Units
1. Introduction to Artificial Intelligence in Call Center and Customer Experience: Roles, Boundaries, Authentication and Privacy 2. Voice and Text Bots: IVR, Chatbot and Voicebot Design 3. Conversation Design and the Virtual Assistant: Intent, Dialogue, and Natural Experience 4. Call Summary and Auto-Tagging: Reducing Wrap-up to Seconds 5. Knowledge Base and RAG: How Bot and Agent Find the Correct Answer 6. Agent Assist: Real-Time Help 7. Sentiment Analysis and Quality Management: QA with Speech Analytics 8. Self-Service and Automation: Customer Self-Solving 9. Data Privacy, Security and Compliance: KVKK, PCI-DSS and Masking 10. Escalation and Human-Artificial Intelligence Collaboration 11. Measurement, KPI and Continuous Improvement: What to Monitor and How? 12. Building an End-to-End CX-AI Program: Integration and Governance
Unit 9 / 12

Data Privacy, Security and Compliance: KVKK, PCI-DSS and Masking

Gains:

  • Ability to establish a secure AI flow with the principle of minimization, without masking sensitive data at the source and never transmitting the card number
  • Ability to control masking with a separate authentication layer and choose tools that are enterprise, DPA-enabled and do not use data in training
  • Ability to use tools only for authorized, defensive and consensual purposes while maintaining transparency with the customer

The call center is the place where the most intense personal data flow of the organization occurs. Name, phone number, address, TR ID, order history, health information, and even payment card number may be mentioned in every conversation. Relaxing even for a moment while processing this data into artificial intelligence will lead to both serious legal sanctions (KVKK fines can reach millions of liras, GDPR fines can reach a percentage of turnover) and irreversible loss of customer trust. This unit is the security foundation that sits on top of all previous units: no matter how smart a bot, summary, analysis or assistant is, it cannot be used if it does not handle data securely.

In this unit, we will cover three main topics: data privacy (protection of personal data — KVKK/GDPR), payment security (PCI-DSS) and masking/redaction (hiding sensitive data before giving it to artificial intelligence). Additionally, in terms of IT security, we will emphasize the only authorized and defensive use of these tools.

Basic concepts and legal framework

KVKK (Personal Data Protection Law) regulates the processing of personal data in Türkiye; GDPR is the European equivalent. According to these laws, personal data can only be processed securely and as necessary for a specific, legitimate purpose. Information such as health, religion and biometrics are special personal data and are extra protected. PCI-DSS (Payment Card Industry Data Security Standard) determines how card data is processed; It is one of the strictest rules and prohibits unnecessary storage/transmission of the full card number.

A few critical concepts in the context of artificial intelligence:

  • Masking / redaction: Hiding / deleting sensitive data (name, ID, card, phone) before giving it to artificial intelligence. "[CUSTOMER]" instead of "Ahmet Yılmaz", "[CARD]" instead of card.
  • Data minimization: Sharing only as much data as the business requires. Not including the full address in the summary unless it is required.
  • Data residency: In which country/server the data is processed; Some data cannot go abroad.
  • Data processing agreement (DPA): A contract that specifies how the AI ​​tool you use will process the data, not store it, and not use it in model training.
  • Consent and purpose: The necessary information and legal basis for the processing of conversation recordings.
Attention: It is not enough to say "I masked personal data"; It is necessary to verify that masking is working. Automatic masking can sometimes miss a name or card number. Inspect by sampling masking output on high-risk streams.

Secure architecture: where and how to process data?

When introducing AI into the call center, the following layers of security should be established:

  1. Masking at source: Personal/card data is automatically masked before the transcript goes to the AI. Card numbers are never entered into the model in their raw form.
  2. Corporate tool selection: Corporate tools that do not use your data in model training, DPA signed, and data residency guaranteed are preferred. Customer data is not entered into free publicly available tools.
  3. Access control: Who can access which data is recorded (audit log). Unauthorized access is prevented.
  4. Storage limit: Data is stored only for as long as necessary; unnecessary records are deleted.
  5. Transparency: The customer knows that his conversation is being recorded/processed and that he is talking to the bot.

The following table compares safe and risky practice:

Subject

Risky practice

Secure application

Vehicle selection

Free tool available to everyone

Corporate, DPA, not used in education

card data

Raw pasting into text

Never; masked/[CARD]

personal data

Share as it is

Masking + minimization

storage

Indefinitely

Purpose limited, deletion policy

Access

everyone

Authorized, logged

transparency

secret recording

Lighting + information

Step by step: a safe AI flow of data

  1. Classify: Which data fields are sensitive (TC, card, health, address)? Mark these in advance.
  2. Mask: Apply automatic masking before going to AI; Never forward the card.
  3. Minimize: Don't send more than the job requires.
  4. Verify: Check by sampling if there is any data missed by masking.
  5. Contract and retention: Confirm the vehicle's DPA, data residency and retention period.
  6. Monitor and audit: Log access, conduct regular security audits.

Four copyable templates

1) Masking (redaction) request:

Find and mask the following personal data in the text below: name-surname → [CUSTOMER], TR ID → [IDN], phone → [PHONE], card number → [CARD], address → [ADDRESS], e-mail → [EMAIL]. Give the masked text; Also list how many and what types of data are masked. Also mask an area you are not sure about (safe side). Text: <<...>>

2) Masking verification (leak scanning):

The text below should be masked. Is there STILL any visible unmasked personal/card data left inside? (name, ID, phone, card, address, e-mail) List what you found; If there is none, say "clean". Don't change the text, just inspect.Text: <<masked text>>

3) Data minimization control:

For the following AI prompt/output, check the personal data fields that are NOT REQUIRED based on the business purpose. Purpose: <<eg. call summary>>.Which fields can be extracted? Suggest a simplified version that does the same job with minimum data.Content: <<...>>

4) Vehicle/compliance pre-checklist (registration):

Before using a new AI tool in a call center, produce a compliance note by answering these questions:- Is data processed domestically? - Is it DPA signed? - Is the data used in model training? - Storage period? - Is the card data processed? PCI-DSS coverage? - Is access logged? Mark missing/risky items as "cannot be used without approval".

Weak prompt / Strong prompt

Weak prompt:

Summarize this call record: "Ahmet Yılmaz, TC 12345678901, kart5312 3456 7890 1234, address Bağdat Cad No 5, objected to his invoice."

Serious violation: raw name, ID and card number go to a public tool; PCI-DSS and KVKK violation.

Powerful prompt:

Summarize the following masked call: "[CUSTOMER] has been verified with [IDN], [CARD], [ADDRESS] and has objected to his invoice." Keep the summary anonymous; Do not generate or request any personal/card data.

Difference: data masked, minimized, summary anonymous; no violation.

three mini cases

Case 1 — Correct masking. In an insurance center, 8,000 call transcripts were analyzed daily. The transcripts were passed through an automatic masking layer before going to the AI; Name, TR ID number, policy number and health information were masked and the masking output was inspected with daily sampling. The analysis retained all its value, no personal data went raw into the model. Security and benefit were achieved together.

Case 2 — Card data breach. An e-commerce employee uploaded call recordings with full card numbers into a public tool to analyze payment issues. This violated the most fundamental rule of PCI-DSS (not transmitting card data to unauthorized media); There was a risk of serious findings and penalties during the audit. The correct way was to completely mask the card data at the source and only analyze the "Payment with [CARD] failed" information.

Case 3 — Masking leak. At a bank, automatic masking missed several ID numbers written in an unusual format. Luckily, the "2) Masking verification" step was in effect, so the leaks were caught and corrected before analysis. Lesson: masking alone is not enough; Authentication layer is required. Single layer, like human error, is a single point failure.

Common mistakes

  • Pasting the raw data into the tool. Name, ID, card and address should not be entered into any AI vehicle without being masked.
  • Process card data. The full card number is never entered into the model input; PCI-DSS prohibits this.
  • Driving in public. Customer data is not given to tools that do not have DPA and use the data in training.
  • Not verifying masking. Automatic masking may be missed; There must be a sampling/validation layer.
  • Skipping transparency. The customer must know that the recording is being processed and talking to the bot; Covert processing is both unethical and illegal.
  • Storing too much data. Data kept after the purpose is over is just a risk.
Caution (information security): All techniques in this unit are valid only for authorized, defensive purposes and for your own organization's data. Using speech analytics, voice recognition and data processing tools to monitor unauthorized persons, access someone else's data or record without consent is both illegal and against professional ethics. No data is processed without authorization, purpose and consent.

In summary

Data privacy, security and compliance; is the non-negotiable ground of call center AI. KVKK/GDPR protects personal data, PCI-DSS payment card; Violating either brings severe sanctions and loss of trust. Mask sensitive data at the source without giving it to the AI, never pass the card number, share only as much data as necessary (minimization), be sure to verify the masking, and choose only enterprise, DPA-enabled tools that do not use the data for training. Be transparent with the customer and use all tools only with authority, advocacy and consent.

Application task

List 5 different data fields that could go to the AI ​​in your call center scenario (e.g. name, ID, card, address, health information) and determine which masking tag you will use for each. Write an imaginary raw transcript and apply the "1) Masking" and "2) Masking verification" templates. Finally, for an AI tool you have recently used (or are considering using), produce a compliance note with the "4) Tool/compliance preliminary checklist" template and mark the missing/risky items.

checklist

  • [ ] I mask sensitive data at the source (name, ID, phone number, address) without giving it to the AI.
  • [ ] The full card number is never included in the model entry (PCI-DSS).
  • [ ] I only share as much data as the job requires (minimization).
  • [ ] I control masking with a separate authentication layer.
  • [ ] I only use corporate, DPA-enabled tools that do not use data in education.
  • [ ] I am transparent with the customer about recording/processing and talking to the bot.
  • [ ] I use tools only for authorized, defensive, and consensual purposes.
Previous Next