AI-powered customer communication covers everything from a voice agent answering the phone to replies on WhatsApp, and all of it means processing personal data. That is exactly what the KVKK and AI discussion is about in Turkey: who holds the recording, how long it is kept, and what permission it rests on. What follows is a practical framework; this is not legal advice, and it should be reviewed with your own legal counsel.
What data AI-driven communication actually processes
The moment a voice agent picks up a call, several layers of data are created. Most businesses only think about the recording, while more accumulates behind it:
- Voice recording: the raw audio of the conversation; a person's voice alone can make them identifiable.
- Transcript: the text version; even if the audio is deleted, the content lives on here.
- Contact details: phone number, email, messaging channel identifier.
- Extracted fields: name, address, appointment date, order number and request type pulled out by the agent.
- Technical records: call time, duration, channel, and the point at which it was handed to a human.
- Quality and model records: copies kept for scoring, labelling and error analysis.
Build your inventory so it covers all of these; the most commonly missed items are transcripts and quality copies.
Notice and explicit consent are not the same thing
Confusing these two is the most common mistake in the field. Notice means telling people who you are, what data you process and why, and what rights they have; it is expected regardless of the legal basis you rely on. Explicit consent is a separate legal basis: freely given, specific, informed and always withdrawable.
The practical consequences:
- Do not bury consent inside other text. "By continuing you accept everything" is a fragile construction.
- Keep the notice at the start of the call short and understandable: that a recording is being made, why, and what the alternative is.
- Withdrawing consent must be as easy as giving it. If no flow in your system processes a withdrawal, the process is incomplete.
- Keep consent records provable: when it was taken, through which channel, and against which text.
Marketing permission is a separate topic
Calling a customer to deliver a service is not the same as reaching out to sell. Promotional calls and messages fall under commercial electronic message rules, and in Turkey permissions are managed through a national system. Risk grows once an AI worker is in play, because automation consumes lists quickly; if a record lacks permission, the error scales instantly.
- Separate service communication from marketing communication at the database level.
- Tie outbound automation to a permission check so a call never starts without one.
- Collect opt-outs from every channel into a single place.
Minimisation and retention periods
The safest data is data you never collected. Question every field your voice agent gathers: can the task be completed without it? If yes, do not collect it.
Set retention per purpose; treating everything with one blanket period creates both unnecessary risk and unnecessary cost. What the right period is varies from business to business and depends on other obligations in your sector, so make that call with your legal counsel. Write the decision into a retention and disposal policy, then implement automatic deletion. A policy that relies on manual clean-up stays on paper.
Consider audio and transcript separately too; they do not have to share the same period.
Masking, access and logging
Masking sensitive fields at the agent and in storage directly reduces the impact of any leak.
- Card numbers, ID numbers and passwords should never enter the record; hand the payment step to a secure flow.
- Keep access narrow on conversations touching health or legal matters.
- Apply automatic masking to transcripts, with an equivalent in the audio file.
- Log who listened to or read which record and when. Bind access to roles, not individuals.
- Never use real customer recordings in test and development environments.
Cross-border transfer and choosing a vendor
AI stacks are often assembled from components running in several countries; a conversation may be processed in one place and stored in another. It would be wrong to state anything categorical here: find out precisely where data is processed and decide your transfer setup with your legal counsel.
Ask vendors these in writing:
- In which countries is data processed and stored? Can a region be selected?
- Is my data used for model training? Can that be turned off?
- Who are the sub-processors, and am I notified when the list changes?
- Is the retention period configurable, and is disposal automatic?
- When a deletion request arrives, how quickly is it applied, including backups?
- Are access logs visible to me? How do export and end-of-contract data return work?
- What is the notification process in the event of a breach?
Checklist
- A data inventory exists covering audio, transcripts, extracted fields and quality copies.
- A legal basis is documented for every processing activity.
- The notice text is plain, current and reachable on every channel.
- Explicit consent is taken separately, is provable and is easy to withdraw.
- Marketing permission is separated from service contact, and outbound automation checks it.
- Only the fields you need are collected; the rest were removed from the flow.
- Retention is set per purpose with automatic disposal in place.
- Sensitive fields are masked and payment data never enters the record.
- Access is role-based and listen or read activity is logged.
- Vendor questions were answered in writing and folded into the contract.
- An incident plan names who does what if something goes wrong.
- Policies are reviewed annually and the team is briefed.
Compliance is not a one-off project; it is an operating habit you revisit as channels and flows change. What works best is embedding privacy decisions into the design of the flow itself: decide on day one which fields get asked, how long they are kept and who can see them. To review your data flows and retention setup, take a look at /data-crm and /ai-call-center, and write to us via /contact to discuss your own scenario. More at newads.ai