The moment you launch a WhatsApp chatbot for a business in Turkey, you start processing personal data. The customer's phone number, name, order, address, and sometimes a piece of health information like "my tooth hurts" all arrive inside the conversation. The bot reads that message, sends it to an AI model, and saves it somewhere. All of this falls under Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, KVKK), Turkey's Personal Data Protection Law.
This post walks through, in order, the six issues you need to settle before launching a chatbot. It is not legal advice; its purpose is to help you ask the right questions when you talk to your lawyer or your data controller team.
6 issues to settle before launch
Privacy notice
The customer should learn who processes their data and why in the very first message.
Legal basis and consent
A contract is enough for an order; marketing messages need separate consent.
Cross-border transfer
WhatsApp and the AI model are usually abroad; Article 9 comes into play.
Sensitive data
Health information, national ID numbers, card numbers: information the bot should not ask for.
Retention and deletion
How long will conversation logs be kept, and who will delete them?
Human handoff
Meta's rule: the customer must be able to reach a human quickly and clearly.
Article 10 of KVKK requires the data controller to inform people when their personal data is collected: who the data controller is, for what purpose the data will be processed, to whom and for what purpose it may be transferred, by what method and on what legal basis it is collected, and what rights the person has.
In a chatbot, the most practical way to do this is a short sentence plus a link to the privacy notice in the bot's first message:
Hello, I'm the digital assistant of X Business. Your messages are processed to respond to your request. More information: yoursite.com/kvkk
Meta's WhatsApp Business Messaging Policy also requires businesses to obtain the notices, permissions, and consents needed to process personal data and to have a published privacy policy. So if your website doesn't have an up-to-date privacy policy and privacy notice, that comes before the chatbot.
Article 5 of KVKK allows personal data to be processed only on specific grounds. For chatbots, these are the two situations you'll run into most often:
| Responding to the customer's request | Sending marketing messages later | |
|---|---|---|
| Example | Taking an order, booking an appointment, answering a question | Campaigns, discounts, new product announcements |
| Possible legal basis | Usually the formation or performance of a contract | Separate, explicit consent |
| Meta's rule | Reply within the 24-hour window after the customer writes | Explicit opt-in before the message |
| Privacy notice | Required | Required |
| Right to opt out | — | The customer must be able to opt out at any time |
Meta's policy says a business may only message people who have shared their number with it and agreed to receive further messages. The same policy requires honoring every stop, block, and opt-out request a person makes, whether inside or outside WhatsApp. Once a customer has said "don't message me," neither the bot nor the team can send them marketing messages.
In a WhatsApp chatbot, the customer's message usually goes to at least two places: Meta's servers (WhatsApp itself) and the provider of the AI model that generates the reply. These providers' servers are most likely outside Turkey. In that case, Article 9 of KVKK, which governs transfers abroad, comes into play.
Article 9 was amended by Law No. 7499, and the new version took effect on June 1, 2024. Under the new framework, a transfer can be made through one of three routes:
| Route | What it means |
|---|---|
| Adequacy decision | A decision issued by the Personal Data Protection Board (the Board) for a country or sector. |
| Appropriate safeguards | The most common is the standard contract published by the Board. It must be reported to the Personal Data Protection Authority within 5 business days of signing. |
| Incidental transfer | Exceptional cases such as explicit consent; not designed for regular, ongoing transfers. |
At the end of 2024, the Authority opened a notification module (in Turkish) for standard contract notifications. Work out with your lawyer which route fits your situation by looking at the provider's contract options.
For each stop on this journey, ask two questions: where is the data stored, and for how long? The answers to both should also be written into your privacy notice.
Article 6 of KVKK classifies certain data as special categories and subjects it to stricter rules: health, biometric and genetic data, religion, religious sect, political opinion, union membership, criminal convictions, and so on. A chatbot for a clinic, pharmacy, or dietitian can wander into this territory very easily.
Meta's policy sets a separate limit too: businesses may not ask people to share sensitive identifiers such as full card numbers, financial account numbers, or national ID card numbers.
Article 4 of KVKK requires data to be kept only as long as necessary for the purpose for which it is processed. Chatbot conversations, on the other hand, easily pile up forever: on the platform, in the AI provider's logs, in the CRM, in a spreadsheet.
Before launch, put the following in writing:
Article 12 of KVKK also requires appropriate technical and administrative measures for data security: who can see which conversation, who can log into the dashboard, and how passwords and access are managed.
This is Meta's rule, not directly a KVKK rule, but for customer trust it matters at least as much as KVKK. Meta's policy requires businesses that use automation to offer a quick, clear, and direct way to reach a human: transfer to an agent within the chat, a phone number, an email address, a support form, and so on.
I covered which questions should stay with the bot and which should go to a human in the chatbot guide, and the balance between a bot and live support in the post chatbot or live support.
Is my chatbot ready from a KVKK standpoint?
0/7Compare the seven items with your own setup; every item you can't check is a question to ask your lawyer.
In our AI Assistant service, before building the bot, we go through these six issues with you using a checklist: the privacy notice sentence in the first message, which information the bot will not ask for, the human handoff rules, and where and for how long conversations will be kept. We finalize the legal texts together with your lawyer; we don't provide legal advice.
Not in every case. If you process data to respond to the customer's own request (an order, an appointment, a question), you can rely on another legal basis in KVKK, such as the formation or performance of a contract. But a privacy notice is required in every case, and marketing messages need separate consent. Work out with your lawyer which basis fits you.
Messages pass through Meta's infrastructure, and the chatbot is usually connected to an AI provider abroad. That's why the transfer issue comes up in most setups. You need to map which data goes to which provider and determine which of the routes in Article 9 of KVKK you rely on.
That's a different purpose from the original purpose of the conversation. If it isn't stated in your privacy notice and there's no legal basis for it, you shouldn't do it. Also check whether the AI provider you use trains its own model on customer messages.
You can't prevent that, but you can make sure the bot doesn't ask for this information and doesn't process more of it than necessary. In such a message, the bot can hand the conversation to a human without repeating the details, and the retention period for those logs can be kept short accordingly.
Whether you need to register with VERBİS (Turkey's Data Controllers' Registry) depends on the business's number of employees, annual balance sheet, and field of activity, independent of the chatbot. Check against the Board's exemption decisions whether the registration obligation applies to you; if you are registered, add the data processed through the chatbot to your inventory as well.
On September 16, 2026, OpenAI launched the Sponsored Agents pilot in ChatGPT ads, where the brand's own agent takes over the conversation. It's US-only for now; for businesses in Turkey, the real lesson is the handoff moment after the ad.
I explain plainly what a chatbot can and can't do, how to set one up on WhatsApp, and when it might give wrong information. A short checklist helps you see whether your business is ready for a chatbot.
A chatbot and live support aren't rivals; they're a division of labor. Which questions should go to which, how to set handoff rules, and how WhatsApp's 24-hour window affects the decision.
We use cookies to improve the site and measure advertising performance. Analytics and advertising cookies run only if you accept them. Details are in our Privacy Policy and Data Protection Notice.
