Corporate Obligations under the Turkish Data Protection Law (KVKK)

The Personal Data Protection Law No. 6698 (KVKK) defines every natural or legal person who processes personal data as a “data controller”. Almost every company processing employee, customer, supplier or visitor data falls within its scope.

1. Duty to inform

When personal data is collected, data subjects must be informed of the controller’s identity, the purposes of processing, to whom and why data may be transferred, the method and legal ground of collection, and their rights (Article 10). The privacy notice must be kept separate from any consent form.

2. Legal grounds and explicit consent

Explicit consent is neither the only nor always the best basis for processing. Relying on consent where performance of a contract, a legal obligation or legitimate interest is available can stall a process if consent is withdrawn.

Compliance is not a set of documents; it is a management system sustained by a data inventory, policies and training.

3. Data security

Controllers must take technical and organisational measures that provide an appropriate level of security against unlawful processing and access (Article 12). Access matrices, logs, encryption and confidentiality undertakings are the starting point.

4. VERBİS registration

Controllers that exceed the employee and annual balance-sheet thresholds set by the Board, or whose main activity is processing special categories of data, must register with the Data Controllers’ Registry (VERBİS). Registration should be based on an up-to-date data inventory.

5. Data subject requests

Requests must be answered free of charge within thirty days at the latest (Article 13). Preparing request channels and response templates in advance helps avoid missed deadlines.

6. Breach notification

If processed data is obtained by others unlawfully, the data subjects and the Board must be notified as soon as possible. In the Board’s practice, this period is 72 hours from becoming aware of the breach.