AI Voiceover and Türkiye's Data Protection Law (KVKK): What Businesses Need to Know

While AI voiceover speeds up corporate communications, it naturally raises a question: what do we need to watch out for when it comes to protecting personal data?

In this post we summarize the key points businesses using AI voiceover in Türkiye need to know under Law No. 6698 on the Protection of Personal Data (KVKK). If you operate in the EU, similar questions arise under the GDPR, but the rules below are specific to Turkish law.

Important note: This article is for general information and is not legal advice. For situations specific to your organization, consult a legal advisor.

When does personal data come into play in voiceover?

There are two kinds of data in AI voiceover: the script being voiced and the voice being used. Under KVKK, the risk depends on what each of these contains.

Scenario	Personal data involved?	Risk level
Generic IVR prompt, ready-made synthetic voice	Generally no	Low
Product video, ready-made synthetic voice	Generally no	Low
Personalized message with the customer's name	Yes (name, contact, transaction details)	Medium
Message to a patient with appointment and treatment details	Yes, health data (special category)	High
Cloning an employee's or executive's voice	Yes, voice data	High
Voice-based identity verification	Yes, biometric data (special category)	High

Is a voice personal data?

Under KVKK, personal data is any information relating to an identified or identifiable natural person. A person's voice is personal data because it can be used to identify them.

When a voice is used to identify or verify a person through technical means, it may qualify as biometric data. Biometric data is listed among special categories of personal data in Article 6 of KVKK and is subject to stricter conditions.

A ready-made, synthetic AI voice doesn't belong to a real person, so using it in an announcement does not, on its own, mean processing personal data.

What to watch out for in personalized messages

A message such as "Dear Ms. Ayşe, this is a reminder of your appointment tomorrow at two p.m." processes personal data because it contains a name and appointment details. For this kind of use:

1. Identify the legal basis. Clarify which of the conditions in KVKK Article 5 (or Article 6 for special categories such as health data) the processing relies on.
2. Meet your duty to inform. Tell people for what purposes and with whom their data is shared. Your voiceover vendor is among those recipients.
3. Apply data minimization. Use only the necessary information in the message. In an appointment reminder, for example, the date and time may be enough without naming the department.
4. Sign a data processing agreement with your vendor. The voiceover platform processes data on your behalf. Define responsibilities and security measures in a contract.

Explicit consent for voice cloning

If you want to create an AI voice from the voice of an employee, an executive or a voice actor:

• Obtain the person's explicit consent, freely given, specific and informed.
• Get consent in writing and clearly state the purposes, duration and channels for which the voice will be used.
• Decide in advance what happens if the person withdraws consent.
• Because of the power imbalance in an employment relationship, make sure consent from employees is genuinely freely given.

Keep in mind that a separate assessment may also be needed for personality rights and intellectual property rights.

Cross-border data transfers: the 2024 changes

Much of the infrastructure behind AI voiceover runs on servers abroad. If a script contains personal data, sending it abroad counts as a cross-border data transfer.

Law No. 7499, published in the Official Gazette on 12 March 2024, made significant changes to Articles 6 and 9 of KVKK. The changes took effect on 1 June 2024. Under the new framework there are three main routes for transfers abroad:

1. Adequacy decision: The Board has issued an adequacy decision for the country, sector or international organization receiving the data.
2. Appropriate safeguards: Without an adequacy decision, safeguards such as the standard contract published by the Board, binding corporate rules or a written undertaking approved by the Board. A standard contract must be notified to the Authority within five business days of signing.
3. Incidental transfer: Only in incidental (irregular, non-repeating) cases, for example in limited situations such as the explicit consent of a person informed about the possible risks.

If you regularly voice scripts containing personal data, the incidental transfer provisions will generally not be a suitable basis; in that case, assess appropriate safeguard mechanisms with your legal counsel.

8 questions to ask when choosing a vendor

1. In which country are the scripts processed?
2. How long are scripts and audio files stored, and how can they be deleted?
3. Are my scripts used to train the model? Can I opt out?
4. Can a data processing agreement, and a standard contract if needed, be signed?
5. What technical security measures (encryption, access control, logging) are in place?
6. How does the notification process work in the event of a data breach?
7. Who are the sub-processors?
8. If voice cloning is offered, how are consent processes managed?

Practical tips to reduce risk

• Where possible, voice scripts with no personal data. Generic announcements, training and promotional content are the safest uses.
• Use personalization only where it's really needed. Not every message has to be personal.
• Prefer ready-made synthetic voices. Using a real person's voice brings additional obligations.
• Document it. Keep a record of which content you process, on what basis and with which vendor.

On Voice Go's Enterprise plan, we define data processing and retention terms in the contract. For details, contact us through the demo request form.