KVKK compliance for AI phone systems in Turkey

Türkiye's Personal Data Protection Law, KVKK (Law No. 6698), governs how businesses handle personal data, and a phone call is one of the most common places that data gets collected. If an AI assistant answers your clinic or salon line, you are still the data controller, and KVKK's expectations still apply in full. This article is practical guidance, not legal advice; for binding questions, consult a Turkish KVKK specialist.

The controller is still you

Using a vendor's AI does not transfer responsibility for how personal data is handled. Under KVKK you remain accountable for lawful basis, transparency (aydınlatma), and security, exactly as you would with a human receptionist. The assistant is a tool you operate, much like a phone system or a booking calendar, not a separate party to the relationship.

A practical KVKK checklist

• Inform the caller (aydınlatma yükümlülüğü). Your assistant should disclose that the call is handled by an automated system and explain why details are being collected.
• Have a lawful basis. For bookings and callbacks that is usually performance of a service or explicit consent, decide which applies and stay consistent across channels.
• Collect the minimum. A name and phone number is enough to book an appointment; resist gathering more at first contact than the task requires.
• Secure the records. Transcripts and booking notes should be access-controlled, not sitting in a shared inbox anyone can open.
• Set a retention period. Define how long call data is kept, document it, and actually delete on schedule.
• Honour data-subject rights. Individuals can request access, correction, or deletion under KVKK, have a simple process ready before the first request arrives.

VERBIS and vendors

Depending on your size and activity, your business may already carry VERBIS registration obligations. Adding an AI receptionist doesn't change that analysis on its own, but it does add a processing activity worth documenting explicitly in your data inventory, alongside your existing systems.

How Hala supports this work

Hala stores your calls and bookings inside your own isolated workspace, scopes access to your team, and gives you a clear, reasoned view of retention. No AI vendor is "KVKK certified," and Hala makes no such claim, but the platform is built to help you meet your obligations as a controller, with the transparency and access controls KVKK expects from any system handling customer calls.

Next step

Document the booking workflow end to end: what is collected, the lawful basis relied on, who can see it, and how long it is retained. That short record is the foundation of a defensible KVKK position, and it turns switching on an AI assistant into a controlled step rather than a leap into the unknown.