language model that writes the replies, a text-to-speech model, recording storage and a CRM. Each of these can act as a data processor on your behalf. Under Article 12 of the Law, when data is processed by others on the controller’s behalf, the controller is jointly responsible with them for taking security measures.

If any of these services processes data outside Turkey, Article 9 of the Law, as amended by Law No. 7499 in 2024, applies. In summary, transfers abroad may be made:

• where the Board has issued an adequacy decision for the country, sector or international organisation and one of the conditions in Article 5 or 6 is met;
• where there is no adequacy decision, through one of the appropriate safeguards, provided the data subject can also exercise their rights in the destination country: standard contractual clauses announced by the Board, binding corporate rules or a written undertaking with the Board’s permission, for example. Standard contracts must be notified to the Authority within five business days of signing;
• failing both, only in limited cases such as the data subject’s explicit consent after being informed of the risks, and the Law allows these only “on an incidental basis”. Discuss with your lawyer whether a transfer repeated on every call can fall within this.

Ask your vendor: Which sub-processors handle call data, and in which countries? Is the data used to train models? How long do providers keep it, and how are deletion requests passed on? Which safeguard do transfers abroad rely on? Reflect the answers in the recipient groups and transfer information in your privacy notice. The KVKK’s guide on generative AI and personal data protection (in Turkish), published on 24 November 2025, also calls for these systems to be developed with a transparent, auditable and human-centred approach.

Retention and destruction

Article 4 of the Law requires data to be kept only as long as the relevant legislation provides or as long as necessary for the purpose, and Article 7 requires data to be deleted, destroyed or anonymised once the reason for processing no longer exists. The Regulation on the Deletion, Destruction or Anonymisation of Personal Data (in Turkish) puts this into practice: controllers required to register with the Data Controllers’ Registry prepare a retention and destruction policy, the periodic destruction interval may not exceed six months, and records of deletion operations are kept for at least three years.

There is no single period for call data. For each type of data, answer the question that sets its period:

The period in the last row comes from Article 13 of the Regulation on Commercial Communication and Commercial Electronic Messages (in Turkish). For consent rules on outbound calls, see our guide to İYS consent rules for AI phone calls.

Health data and other special categories

Article 6 of the Law treats health data as a special category of personal data. As amended by Law No. 7499, processing such data is prohibited as a rule and possible only in the cases listed in the article, and the adequate measures set by the Board must also be taken. A clinic phone assistant should therefore not ask about the details of a complaint, and if a patient starts describing symptoms it should politely return to the booking step. For detailed flows, see our article on AI phone assistants for clinics.

Data subject rights and requests

Article 11 of the Law gives everyone the right to apply to the data controller to learn whether their data is processed, request information, know the third parties it is transferred to, request correction, deletion or destruction, object to an adverse outcome produced by automated analysis and claim compensation. Under Article 13, requests are concluded as quickly as their nature allows and within thirty days at the latest, free of charge as a rule.

The Board’s decision 2020/504 (in Turkish) is a useful example for recording requests. In a complaint against an airline that had not provided a transcript of a call, the Board said the right of access covers reasonable access to the content of the data, not handing over the recording medium, and took no action because the company had sent a masked transcript. Teach your voice agent to direct callers who say “delete my recording” or “I want my recording” to your request channel, and make sure your team knows who answers these requests and by when.

Checklist

• Have you listed the data types created on a call (recording, transcript, summary, fields, voicemail)?
• Are the purpose and legal basis for each data type written down?
• Are the short notice and the full privacy notice ready, and has your lawyer approved them?
• Does the notice tell callers they are speaking with an AI assistant?
• Where you rely on explicit consent, is it obtained separately from the notice?
• On outbound calls, is notice given at the first contact?
• Does the voice agent ask only for what it needs and avoid health details?
• Do you know all sub-processors and the countries where data is processed?
• Is the safeguard you rely on for transfers abroad clear?
• Are retention periods and a destruction routine defined for recordings, transcripts, summaries and voicemail?
• Is access to recordings restricted, with two-step sign-in turned on?
• Is there a channel, an owner and thirty-day tracking for data subject requests?

KVKK-related settings in Speakline

We build Speakline in Turkey. On recorded calls we support playing a KVKK notice to callers. Calls can be recorded and stored with their Turkish transcripts; your team reaches them from the call center dashboard, and team accounts can be protected with two-step sign-in. In the instructions for our voice agents, you define what they collect and which topics they must never ask about, and you can send call summaries and transcripts to your own systems through our API and webhooks.

Remember to reflect the systems and providers you send data to in your privacy notice. You can find how Speakline processes personal data for its website and services in our KVKK notice. If you would like to review your setup together, get in touch.