Guide

KVKK-compliant meeting recording: what to watch out for

Updated 16 September 2026 · Türkçe

Recording a meeting is not forbidden. But the moment you press record you begin processing the personal data of everyone in the room, and the obligations of Law 6698 — Turkey's data protection law, known as KVKK — come into force. What follows is a checklist: where each obligation bites, and what to ask when choosing a tool.

1. An audio recording is personal data — and so is the transcript

The law defines personal data as "any information relating to an identified or identifiable natural person" (art. 3). A meeting recording meets that comfortably: who spoke, what they said, what they agreed to. Turning audio into text does not anonymise it — the names, the projects and the opinions sit in the transcript exactly as they were.

The practical consequence: deleting the recording is not enough, the transcript and the summary fall under the same policy.

2. Once a voice print is involved, the data becomes "special category"

Some tools that separate speakers do it by extracting a voice print: a vector unique to the person is produced from the audio and the person is identified by it. Data produced for the purpose of identifying someone is biometric data and counts as special-category personal data under article 6 of the law. It carries heavier conditions than ordinary personal data.

The question to ask when choosing a tool: is a voice print produced, and if so where is it stored and can it be deleted? Not every tool that separates speakers has to store a voice print — some only distinguish "speaker 1 / speaker 2" inside a single recording and keep no identity between recordings.

3. Notice, before you press record

The duty to inform (art. 10) arises at the time the data is obtained — saying "by the way, I was recording" afterwards does not satisfy it. For a meeting, that means telling the room, before you press record, that it is being recorded, for what purpose, for how long, and with whom it will be shared.

If explicit consent is to be taken (generally required where special-category data is involved), the consent has to be given freely. In an employer–employee relationship this is contested ground: consent obtained with "you cannot join the meeting unless you accept" may not count as free. For internal meetings, relying on another legal basis (legitimate interest, for example) and documenting it can be sounder — that is the part to ask a lawyer about.

4. Transfer abroad: present in almost every tool

The models that turn speech into text are heavy; nearly all of them run in a cloud, and that cloud is usually not in Turkey. If audio or text leaves the country, article 9 applies. After the amendment made by Law 7499 in 2024, a transfer can be made on the basis of an adequacy decision, appropriate safeguards (standard contractual clauses, binding corporate rules, an undertaking) or one of the listed exceptions. Standard contracts have to be notified to the Board.

The only correct behaviour here is to expect the tool to state plainly what it sends where. If it does not say, the answer is not "it does not send anything".

5. Retention and deletion

Article 4 requires processing that is connected to the purpose, limited and proportionate, and not kept longer than needed. For a meeting recording the most concrete form of that is one question: do you actually need the raw audio file? What most teams need is the summary and the decisions; raw audio, weeks after the meeting, is only risk. A flow that never stores the audio is safer than one that stores it and then has to remember to delete it.

Six questions to ask of any tool

1. Is the raw audio kept as a file, or does it only stream through while being turned into text?
2. Where do the transcript and the summary sit — on the device, or on the provider's server?
3. Is a voice print produced for speaker separation? If so, where is it kept, and can it be deleted in one tap?
4. Which countries is the data transferred to, and under which safeguard?
5. Are recordings used to train models? (Look for an explicit "no" in the contract.)
6. Is it possible to delete a user's data wholesale, and in how many steps?

How Ses Notu answers this list

Answering the same six questions for my own product, including the parts that do not look good:

• Raw audio is not stored. It is never written as a file; it streams while you speak, to be turned into text, and ends there.
• The transcript and summary are on your phone. We keep no copy. No account, no sign-in.
• The voice print does not leave the phone. The model that extracts it (CAM++, ONNX Runtime, ~28 MB) ships inside the app; the vectors stay on the device and can be deleted from settings. How it works is in a separate post.
• There is a transfer abroad and I am not hiding it. Audio streams to the speech recognition provider (Soniox) to be turned into text; the meeting text goes to Google (Gemini, via Firebase AI Logic) for the summary. Our server is in the EU. Who receives what is written out as a table in the privacy policy.
• Not used for training. Nothing you record is used by us to train a model, and none of it is shared with advertisers.
• Deletion is in one place. Because the recordings are on the device, deleting the app deletes the data; voice prints can also be deleted individually.

The app has a screen that reminds you what to tell the room before recording starts — but it is you who gives the notice, not the app. That obligation cannot be delegated.