KVKK voice recording rules: What to check before you transcribe

Is recording against the law?

Recording is not unlawful in itself, but it has conditions. Processing must be lawful and fair, tied to a specific purpose and proportionate to it (art. 4). It also needs a legal basis: Explicit consent is one, and performance of a contract, a legal obligation or legitimate interest are others (art. 5).

There are cases where the law does not apply. Purely personal or household activities are outside its scope, provided the data is not given to third parties and is kept secure. Processing for art, history, literature, science or free expression is also outside it, provided it does not violate privacy or personal rights or amount to a crime (art. 28). These exceptions have limits, and researchers and journalists also follow their professional rules.

Criminal law applies separately. Article 133 of the Turkish Penal Code makes it an offence to record a non-public conversation without consent, even if you are a party to it (Law no. 5237, in Turkish). So the safest course is to say so before you start.

Before you record

1. Write down the purpose. Know why you record and what the text is for.
2. Choose the legal basis. Know which one you rely on.
3. Inform people. Tell them who you are, the purpose, who may receive the data and their rights (art. 10).
4. If you rely on consent, get it on the recording. That makes it easier to prove later.

A short example: “I am recording this conversation and will transcribe it. I will use it only for this study and delete it when the work ends. Do you agree?” This is not enough in every case, and it should match your organisation’s privacy notice.

Who is the data controller?

Whoever decides the purpose and means of processing is the data controller (art. 3). If you are transcribing an interview, that is usually you or your organisation. Under the user agreement, LiveType’s operator is the data processor that stores transcripts on your behalf. For your account data the operator is the controller, as the privacy notice explains. Choosing a tool does not hand your responsibility over to it.

Questions to ask of a transcription tool

Private transcription shows how to verify this yourself.

Transfers abroad in cloud transcription

Sending sound to a service abroad is a transfer under article 9, which a 2024 amendment rebuilt around adequacy decisions and appropriate safeguards. By option:

• This device: The sound does not leave, so the question does not arise. Model files download from outside, but no sound is sent.
• Cloud with your own key: The sound goes from your browser straight to the provider you chose, so you make the transfer. The provider’s terms apply.
• Credit cloud: The sound passes through our server, unsaved, to the provider.
• Remote device: The sound goes peer to peer, encrypted, to your own or your team’s device.

For sensitive conversations, on-device transcription is the easy route. Cloud transcription and remote devices compares them.

After transcribing: Storage, deletion, rights

• Delete when the purpose ends. Data must then be erased, destroyed or anonymised (art. 7). Remember the sound file, the text and exported copies.
• Do not over-share. Do not use a public link for text with personal data.
• Use codes. Qualitative interview transcription covers anonymising, and interview transcription covers protecting a source.
• Be ready for requests. People may ask whether their data is processed and ask for it to be corrected or deleted (art. 11).

If you work for an employer or institution, ask for its policy first. The information here is general and does not replace legal advice.