Call Center Regulations and Customer Communication Rules in Turkey

Introduction

Call center regulations and customer communication rules in Turkey are highly important for telecom operators, banks, insurance companies, e-commerce platforms, healthcare providers, travel companies, SaaS businesses, fintech companies, utility providers, debt collection teams, outsourcing companies and international businesses serving Turkish customers. A call center is not only a sales or support channel. It is a legal communication channel where personal data is collected, customer consent may be obtained, contracts may be concluded, complaints may be received, disputes may be recorded, commercial messages may be sent and sensitive customer information may be processed.

Turkey does not have one single statute called the “Call Center Law.” Instead, call center compliance is governed by a combination of different legal regimes. These include the Turkish Personal Data Protection Law No. 6698, the Regulation on Commercial Communication and Commercial Electronic Messages, the Electronic Communications Sector Consumer Rights Regulation, the Electronic Commerce Law No. 6563, sector-specific rules of BTK, Ministry of Trade rules, İleti Yönetim Sistemi rules, consumer protection law, labor law, banking and finance regulations where applicable, and general contract law.

For businesses, the main legal risk is treating customer calls as informal conversations. In reality, a call center conversation may create evidence, consent, contractual commitment, marketing liability, data protection exposure or consumer complaint risk. For customers, call center interactions may affect subscription contracts, cancellation requests, invoice disputes, personal data rights, marketing preferences, fraud complaints and service quality.

This guide explains the legal framework for call center operations and customer communication in Turkey, focusing on outbound calls, inbound support, commercial electronic communications, call recording, data protection, İYS, telecom consumer rules, outsourcing, complaint handling and practical compliance.

Is There a Specific Call Center Law in Turkey?

There is no single standalone Turkish law regulating all call centers in one unified code. Instead, the legal obligations depend on the purpose of the call, the sector of the business, the type of data processed and the legal relationship with the customer.

For example, a telecom operator’s call center must comply with BTK consumer rules and electronic communications regulations. A bank call center must also consider banking secrecy and financial regulations. An e-commerce company making marketing calls must comply with commercial electronic communication rules and İYS. A healthcare call center must handle health data carefully under KVKK. An outsourced call center processing customer data on behalf of another company must have data processing and confidentiality controls.

Therefore, the correct legal question is not “Which call center law applies?” The correct question is: What is the purpose of the call and which legal regime applies to that purpose?

A call may be a customer service call, a sales call, a marketing call, a debt collection call, a fraud prevention call, a complaint call, a contract approval call, a cancellation call, a technical support call or a data subject request call. Each category creates different legal consequences.

Main Legal Sources

The main legal sources relevant to call centers and customer communication in Turkey include:

Law No. 6698 on the Protection of Personal Data.

The Regulation on Commercial Communication and Commercial Electronic Messages.

The Electronic Commerce Law No. 6563.

The İleti Yönetim Sistemi framework.

Electronic Communications Sector Consumer Rights Regulation.

BTK regulations for telecom operators.

Consumer Protection Law No. 6502.

Distance contracts and subscription contract rules.

Sector-specific regulations for banking, insurance, healthcare and energy.

Labor law rules for call center employees.

General Turkish contract and tort law.

BTK’s consumer website lists the Electronic Communications Sector Consumer Rights Regulation, the Service Quality Regulation, the Number Portability Regulation and the Regulation on Processing of Personal Data and Protection of Privacy in the Electronic Communications Sector among the main consumer-related regulations in electronic communications.

For non-telecom businesses, Ministry of Trade rules on commercial electronic communications are especially important. The Ministry states that the regulation covers commercial communication rules and commercial electronic messages sent through SMS, e-mail and telephone calls.

Customer Service Calls vs. Marketing Calls

One of the most important legal distinctions is between customer service calls and marketing calls.

A customer service call may concern an existing contract, invoice, delivery, complaint, technical support, fraud report, cancellation request, warranty issue or service update. These calls may often be based on contract performance, legal obligation or legitimate interest depending on the circumstances.

A marketing call, by contrast, aims to promote goods or services, increase sales, introduce campaigns, sell a new package, invite the customer to buy a product or encourage commercial engagement. Marketing calls are generally subject to stricter consent and opt-out rules.

Businesses often make the mistake of mixing customer service and marketing. For example, a customer may call to cancel a subscription, and the call center may attempt to sell a new campaign. A bank may call for fraud prevention and then promote a credit card. A telecom operator may call about a technical issue and then offer an additional package. These mixed calls create legal risk if marketing consent has not been obtained or if the customer’s purpose is manipulated.

The safest approach is to define the legal basis and communication purpose before making the call.

Commercial Electronic Communications and Phone Calls

Commercial electronic communication rules apply not only to SMS and e-mail but also to telephone calls. The Ministry of Trade states that the regulation determines the rules for commercial electronic messages made through SMS, e-mail and telephone calls.

The general rule is that commercial electronic communication requires prior consent from the recipient, unless an exception applies. The Ministry explains that approval must be obtained before sending commercial electronic messages and remains valid until the recipient uses the right to refuse. It also states that prior consent is not mandatory for commercial electronic messages sent to the electronic communication addresses of merchants and craftsmen, but if they use the right to refuse, messages cannot be sent without consent.

This rule is directly relevant to outbound call centers. A business cannot freely call consumers for marketing merely because it has their phone number. The business must verify whether valid commercial electronic communication consent exists and whether the person has exercised the opt-out right.

Call center scripts should therefore distinguish:

Existing customer service calls.

Contract-related notifications.

Legal obligation calls.

Fraud or security calls.

Commercial promotion calls.

Campaign calls.

Cross-selling or upselling calls.

Customer satisfaction calls that include promotional content.

If a call includes promotional content, commercial electronic communication rules should be reviewed.

İleti Yönetim Sistemi and Consent Management

İleti Yönetim Sistemi, known as İYS, is central to commercial communication compliance. The Ministry of Trade explains that İYS allows consumers to view, control and reject all commercial electronic communication consents from a single point. The Ministry also states that İYS enables citizens to control SMS, voice call and e-mail preferences, and that citizens may see which businesses hold their mobile phone number and e-mail information, and may change approval or rejection preferences.

For call centers, this means that outbound campaign lists should not be generated only from CRM databases. The company must check whether the customer’s consent status in İYS permits the intended communication. If the customer has withdrawn consent, the business should not continue calling for marketing.

Consent management should be dynamic. A customer may have approved marketing at one time but later withdrawn consent through İYS. A call center that uses old lists may violate the law even if the original consent was valid.

Businesses should maintain:

İYS integration.

Consent source records.

Consent date and time.

Channel-specific preferences.

Opt-out records.

Campaign suppression lists.

Audit logs.

Vendor access restrictions.

Call center staff should not manually override opt-out preferences without a lawful basis.

Can Consent Be Obtained through a Call Center?

Consent may be obtained through a call center in some situations, but strict legal standards apply. The Turkish Personal Data Protection Authority states that explicit consent may be obtained through electronic media and call center channels, but the burden of proof belongs to the data controller. It also emphasizes that explicit consent must relate to a specific subject, be based on information and be freely given. Broad, blanket consent statements are not legally valid.

This is highly important in call center practice. A vague script such as “Do you approve all data processing and communications?” is risky. Consent must be specific. The customer must understand what they are approving. The consent should not be bundled with unrelated matters. The customer should not be pressured into giving consent in order to receive a service unless the processing is genuinely necessary.

For commercial communication consent, the company should clearly explain:

The identity of the service provider.

The communication channel.

The purpose of communication.

The type of messages or calls.

The right to refuse.

How the recipient may withdraw consent.

If consent is recorded by call, the recording should be stored securely and retrievable as evidence.

Call Recording under Turkish Law

Call recording is common in call centers. Businesses often record calls for service quality, dispute resolution, fraud prevention, training, contract evidence, complaint management and regulatory compliance. However, recording a call means processing personal data and sometimes communication content.

Under KVKK, the customer must be informed about personal data processing. The Personal Data Protection Authority explains that data subjects must be informed about the identity of the data controller, processing purposes, transfer purposes, collection method, legal basis and data subject rights when personal data is obtained.

Therefore, a call center should inform callers that calls may be recorded and explain the purpose. A short message at the beginning of the call may be necessary, but it may not always be sufficient by itself. The business should also have an accessible privacy notice explaining call center data processing in more detail.

Call recording should be proportionate. A company should not keep recordings indefinitely without a lawful retention policy. Access to recordings should be limited to authorized personnel. Recordings should not be used for unrelated purposes such as unauthorized marketing, employee profiling beyond lawful limits or sharing with third parties without a valid basis.

Aydınlatma Obligation and Call Center Scripts

KVKK’s aydınlatma obligation is one of the most important requirements for call centers. The Authority states that data subjects must be informed in every case where their personal data is processed, regardless of whether processing is based on explicit consent or another legal ground.

The 2026 principle decision of the Personal Data Protection Board is especially important. It states that aydınlatma must be fulfilled before processing begins, regardless of whether the processing is based on explicit consent or another legal ground. It also states that if processing is based on explicit consent, the aydınlatma text and explicit consent text must be prepared separately under different headings; if processing is based on another legal ground, only aydınlatma should be provided and explicit consent should not be requested unnecessarily.

For call center operations, this means that scripts must be legally structured. The caller should not be forced to “approve” the privacy notice. Acknowledging receipt of information is different from giving explicit consent. The call center should not merge the privacy notice, marketing consent and service approval into one confusing sentence.

Good call center scripts should separate:

Call recording notice.

Privacy notice.

Identity verification.

Service purpose.

Commercial communication consent.

Contract approval.

Marketing opt-in.

Survey consent.

This separation reduces legal risk and improves evidentiary quality.

Processing Customer Data in Call Centers

Call centers process many categories of personal data. These may include names, phone numbers, customer IDs, identity numbers, addresses, e-mail addresses, subscription information, invoice data, payment records, call recordings, complaint details, transaction history, IP addresses, device information, location information, health information, financial data and voice data.

The legal basis depends on the purpose. For example, processing identity data to verify the customer may be necessary for contract performance or legal obligation. Processing call recordings for dispute resolution may be based on legitimate interest in some cases, provided the balance test is satisfied. Processing data for marketing may require consent or commercial communication approval depending on the activity.

A call center should never collect excessive information. If a customer calls to ask about delivery status, it may be unnecessary to request a full identity number. If a customer calls for general information, it may be unnecessary to access the entire customer profile. Data minimization should be embedded into call center software and scripts.

Identity Verification during Calls

Identity verification is necessary in many call center transactions, especially in telecom, banking, insurance, healthcare and subscription services. However, verification must be proportionate. Asking too many sensitive questions may create privacy risk, while weak verification may enable fraud.

A call center should verify identity according to transaction risk. Low-risk information may require basic verification. High-risk transactions such as SIM replacement, password reset, address change, bank transfer instruction, insurance cancellation, medical data disclosure or subscription termination may require stronger verification.

Call center systems should avoid displaying unnecessary personal data to agents. For example, agents may see masked identity numbers or partial data unless full access is necessary. Sensitive transactions should require additional approval or multi-factor authentication.

Businesses should train agents not to disclose personal data to callers until identity is properly verified. The KVKK Board has sanctioned a case where a bank’s call center-related process resulted in the unlawful sharing of a person’s name, surname and phone number with a third party; the Board found a data breach and imposed an administrative sanction for failure to meet data security obligations.

Outbound Sales Calls

Outbound sales calls are among the highest-risk call center activities. They may trigger commercial electronic communication rules, consumer law, unfair commercial practice rules and KVKK obligations.

Before making outbound sales calls, the company should verify:

Whether the recipient is a consumer, merchant or craftsman.

Whether valid commercial communication consent exists.

Whether the recipient has opted out through İYS.

Whether the number was obtained lawfully.

Whether the campaign script is accurate.

Whether the agent can prove the consent source.

Whether the call will be recorded.

Whether the product is regulated.

Whether additional sector rules apply.

The Ministry of Trade states that commercial electronic communication approval must be obtained before sending such communications and that approval cannot be requested by sending a commercial electronic message to the recipient’s electronic communication address.

This means that calling a person merely to ask “Do you consent to marketing calls?” may itself create risk if the call is commercial in nature. Businesses should design consent acquisition carefully.

Inbound Customer Service Calls

Inbound calls are generally less risky than unsolicited outbound marketing calls because the customer initiates the communication. However, inbound calls still require compliance. The agent may process personal data, access customer records, record the call, solve a complaint, make a tariff change, sell an additional service or obtain consent.

A common risk occurs when an inbound service call becomes a sales call. If the customer calls for support and the agent promotes a new product, the communication may become commercial. Businesses should decide whether such upselling is permitted only where valid marketing consent exists.

Inbound calls also create evidence. A customer may request cancellation, object to an invoice or report fraud. The business should record and process these requests properly. Ignoring a cancellation request or failing to issue a complaint number may lead to consumer disputes.

Telecom Call Centers and BTK Consumer Rules

Telecom operators have sector-specific customer communication obligations. BTK’s consumer portal lists electronic communications consumer regulations, service quality rules, number portability rules and personal data/privacy rules applicable in the sector.

Telecom call centers commonly handle subscription creation, tariff changes, number portability, cancellation, invoice objections, modem issues, internet speed complaints, roaming disputes, SIM replacement, eSIM activation, identity verification, service interruption, value-added services and fraud reports.

In telecom call center practice, the operator should be able to prove:

The customer’s identity was verified.

The customer approved the tariff or campaign.

The customer was informed about commitment terms.

The customer requested cancellation.

The customer objected to an invoice.

The customer approved value-added service activation.

The customer consented to commercial communication, if relevant.

The customer was informed about personal data processing.

BTK’s consumer site also provides a consumer complaint submission channel, showing the importance of formal complaint management in the telecom sector.

Complaint Handling through Call Centers

Call centers are often the first place where customer complaints are received. Complaint handling is not only a customer satisfaction function; it is a legal risk management function.

A proper complaint process should include:

Complaint registration.

Reference number.

Date and time.

Agent identity or system record.

Customer identity verification.

Subject classification.

Evidence collection.

Internal escalation.

Response deadline.

Written response where necessary.

Retention of records.

Regulatory reporting where applicable.

If a customer complains about fraud, data breach, unauthorized transaction, SIM swap, unknown subscription or unlawful marketing, the call center should escalate the case immediately. Low-risk scripts are not enough for high-risk complaints.

Businesses should also avoid retaliatory or misleading communication. A customer who asks to cancel should not be pressured with false information. A customer who asks for data deletion should be directed to the correct KVKK procedure.

Customer Communication in Subscription Contracts

Call centers frequently conclude, amend or terminate subscription contracts. This is common in telecom, utilities, digital platforms, insurance, software and e-commerce services.

Where contract approval is obtained by call, the company should preserve the full approval record. The script should clearly state the service, price, duration, commitment period, cancellation fee, tax, additional charges and key terms. The customer’s approval should be explicit and transaction-specific.

A weak call script such as “Do you approve the campaign?” is not enough if the campaign includes a long commitment period and early termination fee. The customer should understand what they are approving.

For cancellation calls, the business should not impose unreasonable barriers. If the law allows termination through customer service, the agent should not force the customer to visit a branch unless a specific legal reason exists.

Outsourced Call Centers

Many businesses outsource call center operations to third-party providers. Outsourcing does not remove legal responsibility. The customer-facing company usually remains the data controller for many processing activities, while the call center provider may act as data processor.

An outsourced call center agreement should include:

Scope of services.

Data controller and processor roles.

Confidentiality.

Agent training.

Script approval.

Call recording ownership.

Access controls.

Subcontractor restrictions.

Data breach notification.

Audit rights.

Retention and deletion.

Cross-border transfer restrictions.

Information security requirements.

Complaint escalation.

Official request procedure.

Marketing compliance.

İYS checking responsibility.

If the call center provider makes marketing calls, the contract should clearly allocate who verifies İYS consent, who stores proof, who handles opt-out requests and who responds to Ministry of Trade complaints.

Cross-Border Call Centers

International companies may use call centers located outside Turkey to serve Turkish customers. This creates cross-border data transfer issues. Customer names, phone numbers, call recordings, account data, complaint details and transaction records may be accessed abroad.

KVKK cross-border transfer rules must be reviewed where Turkish personal data is transferred or made accessible abroad. Cross-border access by foreign call center agents may qualify as a transfer in practice. Therefore, businesses should assess whether appropriate safeguards, standard contracts, explicit consent or another lawful mechanism is required.

Foreign call centers should also be trained on Turkish customer communication rules. A team operating from abroad may not know İYS, Turkish commercial electronic communication rules, BTK consumer rules or KVKK requirements. Legal compliance should be built into scripts, systems and training.

Employee Monitoring in Call Centers

Call center employees are often monitored for performance, quality and security. Employers may review call recordings, screen activity, login times, break times, call duration, customer satisfaction scores and agent notes. This monitoring involves employee personal data.

Under KVKK, employee monitoring must be lawful, transparent, proportionate and limited to legitimate purposes. Employees should be informed about call recording, performance monitoring, quality review, disciplinary use, data retention and access rights. Excessive monitoring or hidden surveillance may create legal risk.

Call centers should balance business needs with employee privacy. Quality control can be lawful, but continuous intrusive monitoring without proper notice and justification may be disproportionate.

Call Center Data Security

Call centers are high-risk environments for data security. Agents may access customer accounts, payment information, identity data, phone numbers, addresses, subscription records and complaint details. Unauthorized access, insider misuse, weak passwords, screen recording leaks, unencrypted call recordings or insecure remote work can create serious breaches.

Businesses should implement:

Role-based access control.

Multi-factor authentication.

Masked data fields.

Agent activity logs.

Call recording encryption.

Secure remote work rules.

Clean desk policies.

No personal device recording.

DLP controls.

Periodic access review.

Supervisor approval for sensitive transactions.

Fraud detection.

Background checks where lawful.

Incident response procedures.

The KVKK Board’s call center-related decision concerning unauthorized sharing of a person’s name, surname and phone number illustrates that call center data security failures can lead to sanctions.

Call Centers and Fraud Prevention

Call centers are often targeted by fraudsters. Fraudsters may call pretending to be customers and request SIM replacement, password reset, address change, payment card update, e-mail change or account recovery. They may also impersonate companies and call customers to obtain passwords or one-time codes.

Call centers should have fraud prevention protocols. High-risk requests should require additional verification. Agents should never ask for full passwords or one-time banking passwords. Customers should be warned not to share SMS codes. Suspicious calls should be escalated.

In telecom, SIM swap and eSIM activation requests should be treated as high-risk. In banking and fintech, account recovery and device change requests should be carefully verified. In e-commerce, refund and address-change fraud should be monitored.

Retention of Call Records

Call recordings and customer communication records should be kept only as long as necessary for the relevant legal purpose. Retention periods may depend on sectoral rules, limitation periods, regulatory obligations, dispute risk and internal policies.

A company should not keep all call recordings forever. Long retention increases data breach risk and may violate proportionality principles. On the other hand, deleting recordings too early may prevent the company from proving consent, contract approval, complaint handling or fraud reports.

A lawful retention policy should classify calls by type:

Contract approval calls.

Marketing consent calls.

Complaint calls.

Fraud reports.

Technical support calls.

Ordinary information calls.

Sensitive data calls.

Employee training samples.

Each category may have a different retention period. The retention policy should be documented and technically implemented.

Customer Rights and Access to Call Records

Customers may request information about their personal data under KVKK. This may include whether call recordings exist, what data is processed, why it is processed and to whom it is transferred. However, providing actual call recordings may require careful analysis because recordings may include third-party data, trade secrets, security information or other protected content.

A business should have a procedure for responding to data subject requests. The call center should recognize KVKK requests and route them to the privacy team. Agents should not casually promise deletion or disclosure without legal review.

Where a call recording is central to a dispute, the customer may also request it through litigation, consumer proceedings, regulatory complaint or court evidence mechanisms.

Administrative Complaints and Remedies

Customers who receive unlawful commercial calls may file complaints through Ministry of Trade channels. The Ministry states that commercial electronic communication complaints may be submitted electronically through its complaint portal or by petition to provincial trade directorates within three months from the date the communication was sent.

Customers may also use İYS to change approval or rejection preferences. The Ministry states that consumers can change commercial electronic communication preferences through İYS at any time.

For telecom-specific disputes, consumers may use BTK complaint channels. For data protection complaints, individuals may apply to the data controller first and then to the Personal Data Protection Authority under KVKK procedures where applicable.

A customer affected by fraud, unauthorized data sharing, unlawful marketing or identity misuse may need to use more than one remedy at the same time.

Practical Compliance Checklist for Call Centers

Businesses operating call centers in Turkey should follow this checklist:

Classify call types by purpose.

Separate customer service calls from marketing calls.

Check İYS status before outbound marketing calls.

Keep consent records.

Use legally approved scripts.

Provide call recording notices.

Prepare KVKK privacy notices.

Separate aydınlatma from explicit consent.

Avoid blanket consent.

Use proportional identity verification.

Limit agent access to customer data.

Encrypt call recordings.

Define retention periods.

Train agents on KVKK and İYS.

Prepare complaint escalation procedures.

Audit outsourced call centers.

Monitor high-risk transactions.

Prepare data breach response plans.

Keep evidence of approvals and opt-outs.

Review scripts periodically.

Practical Checklist for Customers

Customers should protect themselves by following these steps:

Do not share passwords or one-time codes in calls.

Ask why the call is being made.

Ask whether the call is commercial or service-related.

Use İYS to manage marketing preferences.

Request complaint reference numbers.

Keep screenshots and call times for unlawful calls.

Object to unauthorized tariff or subscription changes.

Request written confirmation of cancellation.

Apply to the company for KVKK rights where personal data is misused.

File complaints with the Ministry of Trade, BTK or KVKK where appropriate.

Legal Risks for Businesses

Call center non-compliance may create several risks:

Administrative fines for unlawful commercial communication.

KVKK sanctions for unlawful processing or data security failures.

BTK complaints and sanctions in telecom services.

Consumer arbitration or court disputes.

Contract invalidity or refund claims.

Reputational damage.

Loss of customer trust.

Evidence problems in disputes.

Liability for outsourced call center misconduct.

Fraud losses from weak identity verification.

A business may lose a dispute not because the customer was right on the commercial issue, but because the business cannot prove consent, approval, information, cancellation handling or lawful data processing.

Conclusion

Call center regulations and customer communication rules in Turkey require a multi-layered legal analysis. There is no single call center law, but call center operations are regulated through personal data protection law, commercial electronic communication rules, İYS, BTK consumer rules, consumer protection law, sector-specific regulations and contract law.

The most important distinction is between customer service communication and marketing communication. Commercial calls require careful consent and İYS compliance. Customer service calls still require KVKK compliance, lawful recording, proper identity verification, complaint handling and data security.

Call recording is legally possible, but it must be transparent, proportionate, secure and limited to legitimate purposes. Explicit consent and privacy notices must not be merged into unclear scripts. The 2026 KVKK principle decision confirms that aydınlatma and explicit consent must be separated and that aydınlatma must be fulfilled before processing begins.

For businesses, call center compliance should be built into scripts, CRM systems, İYS integration, agent training, vendor contracts, recording systems, complaint processes and audit programs. For customers, awareness of rights is essential: unlawful marketing calls, unauthorized subscriptions, data misuse and poor complaint handling can be challenged through İYS, Ministry of Trade complaints, BTK complaints, KVKK applications and consumer remedies.

A compliant call center is not only a customer service tool. It is a legal evidence system, a data protection environment, a marketing compliance gate and a risk management function.

Frequently Asked Questions

Is there a specific call center law in Turkey?

No. Turkey does not have a single standalone call center law. Call center operations are governed by different rules, including KVKK, commercial electronic communication rules, İYS, consumer protection law, BTK regulations and sector-specific legislation.

Are marketing calls regulated in Turkey?

Yes. The Ministry of Trade states that commercial electronic communication rules cover SMS, e-mail and telephone calls. Prior approval is generally required before sending commercial electronic communications to consumers.

What is İYS?

İleti Yönetim Sistemi is the system through which consumers can view, control and reject commercial electronic communication consents from a single point.

Can consumers change call and message preferences through İYS?

Yes. The Ministry states that citizens can use İYS to check and change commercial communication preferences, including SMS, voice calls and e-mail preferences.

Can explicit consent be obtained through a call center?

Yes, but the data controller bears the burden of proof. The Personal Data Protection Authority states that explicit consent may be obtained through electronic media and call center channels, but consent must be specific, informed and freely given.

Must call centers inform customers that calls are recorded?

Yes. Call recording involves personal data processing. Customers should be informed about the data controller, processing purpose, transfer purposes, collection method, legal basis and rights under KVKK.

Can a business combine privacy notice and consent in one script?

This is risky. The 2026 KVKK principle decision states that aydınlatma and explicit consent texts must be separated where processing is based on explicit consent, and aydınlatma must be fulfilled before processing begins.

What happens if a call center shares customer data with the wrong person?

This may constitute a data breach. In a call center-related decision, the KVKK Board imposed an administrative sanction where a person’s name, surname and phone number were unlawfully shared with a third party.

How can unlawful commercial calls be reported?

The Ministry of Trade states that complaints may be submitted electronically through its complaint portal or by petition to provincial trade directorates within three months from the date of the communication.

What is the biggest legal risk for call centers in Turkey?

The biggest risk is lack of proof. If the company cannot prove consent, approval, call purpose, privacy notice, cancellation request handling or complaint response, it may face regulatory, consumer and data protection liability.