Last updated: 2026-10-19
The meeting invitation looks ordinary: a customer onboarding call, four colleagues and one unfamiliar attendee called “Meeting Assistant.” Someone added it to save time. Before the discussion starts, the host needs to decide whether it can stay.
Allow an AI note-taker only when you can explain why it is needed, what it captures, where the information goes and who can use the result. Restrict it when specific controls make the proposed use acceptable. Keep it out when a necessary legal condition, provider fact or safeguard remains unresolved.
This decision tree is for teams working in or with Türkiye, with additional GDPR checks where that law applies. The traffic-light outcomes are recommended operating rules, not legal classifications or a regulator’s approval.
Work through these questions for the actual meeting and the exact product feature. An approved video platform does not automatically mean every AI feature, integration or participant’s personal account is approved.
“Stop” means do not use the tool for this meeting as currently proposed. A later review may reach a different result.
A “weekly team sync” might contain an employee’s medical explanation for an absence. A “customer demo” might expose identifiable users in a live support dashboard.
Before the meeting, identify what is reasonably likely to be discussed:
These groups describe operational risk. Commercial confidentiality and special-category personal data are different issues, and either can prevent the proposed use.
Include people who will never join the call. A transcript can identify a customer’s employee, an unsuccessful applicant or a colleague mentioned by name. Everyone present agreeing to the tool does not settle how those other people’s data may be used.
If the agenda changes during the call, pause or remove the assistant before continuing. Check what “pause” actually stops: live capture, transcription, recording and other enabled features may have separate controls.
Ask the provider and your administrator to identify which of these activities occur:
Disabling the recording file does not establish that no personal data is processed. A summary can require live audio processing and a transcript even when no replayable recording is saved.
Conversely, separate checks do not necessarily require six different consent forms or six different legal bases. The task is to identify and justify the actual purposes and operations. A later use for staff scoring needs its own assessment; approval to produce project actions does not automatically cover it.
“Improve productivity” is too broad to guide settings. A more useful purpose is: “Produce a draft action list for this implementation meeting, for the named project team to verify.”
Under KVKK, identify the applicable Article 5 processing condition for ordinary personal data. Consent is one possibility; other conditions may apply where their requirements are met. If relying on legitimate interests, explain why the processing is necessary and how it avoids harming individuals’ fundamental rights and freedoms. Convenience alone does not answer that question.
Where GDPR applies, establish the relevant Article 6 basis too. A signed service or employment contract does not make recording every conversation necessary to perform it.
If relying on consent, provide a genuine choice and a workable way to refuse or withdraw. For an optional note-taker, that could mean continuing the same meeting with human-written notes. Silence, attendance or an invitation acceptance should not be treated as affirmative consent.
Health information, trade-union membership and other categories listed in KVKK Article 6 require an applicable special-category processing condition and the Board’s prescribed safeguards.
The current Article 6 includes processing necessary to fulfil legal obligations in employment, occupational health and safety, social security, social services and social assistance. This does not mean that any HR meeting can be sent to an AI provider. The proposed capture and disclosure still need to fit the condition and remain proportionate.
Where GDPR applies, special-category processing needs an Article 9 exception alongside the Article 6 basis. The two laws’ category lists are not identical.
For a sickness-absence discussion, ask whether a limited record of an agreed workplace adjustment would meet the need without recording the employee’s full account.
In Türkiye, Article 419 of the Turkish Code of Obligations limits employers’ use of worker data to information related to suitability for the job or necessary for performance of the employment contract, while preserving special statutory provisions.
There is also a current communications-monitoring issue. The Board’s principle decision dated 16 September 2026, numbered 2026/2035, addresses employer monitoring of work communication channels. It requires attention to lawful processing, specific information for employees, proportionality and less intrusive methods.
That decision is not a dedicated AI note-taker ruling. Its relevance should be assessed where meeting capture or subsequent analysis functions as employee monitoring. Turning routine summaries into a searchable archive for disciplinary or performance scrutiny materially changes the proposed use.
Employee consent also needs care because of the power imbalance. Under GDPR, consent will usually be unsuitable for employment processing where workers cannot refuse without adverse consequences. Applicable national employment rules and collective agreements may impose further requirements.
For disputed monitoring, sensitive HR meetings or uncertainty about recording and confidentiality rules, obtain advice from qualified counsel before enabling capture.
Collect evidence for the purchased plan, enabled feature and actual account. A website statement about an enterprise product may not describe a free account an employee connected to their calendar.
Keep a short approval file containing:
Check contractual assistance with deletion, individual rights and incidents. For a provider acting as your GDPR processor, the contract must satisfy Article 28. If your business is itself a processor for a customer, check the customer’s instructions and required subprocessor authorization before adding the service.
“No training” answers only part of the question. For example, Zoom’s meeting-summary documentation says communications-like customer content is not used to train Zoom or third-party AI models. The same documentation explains that relevant data may be sent to third-party models to provide the feature and may be processed in US data centres. Its separate transcript controls also show why retained transcripts and later uses need checking.
This is an illustration of distinct processing activities, not a product endorsement. Verify the documentation and configuration when making your own decision.
For transfers governed by KVKK Article 9, first establish the relevant processing condition. Then check for an applicable adequacy decision or an appropriate safeguard. In the absence of adequacy, the safeguard route also requires that individuals can exercise their rights and access effective legal remedies in the destination country.
One safeguard is the Board’s standard contract matching the parties’ controller/processor roles. A generic DPA or EU standard contractual clauses alone do not replace that Turkish instrument. Where the Turkish standard-contract route is used, notify the Authority within five working days after signatures are completed.
The fallback exceptions are for occasional transfers under specified conditions. Routine overseas processing of a recurring meeting should not be designed around a blanket transfer-consent checkbox.
Map more than storage. Overseas model processing and access by a separate overseas support provider can also matter. Review onward transfers to model providers and other subprocessors. A domestic storage setting does not by itself resolve every transfer.
Where GDPR also applies, assess its Chapter V transfer requirements separately. An arrangement acceptable under one regime does not automatically satisfy the other.
The host needs a configuration they can operate, rather than a policy that assumes the product behaves a certain way.
Give useful notice before capture. Explain the responsible organization, purpose, collection method, legal basis, recipients and applicable rights. KVKK’s notice obligation applies even when processing relies on a condition other than consent. Link to the relevant fuller notice in the invitation and explain the feature again at the start for late or unexpected attendees.
Also explain the practical details people need: whether audio is retained, who receives the notes, how long each output is kept and how to raise a concern. The platform’s generic “AI enabled” banner may not provide the required information.
Control distribution. Start with a named, restricted audience. Check whether automatic sharing includes everyone invited, external guests or people who did not attend. Turn off public links and unnecessary CRM, chat and knowledge-base exports. Decide who can download the transcript as well as who can view it.
Set retention by output. The raw recording, transcript and verified action list may have different needs. Do not keep all three for the longest available period simply because the tool allows it. Test deletion, including trash, provider backup handling and exported copies. Preserve material subject to an applicable legal hold or other retention obligation.
Assign a reviewer. Have someone check names, speaker attribution, amounts, deadlines and whether a suggestion was actually agreed. Treat the AI summary as a draft until reviewed. Provide a correction route and update downstream copies where needed. Do not let an unverified sentence become a customer commitment or an employee performance finding.
For a GDPR-covered rollout likely to create high risks to individuals, complete a data protection impact assessment before processing. The obligation depends on the proposed processing and applicable criteria; using an AI feature does not automatically settle that assessment.
A recurring implementation meeting covers project actions. The organization has already assessed the provider, legal grounds and transfers. Participants receive appropriate information, access is restricted, retention is configured and a project owner verifies the notes.
The host confirms that this meeting fits that approval and enables the agreed feature. Green still depends on those controls remaining in place.
A customer onboarding call includes a troubleshooting segment involving identifiable users. The provider and legal prerequisites are already approved, but capturing the whole agenda would exceed the intended scope.
The team separates the sensitive segment, keeps the assistant off during it, disables automatic external distribution and shares only a checked action list with approved recipients. Amber applies once those controls are implemented and verified.
An employee brings a personally subscribed assistant to a grievance discussion. The organization cannot verify its recipients, retention or transfer arrangement, and has not established the required processing conditions.
Remove the assistant and use the approved alternative. Resolve the missing evidence and legal questions before considering later use.
These are hypothetical examples. A meeting label alone never determines the result.
Choose one recurring meeting with a limited, predictable agenda. First test settings and deletion with invented content. Then, once the prerequisites are satisfied, run the approved configuration in the selected meeting.
Keep a brief decision record: meeting purpose, permitted data, tool and feature, processing basis, transfer route, notice, recipients, retention, reviewer and outcome. Note any extra restrictions and who owns them.
After the pilot, check whether the notes saved useful work, whether unexpected information was captured and whether sharing, correction and deletion behaved as expected. Reassess when the agenda, participants, provider terms or settings change.
A successful pilot supports approval for comparable meetings. It does not establish suitability for recruitment, health or disciplinary discussions.
If the exercise exposes gaps in provider evidence, notices or data-flow mapping, Kooch’s KVKK & GDPR Gap Analysis can assess agreed practices and help prioritize improvements. Contact Kooch to discuss the meeting workflow and the scope of support you need.
Reviewed on 19 October 2026. The decision tree and examples are practical recommendations applying the sources below; they are not an official regulator-issued test.
