Personal Data Protection and KVKK Compliance

Personal data protection involves more than placing a privacy notice on a website. Employee files, customer records, CCTV images, enquiry forms and cloud services can each involve different processing activities. Their purposes, legal bases, access arrangements and retention periods should be examined separately.

Turkish Personal Data Protection Law No. 6698, commonly referred to as KVKK, requires lawful and proportionate processing for specified purposes with appropriate safeguards. Amendments effective in 2024 and Board decisions issued in 2025 and 2026 make an up-to-date review particularly important for sensitive data, international transfers and privacy notices. This article addresses Turkish law; GDPR compliance is a separate assessment where that regime applies.

Personal data, controllers and processors

Personal data concerns an identified or identifiable individual. Names and telephone numbers are familiar examples, but employee identifiers, device records and identifiable images may also qualify. Keeping information in a business system does not remove its personal character.

The party determining the purposes and means of processing is the data controller. A provider processing on its behalf and instructions may act as a data processor. The labels in a contract do not replace an examination of what each party actually does.

A useful starting point is to identify what is collected, from whom, why it is needed, who can access it, which providers receive it and when it should be deleted.

Consent is not the only legal basis

Article 5 provides grounds beyond explicit consent, including processing expressly provided for by law, necessity for a contract, compliance with legal obligations, establishing or protecting a right, and qualifying legitimate interests.

Information needed to deliver a purchased product and information used to send advertising concern different purposes. A basis supporting one activity does not automatically support the other. Commercial electronic communications may also engage separate legislation.

Where consent is used, it must relate to a specified matter and be informed and freely given. Broad approval for unspecified future processing is not a reliable compliance approach.

Privacy notices and consent must be separated

A privacy notice explains the processing. Consent is one possible legal basis. Processing without relying on consent does not, by itself, remove the duty to inform where that duty applies.

A notice should cover the controller’s identity, purposes, potential recipients and transfer purposes, collection method, legal basis and the individual’s statutory rights. The purpose of processing and its legal basis are distinct information items.

The Board’s Decision No. 2026/347 of 18 February 2026 reiterates that privacy notices and consent texts must be prepared separately. Even when placed on one page, they require separate headings and declarations. Presenting the notice itself as a consent or acceptance document obscures this distinction.

Sensitive data after the 2024 amendments

Health, biometric and genetic data, together with other categories specified by Article 6, are subject to a special regime. Their processing grounds must be assessed separately from those for ordinary personal data.

Amendments effective on 1 June 2024 restructured the grounds for processing these categories. In addition to explicit consent, the legislation provides grounds including express legal provisions, establishing or protecting rights, and necessity for certain legal obligations in employment, occupational health and safety and social-security matters. Each ground has conditions, and the Board’s prescribed adequate measures remain relevant.

Employee health information or biometric access systems therefore require an assessment of necessity and possible alternatives rather than the automatic use of a standard consent form.

Does every organisation have to register with VERBİS?

Registration with the Data Controllers’ Registry and compliance with KVKK are different matters. An exemption from registration does not remove duties concerning lawful processing, notices or security.

The Board’s exemptions take account of employee numbers, annual financial balance-sheet totals and whether the main activity involves sensitive personal data. The general size-based exemption considers together fewer than fifty employees, a balance-sheet total below TRY 100 million and a main activity that is not the processing of sensitive personal data.

Decision No. 2025/1572 of 4 September 2025 also introduced an exemption for certain controllers whose main activity involves sensitive data, where annual employee numbers are below ten and annual balance-sheet totals below TRY 10 million. Other exemptions, calculation rules and current Board decisions must also be checked.

Cloud services and international transfers

International transfers are not limited to emailing a document to a foreign recipient. Data-centre locations, remote support access and sub-processors may also be relevant when mapping a service’s data flows.

Article 9, as amended in 2024, establishes a framework involving processing conditions, adequacy decisions and appropriate safeguards. Standard contracts are one safeguard, not an automatic answer for every transfer. The controller and processor roles must be identified and the appropriate contract model selected.

Where the standard-contract route is used, the contract must be notified to the Authority within five working days of signature. A provider’s statement that it is GDPR-compliant does not establish that all Turkish transfer requirements have been satisfied.

Security, retention and service providers

Legal documents need to match operational practice. Role-based access, strong authentication, updates and backups, access logs, staff training and provider oversight should be considered together.

Provider contracts should address the actual services and clarify access, confidentiality, sub-processing, incident reporting and the return or deletion of information at the end of the relationship.

There is no single retention period for every data category. Applicable statutory requirements and the processing purpose must be considered. When the grounds for processing cease, deletion, destruction or anonymisation may be required. Indefinite retention is not a general solution.

Monitoring employee communications

The Board’s Decision No. 2026/2035 of 16 September 2026 addresses monitoring of corporate communication channels. Employer ownership of an account does not authorise unrestricted content review. Specific advance information, an appropriate legal basis, proportionality, less intrusive alternatives and limited access rights are important.

Termination of employment does not automatically justify keeping the account and its contents accessible indefinitely. Offboarding procedures should address email, device and archive access accordingly.

Requests and breach notifications

Requests from individuals must be handled as soon as appropriate and within thirty days at the latest. Where a response is refused or inadequate, complaint periods include thirty days from learning of the response and, in all circumstances, sixty days from the original application. The sixty-day outer period is also important where no response is given.

Where processed personal data are unlawfully obtained by others, a separate breach assessment is necessary. Under Board Decision No. 2019/10, the controller must notify the Board without delay and no later than 72 hours after becoming aware of the breach. Affected individuals must be informed within the shortest reasonable time after they are identified. The two notifications should not be reduced to a single identical deadline.

A practical starting checklist

• Map data, purposes, legal grounds and the relevant flows.
• Review privacy notices separately from any necessary consent process.
• Assess sensitive information and international transfers specifically.
• Check VERBİS obligations against current exemptions.
• Allocate responsibility for retention, deletion, individual requests and incidents.
• Compare provider contracts and employee access with actual practice.

A workable compliance programme aligns legal documentation with technical and organisational measures. It should be revisited as the organisation’s activities, service providers and data processing change.