Recording job interviews in Turkey: Penal Code article 133, KVKK notice and consent, and transfers abroad

In Turkey (Türkiye), recording a job interview without the candidate's consent is a crime even for the interviewer: article 133(2) of the Turkish Penal Code punishes anyone who records a non-public conversation they take part in "without the consent of the other speakers" with six months to two years in prison or a judicial fine. The Personal Data Protection Law (KVKK, Law 6698) then requires notice when you collect the recording, a processing ground such as explicit consent, deletion once the purpose ends, and an adequacy decision or a safeguard such as a notified standard contract before a recording goes to a vendor abroad. This is the position as of November 2026.

This page adds Turkey to our country series. Like Singapore, Turkey has its own national data protection law rather than the GDPR, but its recording rule is stricter than the criminal rules in Germany or Austria: a participant needs the other speakers' consent. It is for recruiters, agency consultants and hiring managers who interview candidates located in Turkey by video or phone, including from the US. Statutes are quoted from mevzuat.gov.tr, the official legislation site, and guidance from the Personal Data Protection Authority (KVKK Kurumu); quotations are our translations from Turkish.

Turkey's rules at a glance

Is it a crime to record a job interview in Turkey?

Yes, unless the other speakers agree. Article 133 of the Turkish Penal Code (Law 5237), headed "listening to and recording conversations between persons," has three parts:

• Article 133(1): listening to non-public conversations between other people "without the consent of any of the parties," or recording them, is punished with two to five years in prison.
• Article 133(2): "A person who records with a sound recording device a non-public conversation in which they take part, without the consent of the other speakers, is punished with six months to two years in prison or a judicial fine."
• Article 133(3): unlawfully disclosing data obtained by recording non-public conversations is punished with two to five years in prison and a judicial fine of up to four thousand days.

A job interview is a non-public conversation, so subsection 2 covers the interviewer who records it. This is the opposite of the US one-party rule; see two-party consent states for the US side. Article 134 adds a separate offence for violating the privacy of private life, with the penalty doubled where it is done by recording images or sounds. Under article 139, offences in this part of the code are prosecuted only on complaint, except unlawfully recording personal data (article 135), unlawfully giving or obtaining personal data (article 136) and failing to destroy data when legally required (article 138), which are prosecuted without one.

Under article 8, Turkish law applies to offences committed in Turkey, and an offence counts as committed there if the act is done "partly or wholly" in Turkey or its result occurs there. A call with a candidate sitting in Turkey can therefore fall within article 133 even if the interviewer is abroad.

What does the KVKK require when you record?

A recording or transcript of an interview is personal data, and its processing must follow the principles in article 4 of the Personal Data Protection Law: lawful and fair, accurate, for "specific, explicit and legitimate purposes," "relevant, limited and proportionate," and kept only as long as the law or the purpose requires. Article 5(1) sets the default: personal data "may not be processed without the explicit consent of the data subject." Article 5(2) lists the exceptions, including processing that is necessary and "directly related to the formation or performance of a contract" and processing necessary for the controller's legitimate interests, provided the data subject's fundamental rights are not harmed.

Article 10 requires notice "at the time personal data are obtained": the controller's identity, the purpose, to whom and why the data may be transferred, the method and legal ground of collection, and the data subject's rights. The Authority's page on the duty to inform stresses that this duty continues whether the processing rests on explicit consent or another ground: "the data subject must be informed in every case in which their personal data are processed."

What counts as explicit consent?

The KVKK defines explicit consent as consent "on a specific matter, based on information and given with free will" (article 3). The Authority's guidance on obtaining explicit consent adds three points that matter for interviews:

• It "does not need to be obtained in writing" and can be given electronically or by phone, but "the burden of proof belongs to the data controller." Note the candidate's yes, with the date and time.
• General "blanket consents" that are not limited to a specific matter are "legally invalid." Ask about this recording, for this hiring process.
• Consent can be withdrawn at any time, with effect for the future: processing based on it must stop from the moment the withdrawal reaches you.

Give the notice and ask for consent as two separate steps: the notice is owed in every case, while consent is the answer to one specific question. Because article 133(2) requires the candidate's agreement to the recording anyway, consent is the natural ground for the recording itself, even where your interview notes rest on the contract-formation ground.

Does the KVKK's 2026 principle decision on monitoring affect recruiters?

It affects how you monitor your own recruiters. In a principle decision of September 16, 2026 (2026/2035), published on October 8, 2026, the Personal Data Protection Board set rules for employers that monitor corporate e-mail and "other communication channels used for carrying out work." Among them: a general statement that accounts may be monitored is not enough; notice must cover the legal ground, purpose, scope, method and retention; given the dependency in employment, an employee's explicit consent cannot as a rule be the primary legal ground; monitoring must be graded, with the least intrusive method first; and because employees' communications "may often also contain personal data of the other parties to the communication," the effect on those people must be considered.

If your phone system or interview tool records or analyzes every recruiter call, both groups are affected: the recruiters as employees and the candidates as the other party. Record only the interviews you need, limit who can open recordings, keep access logs, and tell your staff in specific terms what is recorded and why.

Can candidates get the recording or have it deleted?

Yes. Article 11 gives every data subject the right to learn whether their data are processed, to request information, to know the third parties in Turkey or abroad to whom data were transferred, to request correction and deletion, to object to a result against them arising "exclusively through automated systems," and to claim compensation for unlawful processing. Under article 13, the controller must conclude a request "as soon as possible and within thirty days at the latest, free of charge," unless the action involves an extra cost under the Board's tariff. If the request is refused or not answered, article 14 lets the person complain to the Board within thirty days of learning the answer and in any case within sixty days of the request. Our candidate data access requests guide has a workflow.

Article 11's objection right is the one to watch with AI tools: a feature that ranks or filters candidates on its own produces exactly the kind of automated result a candidate may object to. Keep a person in the decision.

How long can you keep interview recordings?

The KVKK sets no number for recruitment. Article 4 limits retention to the period the law sets or the purpose requires, and article 7 says personal data must be deleted, destroyed or anonymized, on the controller's own initiative or at the data subject's request, once the reasons for processing them no longer exist. Failing to destroy data after the legally set periods is itself an offence under article 138 of the Penal Code. Set a short period for audio, document it, and delete on schedule; our retention policy template gives the structure.

What if you interview from the US, or the tool is hosted abroad?

The KVKK applies to "natural or legal persons who process" personal data (article 2) and has no separate article on territorial scope, so a foreign employer or agency recording a candidate in Turkey should plan to meet it. For the recording or transcript itself, article 9, rewritten by Law 7499 in March 2024, allows a transfer abroad where an article 5 or 6 ground exists and either the Board has issued an adequacy decision for the country, or the parties provide an appropriate safeguard, such as a standard contract announced by the Board or binding corporate rules, and the data subject can exercise their rights and seek remedies in the destination country. A standard contract "is notified to the Authority by the data controller or processor within five business days of signing" (article 9(5)), and not doing so carries an administrative fine under article 18. Without either, article 9(6) allows only occasional transfers, for example with the person's explicit consent after being told of the possible risks.

Before processing, controllers must also register in the Data Controllers Registry (VERBİS) under article 16 unless the Board has exempted them; check the Authority's registry exemptions for your situation.

Can you use AI note takers or transcription?

Yes, with the candidate's consent to the recording, notice of the tool and vendor, a transfer basis for any vendor outside Turkey, and short retention. Ask the vendor where it stores and processes audio and transcripts, whether it keeps audio, whether it will sign the Board's standard contract, and whether it trains models on your interviews. The Authority's guides page includes a guide on generative AI and personal data protection. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews in Turkey

Başlamadan önce: Cevaplarınızı doğru kaydedebilmek için görüşmemizi
[ses kaydına almak / bir yazılımla yazıya dökmek] istiyorum.
[Kaydı / Yazılı dökümü] yalnızca bu işe alım süreci için kullanacağız,
yalnızca [müşterimizle / işe alım yöneticisiyle] paylaşacağız ve süreç
bittikten [süre] sonra sileceğiz. Kişisel verilerinize ilişkin
aydınlatma metnini size [e-postayla] gönderdik. Kayda almama onay
veriyor musunuz? Hayır diyebilir veya istediğiniz an durdurmamı
isteyebilirsiniz; bu, başvurunuzu etkilemez.

(Before we start: I'd like to [record / have software transcribe]
our conversation so I capture your answers accurately. We'll use the
[recording / transcript] only for this hiring process, share it only
with [our client / the hiring manager] and delete it [period] after
the process ends. We've sent you our privacy notice [by email]. Do
you agree to me recording? You can say no or ask me to stop at any
time; it won't affect your application.)

The separate notice line reflects article 10; the question reflects article 133(2) and the KVKK's explicit consent rules. More wording is in the interview recording consent script. For a neighboring country with an equally strict rule, see Greece.

Checklist before you record interviews in Turkey

• Candidate's consent to the recording obtained before it starts, specific to this process, with the time noted.
• Article 10 notice sent separately, naming any client or vendor who receives the recording.
• Processing ground documented for the recording and for your notes.
• Recruiters told in specific terms if their calls are recorded or analyzed; access limited and logged.
• Requests answered within 30 days; automated scoring kept under human review.
• Retention period set; audio deleted on schedule.
• Vendor abroad covered by an adequacy decision or a standard contract notified within five business days.
• VERBİS registration checked.