Turkey Recording Laws: All-Party Consent, TCK Penalties & KVKK (2026)

How Turkey Classifies Recording Consent

Turkey operates under an all-party consent standard for private recordings. Every person involved in a conversation must agree before anyone may lawfully record it. This rule applies to phone calls, in-person discussions, video chats, and any other form of private communication.

The legal foundation sits in the Turkish Penal Code (Turk Ceza Kanunu, or TCK), Law No. 5237, enacted September 26, 2004. Articles 132 through 138, grouped under the heading "Offenses Against Privacy and the Secrecy of Private Life" (Ozel Hayata ve Hayatin Gizli Alanina Karsi Suclar), set out the criminal prohibitions. The full text of the code is published on Turkey's official legislation database at mevzuat.gov.tr.

Unlike one-party consent countries such as the United States (at the federal level) or Brazil, Turkey does not permit a participant to secretly record their own conversations. The mere act of pressing record without telling the other side is enough to trigger criminal liability. Article 133(2) creates a somewhat lighter offense specifically for participants who do this, but it remains a crime.

This article covers the law of Türkiye (Turkey) only. It does not address the recording-consent rules of any other country. For US state laws, see the US recording laws hub.

TCK Article 132: Violating the Confidentiality of Communication

Article 132 of the Turkish Penal Code targets interference with private communications carried through technological means. This covers telephone calls, emails, text messages, fax transmissions, and internet-based messaging platforms.

Base Offense

Anyone who violates the confidentiality of communications between persons faces 1 to 3 years in prison. The law requires that the communication travel through a recognized medium. Face-to-face conversations do not fall under Article 132. Those are handled separately under Article 133.

Recording Aggravator

When the violation of communication confidentiality involves recording the contents, the penalty is increased by one fold. In practical terms, this doubles the sentence range. A person who records a phone call they were not authorized to record faces an effective range of 2 to 6 years.

Disclosure of Communication Contents

Article 132(3) addresses a separate but related offense. Anyone who illegally discloses the contents of communications between persons faces 2 to 5 years in prison. This applies even if the person doing the disclosing obtained the contents lawfully. Sharing a private phone conversation on social media, forwarding confidential messages to third parties, or publishing recorded calls all fall within this prohibition.

The statute is an intentional-only crime. The prosecutor must prove that the accused acted knowingly and willfully. Accidental recordings or inadvertent disclosures do not satisfy this threshold.

TCK Article 133: Eavesdropping and Recording Conversations Between Persons

Article 133 is the provision most directly relevant to recording laws. It covers in-person conversations and private meetings where no telecommunications device serves as the medium. Critically, it draws a legal distinction between outsiders who eavesdrop and participants who secretly record their own conversations.

Eavesdropping With a Device (Article 133/1)

Anyone who listens to private conversations between other persons using a listening device, without the consent of any of those persons, faces 2 to 5 years in prison. The same penalty applies to anyone who records such conversations using an audio recording device.

This is the core all-party consent provision. The phrase "without the consent of any of such persons" means that all participants must give permission. A single holdout makes the recording illegal.

Participant Self-Recording (Article 133/2)

A person who is themselves a party to a private conversation and who records that conversation without the knowledge and consent of the other participants faces a separate and lighter offense under Article 133(2). The penalty is 6 months to 2 years in prison or a judicial fine.

This is one of the most frequently misunderstood aspects of Turkish recording law. Many people assume that recording one's own conversation is either entirely legal (as it would be under a one-party consent rule) or triggers the same 2 to 5 year penalty as third-party eavesdropping. Neither is correct. The participant offense is still a crime, but the legislature treated it as less severe than outsider surveillance, reflecting a distinction between invading someone else's conversation and recording a conversation one is already part of.

In practice, this means a business executive who secretly records a meeting they are attending faces criminal exposure under Article 133(2), not Article 133(1), and a lower sentencing range. However, if they then share that recording, Article 133(3) applies with full force.

Recording a Meeting or Conference (Article 133/2)

A person who records the speech given during a non-public meeting or conference using an audio recording device, without the consent of the other speakers, also falls under Article 133(2) and faces 6 months to 2 years in prison or a judicial fine. Private business meetings, closed-door conferences, and similar gatherings fall under this provision.

Dissemination of Recordings (Article 133/3)

Anyone who distributes recordings obtained through the acts described in paragraphs 1 or 2 to third parties faces 2 to 5 years in prison plus up to 4,000 days in administrative fines. This applies even if the initial recording was somehow lawful. The act of spreading the recording to others is independently criminal.

The distinction between Articles 132 and 133 is critical. Article 132 covers communications made through a medium (phone, internet, mail). Article 133 covers direct, in-person conversations. Both require all-party consent. Both carry prison sentences.

TCK Article 134: Violation of Privacy of Private Life

Article 134 protects the broader sphere of private life beyond just conversations. It covers image capture, video recording, photography, and audio recording of activities that belong to someone's private domain.

Base Offense (Article 134/1)

Anyone who violates the privacy of another person's private life faces 1 to 3 years in prison. The crime is completed the moment the recording is made. No distribution or sharing is required for conviction.

Recording Aggravator

When the violation of privacy occurs through image or sound recording, the penalty is doubled, producing an effective range of 2 to 6 years. Setting up a hidden camera in someone's home, recording a person in a private setting without consent, or capturing images of intimate activities all trigger this enhanced penalty.

Disclosure of Private Images or Sounds (Article 134/2)

Anyone who unlawfully discloses images or sounds related to someone's private life faces 2 to 5 years in prison. This covers the distribution of secretly recorded material through any channel, including social media, messaging apps, or traditional media.

Complaint Timeframe

The statute of limitations for filing a complaint under Article 134/1 is 6 months. The clock starts from the date the victim learns of the recording and the identity of the person who made it.

TCK Articles 135 and 136: Personal Data Offenses

Recordings often contain personal data. Articles 135 and 136 provide a second layer of criminal exposure for anyone who captures or distributes them.

Article 135: Unlawful Recording of Personal Data

Anyone who records personal data in violation of the law faces 1 to 3 years in prison. Turkish law defines personal data broadly: any information relating to an identified or identifiable natural person. A voice recording, a photograph, a video clip, biometric data, and even a phone number all qualify.

Article 136: Unlawful Transfer or Acquisition of Personal Data

Anyone who unlawfully gives personal data to another person, disseminates it, or acquires it faces 2 to 4 years in prison. This provision targets the downstream handling of data after it has been collected.

If the personal data in question involves statements or images recorded under the Code of Criminal Procedure (CMK) Article 236, paragraphs 5 and 6, the penalty under Article 136 is doubled.

Article 136 is not a complaint-based offense. Prosecutors may initiate proceedings without a victim filing a complaint.

TCK Article 137: Aggravated Offenses

Article 137 does not create new offenses. Instead, it increases the penalties for the offenses described in Articles 132 through 136 when they occur in aggravating circumstances.

The penalty for any Article 132 through 136 offense is increased by one-half when the offense is committed:

• By a public official (kamu görevlisi) who abuses their official position or authority. This covers police officers, civil servants, military personnel, intelligence agents, and any other person holding public authority. The aggravating element is the abuse of their specific official role, not merely the fact that they hold public employment.

• By persons using organizational or corporate means. A private investigator operating through a company, a law firm deploying surveillance tools, or a corporation that instructs employees to conduct unauthorized monitoring can all face the aggravated penalty under this subsection.

In practical terms, a public official who records private conversations in violation of Article 133(1) would face 50% more than the 2 to 5 year base penalty, resulting in an effective ceiling of 7.5 years. The same principle applies to each of the Article 132 through 136 offenses, compounding their already serious consequences.

Article 137 also intersects with the "recording police" question discussed below. While citizens may now record police performing public duties (per the 2025 Council of State ruling), police who secretly record citizens in violation of TCK 132-136 face the Article 137 aggravated exposure precisely because of their official status.

TCK Article 138: Failure to Destroy Data

Article 138 addresses a distinct but related obligation: once personal data must be deleted under law or court order, failing to do so is a separate criminal offense.

Data controllers who receive a court-ordered deletion instruction, or whose data retention periods have expired under applicable law, and who fail to delete the relevant recordings, face criminal exposure under Article 138. This provision is relevant for businesses that retain call recordings beyond their stated purpose, employers who keep employee surveillance footage longer than their policy allows, and any organization operating under a KVKK Board deletion order.

The Self-Defense Exception: When Secret Recording May Be Lawful

Turkey's all-party consent rule is strict, but it is not absolute. Turkish courts have carved out a narrow exception rooted in the general defense provisions of the Penal Code.

TCK Article 25: Legitimate Self-Defense

Article 25(1) provides that a person who repels a real, imminent, or certain-to-occur unlawful attack directed at their own rights or those of another person, in a manner proportionate to the attack and with the necessity of defense, shall not be punished.

TCK Article 26: Exercise of a Right and Consent

Article 26(1) states that a person exercising their legal right shall not be punished. Article 26(2) adds that no punishment applies for an act carried out with the declared consent of a person who has full authority to give that consent.

How the Exception Works in Practice

The Court of Cassation (Yargıtay) has established criteria for when a secret recording qualifies as a lawful exercise of rights or legitimate defense. All of the following conditions must typically be met:

• A crime is being committed against the recorder or their close relatives at the time of the recording. Threats, extortion, blackmail, sexual harassment, or assault are the most common qualifying offenses.

• The criminal act develops suddenly, leaving no opportunity to contact law enforcement beforehand.

• The recording is the only practical way to document and prove the crime. Other means of evidence are unavailable or inadequate.

• The recorder did not plan, provoke, or orchestrate the situation to create a pretext for recording.

• The recording is used solely for the purpose of proving the crime in legal proceedings and is not shared with third parties or published.

When all five conditions are satisfied, the recording may be admitted as evidence in court and the recorder may escape criminal liability for the act of recording itself. When even one condition fails, the recording is treated as illegally obtained evidence, and the recorder may face prosecution.

Two illustrative cases confirm that courts take this narrowly: In Yargıtay Case No. 2019/3621, an employee was convicted for installing a hidden recording device in a confidential space despite claiming a workplace dispute justified the recording. In Yargıtay Case No. 2021/1547, a person who installed a device under a judge's desk was convicted, confirming that no target's status creates a general exception.

Phone Recording vs. In-Person Recording

Turkish law draws a sharp distinction between recordings made through communication devices and recordings of face-to-face conversations.

Phone and Digital Communication

Recording a phone call, video call, or digital message exchange without all-party consent falls under TCK Article 132. The base penalty is 1 to 3 years, doubled to 2 to 6 years when a recording is made. Disclosure of the recording adds a separate charge carrying 2 to 5 years.

Businesses that record phone calls for quality assurance or training purposes must inform the caller at the start of the call and obtain consent. Simply playing a recorded message that says "this call may be recorded" satisfies the notification requirement only if the caller has the option to decline and the recording stops if they do.

In-Person Conversations

Recording face-to-face private conversations without consent falls under TCK Article 133. The penalty is 2 to 5 years for eavesdropping or recording by a third party (Article 133/1), or 6 months to 2 years for a participant secretly recording their own conversation (Article 133/2). This heavier base penalty for outsider eavesdropping reflects the legislature's view that physical-space privacy deserves heightened protection from third-party surveillance.

Recording a private meeting or conference without speaker consent carries 6 months to 2 years or a judicial fine under Article 133(2).

Recording Police and Public Officials

For many years, a General Directorate of Security circular prohibited citizens and journalists from recording police officers' images and voices. That changed in January 2025.

The January 2025 Council of State Ruling

Turkey's Council of State (Danıştay) finalized a decision annulling the General Directorate of Security's recording ban. The court found the blanket prohibition to be "unnecessary and disproportionate" and concluded that it "infringed upon the core of the right to information." The court stated there is "no longer a legal basis for preventing journalists from recording the images of police officers."

As of January 2025, citizens and journalists may record police officers performing their official public duties. The constitutional standard remains: any limitation on the right to record must be "aligned with the needs of a democratic society" and proportional to its purpose. A blanket ban on all police recording does not meet this standard.

What This Ruling Does Not Change

The January 2025 ruling addresses recording of police in their official capacity performing public duties. It does not create a general right to record anyone in any context. The following remain subject to the all-party consent rules of TCK Articles 132 through 134:

• Private conversations that happen to involve a police officer but are not related to official public functions.
• Recording in spaces where the police officer has a personal (non-official) expectation of privacy.
• Recording that targets an officer's personal life rather than their exercise of public authority.

Additionally, police officers who secretly record citizens in violation of TCK Articles 132 through 136 face the aggravated exposure under Article 137, because the offense is committed by a public official abusing their official position.

Judicial Wiretapping: CMK Article 135

Law enforcement agencies in Turkey may intercept and record communications, but only under strict judicial supervision governed by the Code of Criminal Procedure (Ceza Muhakemesi Kanunu, or CMK), Article 135.

Requirements for Lawful Interception

A judge must issue a written order authorizing the interception. During the investigation phase, the prosecutor may authorize interception in urgent cases, but a judge must approve that decision within 24 hours.

The following conditions must all be present:

• Strong suspicion, supported by concrete evidence, that an offense has been committed.

• The offense must be one of those specifically listed in CMK Article 135(8). The list includes organized crime, terrorism, drug trafficking, and certain other serious offenses.

• No other method of obtaining the needed evidence is available or adequate.

Interception orders are time-limited and subject to ongoing judicial review. The judge may terminate the interception at any time.

What the Authorities Can Access

Under CMK Article 135, authorities may intercept the content of telephone calls, monitor internet-based communications, and access signal data (metadata such as call duration, parties, and timestamps). The Information and Communication Technologies Authority (Bilgi Teknolojileri ve Iletisim Kurumu, or BTK) facilitates technical access at the request of prosecutors or courts.

Recording in Public Spaces

Turkish law does not create a blanket permission for recording in public. The Court of Cassation has stated that while a public space is visible to everyone, individuals do not forfeit their right to privacy simply by entering one.

The Identification Threshold

What matters is not just where a recording is made, but how it is used. Recording a city street or a crowd at a public event is generally permissible when no individual is singled out in an identifiable way. Problems arise when footage isolates a specific person in a manner that invades their private life, subjects them to ridicule, or damages their reputation.

Photography and Filming

A person's photograph is treated as personal data under both TCK Article 135 and KVKK Article 3(3). Photographing or filming identifiable individuals in public without consent and then publishing those images may violate Article 134 (privacy) and Article 136 (unlawful dissemination of personal data).

Professional film crews and photographers working in public spaces in Turkey typically obtain filming permits from local authorities and secure release forms from identifiable subjects.

Voyeurism and Hidden Cameras

Voyeurism and hidden-camera offenses are handled through TCK Article 134's privacy violation framework, with the recording aggravator making them among the most seriously punished recording offenses in Turkey.

Installing Hidden Cameras

Installing a concealed camera in a space where a person has a reasonable expectation of privacy (a home, a hotel room, a changing room, a restroom) without that person's knowledge or consent triggers TCK Article 134(1) with the recording aggravator: 2 to 6 years. The crime is complete upon installation and first use; no distribution is required.

If the footage is subsequently shared with any third party, Article 134(2) adds a separate charge carrying 2 to 5 years. Sharing on social media, distributing via messaging apps, or uploading to any platform are all covered. In cases where images are spread through the media, the penalty under Article 134(2) is increased by one-half.

Revenge Recordings and Non-Consensual Intimate Images

Turkey does not have a standalone "revenge porn" statute (as of May 2026), but the combination of Article 134(1) (recording, aggravated), Article 134(2) (disclosure), and Article 226 (obscene material) provides a full criminal framework for non-consensual intimate image offenses. Prosecutors routinely charge all three provisions in revenge-recording cases.

Workplace Hidden Cameras

The KVKK Board has specifically ruled that workplace cameras must not be placed in areas where employees have a heightened expectation of privacy: restrooms, changing rooms, prayer rooms, and break areas. Installing hidden cameras in any of these locations violates both Article 134 and KVKK data protection obligations simultaneously.

Workplace Recording and Surveillance

Employers in Turkey may conduct workplace surveillance, but the right to monitor is constrained by both the Penal Code and the KVKK.

CCTV and Video Monitoring

Employers must inform employees in advance about the number of cameras, their locations, the purpose of surveillance, and the duration of data retention. The Personal Data Protection Board (Kisisel Verileri Koruma Kurulu) has ruled that cameras must not record areas where employees have a heightened expectation of privacy, including restrooms, changing rooms, and prayer rooms.

Video-only recording is acceptable when it serves a legitimate security purpose. Adding audio recording to workplace cameras violates the principle of proportionality in most circumstances, because the security objective can typically be achieved with video alone.

Employee Consent

Explicit employee consent is required before implementing electronic monitoring systems. The consent must be specific, informed, and freely given. Blanket consent buried in an employment contract does not satisfy KVKK requirements. Employees must be able to understand exactly what is being monitored, why, and for how long.

Email and Computer Monitoring

Employers who monitor company email accounts or computer usage must have a clear, written policy that employees acknowledge. Monitoring personal communications on company devices crosses into TCK Article 132 territory if the employee has not been notified and given consent.

KVKK (Law 6698): Data Protection Rules for Recordings

Turkey's Personal Data Protection Law (Kisisel Verilerin Korunmasi Kanunu, or KVKK), Law No. 6698, went into effect on April 7, 2016. It governs how all personal data, including voice recordings, video footage, and photographs, may be collected, processed, stored, and shared.

Recordings as Personal Data

The KVKK defines personal data as any information relating to an identified or identifiable natural person. Voice recordings, call recordings, CCTV footage, and photographs all fall squarely within this definition. Any entity that captures such recordings is acting as a data controller and must comply with the full range of KVKK obligations.

Lawful Basis for Processing

Data controllers must have a lawful basis before recording. The KVKK recognizes several grounds, including explicit consent of the data subject, performance of a contract, compliance with a legal obligation, establishment or protection of a right, and the legitimate interests of the data controller (provided those interests do not override the fundamental rights of the data subject).

Data Subject Rights Under KVKK Article 11

Individuals have specific rights regarding their personal data, including recordings that feature them. Under Article 11, every data subject may:

• Learn whether their personal data is being processed.
• Request information about the purpose of processing and whether data is being used for that purpose.
• Request the identities of any third parties to whom data has been transferred.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction of data when the grounds for processing no longer exist.
• Object to any processing carried out exclusively through automated systems that produces results against the individual's interests.
• Demand compensation for damages caused by unlawful processing.

VERBIS Registration

Every data controller operating in Turkey must register with the Data Controllers Registry Information System (Veri Sorumlulari Sicil Bilgi Sistemi, or VERBIS) before processing personal data. Failure to register, registering with false information, or failing to update registration details triggers fines ranging from 341,809 TL to 17,092,242 TL in 2026. In August 2024, KVKK enforcement intensified significantly: 16,350 organizations faced investigation with over 503.9 million TL in penalties issued in that month alone.

2026 Administrative Fine Amounts

The KVKK's Article 18 establishes administrative penalties that are adjusted annually based on the revaluation rate. For 2026, the revaluation rate was set at 25.49% by the Tax Procedure Law General Communique No. 585. The updated fine ranges are:

• Failure to comply with Board decisions: 427,263 TL to 17,092,242 TL

• Violation of data security obligations: 256,357 TL to 17,092,242 TL

• VERBIS registration failures: 341,809 TL to 17,092,242 TL

• Violation of the obligation to inform data subjects: 85,437 TL to 1,709,200 TL

These are administrative fines imposed by the Personal Data Protection Board. They exist in addition to any criminal penalties under the TCK.

Cross-Border Data Transfers and Adequacy Status

Any company that stores Turkish recording data on foreign servers, shares call recordings with overseas affiliates, or otherwise transfers personal data outside Turkey must comply with Turkey's cross-border data transfer rules. These rules changed significantly in 2024.

The July 2024 Regulation

Turkey's Regulation on the Procedures and Principles Regarding the Cross-Border Transfer of Personal Data was published July 10, 2024. It fundamentally restructured international data transfers and took effect September 1, 2024. The most important change: explicit consent is no longer a valid standalone legal basis for transferring personal data (including recordings) to foreign countries.

Before September 2024, companies could transfer data internationally simply by obtaining the data subject's consent. That option no longer exists as a standalone mechanism. Companies must now use one of the following approved mechanisms:

• Adequacy decisions issued by the KVKK Board. As of May 2026, the KVKK Board has not issued any adequacy decisions for any foreign country, meaning no country is formally recognized as providing adequate protection.

• Standard Contractual Clauses (SCCs). Companies may use the KVKK-published SCC form exactly as written, without modification. The Turkish-language version prevails over any foreign-language translation. The company must notify the KVKK Authority within five business days of executing an SCC agreement.

• Binding Corporate Rules (BCRs) approved by the KVKK Board, for intra-group transfers within multinational organizations.

• Written undertakings approved by the KVKK Board on a case-by-case basis.

Turkey and the EU Adequacy Framework

Turkey is not on the European Union's adequacy list. EU companies transferring personal data to Turkey must use SCCs or BCRs and comply with GDPR Article 46 requirements. Turkish companies receiving data from the EU are bound by GDPR at the point of transfer; once data enters Turkey's jurisdiction, KVKK governs its handling.

The 2025 KVKK Cross-Border Data Transfer Guide issued by the Turkish Data Protection Authority provides more detail on the hierarchical evaluation method for selecting the correct legal ground. It also distinguishes between "data transfers" (structured, ongoing flows) and "direct disclosures" to foreign parties (one-time, incidental).

For companies that record customer calls or operate CCTV systems and store that footage on cloud infrastructure outside Turkey, the practical implication is clear: those services require either an approved SCC in place with the cloud provider, or the cloud provider must be based in a country for which the KVKK Board eventually issues an adequacy decision.

Deepfake and AI-Generated Recordings

Turkish law addresses AI-generated content at two levels: through existing penal code provisions that can apply to deepfakes and through pending legislation specifically targeting AI-generated material.

TCK Article 217/A: The 2022 Disinformation Law

Article 217/A was added to the Turkish Penal Code by Law No. 7418, enacted in October 2022. It targets a specific conduct: publicly disseminating false information contrary to facts about the internal or external security, public order, or public health of the country, with the sole intention of creating anxiety, fear, or panic among the public in a manner likely to disturb public peace.

The penalty is 1 to 3 years in prison. If the offense is committed by concealing the offender's true identity or as part of an organized group, the penalty is increased by one-half.

Article 217/A is the provision commonly called Turkey's "disinformation law." It is relevant to deepfakes to the extent that a person creates and spreads an AI-generated video falsely portraying public events in ways designed to cause public panic. It is not a recording-consent provision; it does not cover the creation or private sharing of deepfakes, only their public dissemination in the specific context of security, public order, or public health.

Existing TCK Provisions Applied to Deepfakes

Before any specific AI legislation is enacted, existing TCK articles already apply to harmful uses of deepfakes:

• A deepfake video that places an identifiable person in a sexually explicit or otherwise private scenario, created and distributed without consent, triggers TCK Article 134 (violation of privacy of private life) and Article 136 (unlawful dissemination of personal data), with potential penalties of 2 to 6 years combined.

• Using a deepfake voice recording to impersonate someone in a business communication implicates fraud provisions and Article 136 if personal voice-print data is involved.

• Workplace deepfakes used to blackmail or extort colleagues engage TCK's extortion provisions alongside Article 134.

The Pending AI/Deepfake Bill (Not Yet Law)

A Bill on Amendments to Several Laws Regarding Artificial Intelligence (Esas No. 2/3358) was submitted to Turkey's Grand National Assembly on November 7, 2025 and referred to committee. As of May 2026, the bill has not been enacted. Its key proposals include:

• Mandatory labeling of all AI-generated audio-visual content with a clear, persistent "Produced by Artificial Intelligence" statement.

• A six-hour deadline for authorities to make takedown decisions when AI-generated content is reported for violating personality rights or threatening public order.

• Emergency blocking powers for BTK (the Information and Communication Technologies Authority) specifically for AI-generated content violations.

• Administrative fines of 500,000 to 5,000,000 TL for labeling failures or systematic violations.

• Increased penalties (by one-half) for developers whose AI systems facilitate criminal offenses.

Until this bill is enacted, there is no standalone Turkish deepfake law. Practitioners and affected persons rely on the existing TCK privacy, fraud, and personal data framework described above.

Business Compliance: Recording Customers and Employees

Companies operating in Turkey that record phone calls, video conferences, or in-person interactions must navigate both the TCK and the KVKK simultaneously.

Call Center and Customer Service Recording

Before recording any customer interaction, the business must:

• Inform the customer at the beginning of the call that recording will take place.

• State the specific purpose of the recording (quality assurance, training, dispute resolution, or legal compliance).

• Give the customer the option to decline recording. If the customer objects, the call must proceed without being recorded.

• Store recordings securely and delete them when the stated purpose has been fulfilled.

• Register as a data controller with VERBIS.

Pre-recorded messages announcing that a call "may be recorded for quality purposes" do not automatically satisfy KVKK consent requirements. The notification must be specific, and the consent must be freely given.

Retention Periods and Deletion

KVKK does not mandate a universal retention period for call recordings. The appropriate retention period depends on the purpose of recording. For quality assurance, the standard industry practice is 30 to 90 days; for contractual dispute documentation, retaining recordings through the statute of limitations for the underlying contract is defensible. Once the stated purpose is exhausted, Article 138 requires deletion. Companies that fail to delete on schedule face both KVKK administrative fines and potential Article 138 criminal exposure.

Handling Data Subject Access Requests

When a customer or employee submits a KVKK Article 11 access request about their recording data, the company must respond within 30 days. The response must confirm whether recordings exist, describe the purpose for which they are processed, and provide the data subject with information about their right to request deletion. If the stated purpose has been fulfilled, deletion must follow.

Internal Recording Policies

Companies should maintain a written recording and surveillance policy that covers:

• Which communications or spaces are subject to recording.

• The legal basis relied upon for each type of recording.

• How long recordings are retained.

• Who has access to recordings.

• How employees or customers can exercise their data subject rights (access, correction, deletion).

Penalties at a Glance

The following table summarizes the main criminal penalties for recording offenses in Turkey:

Constitutional Protections

The Turkish Constitution of 1982 reinforces the statutory framework. Article 20 guarantees the right to privacy of private life and prohibits unlawful interference. Article 22 protects the secrecy of communication and bars any form of interception or recording outside the exceptions established by law and authorized by a judge.

These constitutional provisions have direct legal force. Courts routinely cite Articles 20 and 22 alongside the relevant TCK provisions when adjudicating recording offenses. The Constitutional Court (Anayasa Mahkemesi) has addressed privacy violations in several individual application decisions, reinforcing that constitutional protection extends to digitally transmitted communications and to recordings made in contexts where individuals have a reasonable expectation of privacy.

---

The information on this page presents general legal information about Türkiye's recording laws as of May 2026. It is not legal advice. Laws may change. Consult a lawyer licensed in Türkiye for advice on your specific situation.