In most companies, KVKK compliance goes like this: a consultant shows up, and two weeks later leaves behind a thick binder full of policies, privacy notices and undertakings. The binder goes on a shelf. Everyone relaxes. Three years later a customer complaint reaches the Board — Turkey’s Personal Data Protection Board (Kurul) — and it turns out that nothing written in that binder has any counterpart in the actual systems: the data that is “deleted after 6 months” has been sitting in the database since 2019, and the table that “only authorized personnel can access” is readable by the entire company.
KVKK — Turkey’s Personal Data Protection Law No. 6698 — does not ask you to produce paperwork. It asks you to actually process data in line with the law. The paperwork is merely the evidence. We look at this from the software side, because that is where the data lives. This post explains, in eight steps, how to build compliance into your systems.
This post is for general information purposes and is not legal advice. We recommend consulting a lawyer about your specific situation.
Concepts First: Who Is Responsible for What?
- Personal data: Any information relating to an identified or identifiable natural person. That covers not just full name and Turkish national ID number, but also IP address, device ID, location data and customer number.
- Special categories of personal data: The categories listed in the law, such as health, biometric data, religion, trade union membership and criminal convictions. The conditions for processing are much narrower and the security expectations much higher.
- Data controller (veri sorumlusu): The party that determines the purposes and means of processing. If you are the one collecting your customers’ data, you are the controller — regardless of which cloud you keep it in.
- Data processor (veri işleyen): A party that processes data on behalf of the data controller: your hosting company, the firm that runs your payroll, your e-mail delivery service.
The critical point: for a mistake made by the data processor, the data controller is also liable before the Board. “The leak wasn’t ours, it happened in the vendor’s system” is not a defense.
Step 1: Data Inventory — The Foundation of Everything
Without knowing what data you hold, why, where, for how long and who you share it with, none of the other steps can be done correctly. The traditional way to build the inventory is through department interviews; but an inventory built only from interviews is always incomplete, because people do not know what the systems actually store.
Our approach works in both directions:
- From process to data: Talk to HR, sales, marketing, support and accounting, and map the business processes.
- From data to process: Scan database schemas, log files, backups, third-party integrations and shared drives. This is the only way you will find out that health information is being typed as free text into the
notesfield of thecustomerstable.
The second method turns up things the first one misses every single time: real customer data in forgotten test databases, application logs that have not been deleted in years, e-mail archives of former employees.
Step 2: Tie Every Processing Activity to a Legal Basis
Article 5 of KVKK lists the conditions under which personal data may be processed: being explicitly provided for by law, the establishment or performance of a contract, legal obligation, legitimate interest, and others. Explicit consent (açık rıza) is only one of them, and most of the time it is the wrong choice.
A mistake we see often is collecting explicit consent for everything. If you process an address in order to deliver an order, your legal basis is the performance of a contract; asking for separate consent for that is unnecessary, and Board decisions have found it unlawful. On top of that, consent can be withdrawn; once it is, you have to stop processing the data.
Write down the basis for each row of the inventory, one by one. Data you cannot tie to any basis is data you should not be collecting.
Step 3: Privacy Notices and Explicit Consent Flows
At the moment you collect data, you have to inform the data subject: who you are, the purpose for which you process the data, who you transfer it to, the method and legal basis of collection, and what their rights are. The privacy notice (aydınlatma metni) is a disclosure, not an approval — which is why the privacy notice and explicit consent cannot be combined in the same text.
We covered this in detail for websites, mobile apps and cookies in a separate post.
Step 4: VERBİS Registration
If your annual number of employees is above 50 or your annual balance sheet total is above 100 million TL, if your core activity is processing special categories of data, or if you are a data controller established abroad, you have to register with VERBİS, the Data Controllers’ Registry Information System. Registration is a publicly accessible declaration of a summary of your inventory — so if your inventory is wrong, your declaration is wrong too.
We explained who is required to register and how the process works in our VERBİS guide.
Step 5: Retention and Destruction — In Code, Not on Paper
The law requires that data be erased, destroyed or anonymized once the reason for processing it no longer exists. Data controllers registered with VERBİS are required to prepare a retention and destruction policy and to carry out periodic destruction.
Writing the policy is easy. The hard part is making the period written in the policy actually work in the system. In practice you will need:
- Fields on your records that let you calculate the retention period (
created_at,contract_ended_at,last_activity_at) - Scheduled jobs that delete or anonymize data whose period has expired
- A lifespan for backups too — a 7-year backup archive makes a mockery of the claim that “we deleted it”
- Logging of destruction operations
-- Anonymize customers whose contract ended more than 10 years ago
UPDATE customers
SET full_name = 'ANONYMIZED', email = NULL, phone = NULL,
national_id = NULL, anonymized_at = now()
WHERE contract_ended_at < now() - interval '10 years'
AND anonymized_at IS NULL;This query is worth more than the legal text, because it actually runs.
Step 6: Technical and Administrative Measures
Article 12 places an obligation on the data controller to “ensure an appropriate level of security”, and the Personal Data Security Guide published by the Authority — the Personal Data Protection Authority (Kurum) — spells out what that means in concrete terms. This is also the article under which the heaviest fines are issued.
Technical side: role-based authorization and an authorization matrix, access logs, encryption (in transit and at rest), a password policy and multi-factor authentication, up-to-date patch management, penetration testing, backups, data masking in test environments.
Administrative side: employee training and confidentiality undertakings, contracts with data processors, periodic review of access rights, a disciplinary procedure, internal audit.
Most of the technical measures are simply what good engineering requires anyway. For the application-side details, see our web application security guide.
Step 7: Data Processors and Cross-Border Transfers
Every SaaS tool, cloud provider and agency you use is a potential data processor. You should have a contract with each of them governing how the data will be protected. If you use a service whose servers are abroad, the matter becomes a degree more serious: with the 2024 amendment to the law, the cross-border transfer regime was rewritten from scratch, and notifying the Authority of standard contracts became mandatory.
We covered what this means for cloud, SaaS and AI tools in our post on cross-border data transfers.
Step 8: Request Handling and a Breach Plan
Two deadlines you should know by heart:
- 30 days: Your time to respond when a data subject applies to access their data or to have it corrected or erased.
- 72 hours: Your time to notify the Board, counted from the moment you become aware of a data breach.
Neither is a deadline to be caught unprepared by. For requests you need a defined channel and a responsible owner; for breaches you need a written and rehearsed response plan. The details are in our post on the 72-hour rule.
The Price of Non-Compliance in 2026
Administrative fines go up every year by the revaluation rate. The amounts applied for 2026:
| Violation | Lower limit | Upper limit |
|---|---|---|
| Breach of the obligation to inform | 85,437 TL | 1,709,200 TL |
| Breach of data security obligations | 256,357 TL | 17,092,242 TL |
| Failure to comply with Board decisions | 427,263 TL | 17,092,242 TL |
| Breach of the VERBİS registration and notification obligation | 341,809 TL | 17,092,242 TL |
| Failure to notify a standard contract | 90,308 TL | 1,806,377 TL |
The fine is the visible part. Board decisions are published, breaches are announced to the public, and enterprise customers now ask about KVKK compliance when choosing suppliers. A lost tender is often more expensive than the fine.
A Realistic Timeline
A typical process for a company with 50-200 employees and a handful of business applications:
- Weeks 1-3: Current-state analysis and data inventory
- Weeks 3-5: Determining legal bases, privacy notices, consent flows, contract addenda
- Weeks 4-6: VERBİS registration, retention and destruction policy
- Weeks 5-12: Implementing the technical measures — authorization, logging, encryption, destruction automation
- Ongoing: Training, annual review, an impact assessment for every new project
The technical measures are the longest item on the timeline and the part that gets postponed most often. Yet that is exactly the part that protects you in an audit or a breach.
Where to Start?
KVKK compliance is not a project you do once and finish; it is a living system that has to be updated whenever a new form, a new integration or a new vendor is added. The way to keep it alive is to keep the legal texts and the technical reality at the same table.
At IWWOMI, this intersection is exactly where we provide KVKK consulting: we build the inventory by scanning your systems, base the documentation on that inventory, and implement the technical measures ourselves. If you want to get clear on where to start, get in touch with us — in the first meeting we will sketch a rough map of where you currently stand.
Sources: Law No. 6698 and secondary legislation — KVKK · Personal Data Security Guide (Technical and Administrative Measures)
