Services
KVKK Data Protection Compliance
Together with our partner law firm, we run the legal and technical sides of compliance with Turkey’s data protection law (KVKK) as a single project.
Legal texts alone do not make you compliant
KVKK compliance stands on two legs. Privacy notices, contracts and the data inventory take shape on the legal side; access permissions, logs, encryption, backup and destruction take shape on the IT side. When one leg is missing, compliance on paper does not stand up in an audit.
Our partner law firm prepares the legal assessment and the texts; we build and operate what those requirements mean on the IT side. You move forward with one project, one timeline and one point of contact.
KVKK (Law No. 6698) is Turkey’s counterpart to the GDPR. Whether you need KVKK consultancy, help with the compliance process, registration with the data controllers’ registry (VERBIS) or technical measures to protect personal data, we bring law and IT together in the same project.
Sound familiar?
Compliant on paper, not in practice
Most compliance projects end with the documents; what gets asked in an audit or a breach is what the systems actually do.
There is an inventory, but it does not match the systems
The storage locations written in the data inventory differ from the servers and folders where the data really sits.
Data past its retention period is not deleted
The policy states a period, but there is no process or owner that performs the deletion in the systems.
You cannot show who accessed which data
Access logs are not kept, or are overwritten after a few days.
Nobody knows how the 72 hours will work after a breach
The steps for detection, assessment and notification to the Authority are not defined; the time passes in panic.
Employees enter client data into AI tools
With no usage rules, personal data goes to services abroad in an uncontrolled way.
The lawyer and IT do not understand each other
The legal requirement cannot be translated into its technical equivalent; each side assumes the other will do the work.
Scope
What our KVKK consultancy covers
Data inventory and process analysis
Through department-by-department interviews we map where personal data is collected, where it is kept and with whom it is shared.
VERBIS and legal documentation
Together with the law firm we prepare the VERBIS registration, privacy notices, policies and contract annexes.
Technical measures
We implement and document technical measures such as the permission matrix, access logs, encryption, backup and network security.
Retention and destruction processes
We reflect retention periods in the systems and make the deletion, destruction and anonymisation steps operable.
Data breach response plan
We define who does what from breach detection to notification of the Authority, and take on the technical investigation.
Training and periodic review
We deliver employee training and review and report on the state of compliance at regular intervals.
How we work
A predictable process in four steps
We follow the same method on every project, so you know from the start what is being done, when and why.
01
Discovery
We review your current setup, needs and risks, on site or remotely.
02
Planning
We present a clear roadmap covering priorities, scope and timeline.
03
Implementation
We complete the transition without disrupting your work, documenting every step.
04
Ongoing management
We keep improving through monitoring, reporting and regular reviews.
Frequently asked questions
KVKK Data Protection Compliance: frequently asked questions
Do you provide the legal advice yourselves?
No. Our partner law firm prepares the legal assessment and the texts. We build, operate and document what those requirements mean on the IT side.
We have our own legal counsel. Can we still work together?
Yes. We work at the same table as your existing counsel and take on only the technical side.
Is compliance a one-off project?
No. A new piece of software, a new process or a change of staff affects the inventory and the measures. That is why we recommend periodic reviews after the project.
Our employees use tools such as ChatGPT. Is that a problem under KVKK?
If content containing personal data is entered into these tools, yes: it is a data processing activity and in most cases a transfer abroad. In line with the Authority’s guidance on generative AI, we address the usage policy and the updates to notices and the inventory together with the law firm, and we put the technical restrictions in place.
We have already had compliance work done. Do we start again?
No. We review the existing documents, identify the gap between them and practice on the ground, and complete only the parts that are missing.
Get a free IT and security assessment
We review your current setup and send you a short report showing the risks and priorities. We work on site and remotely, across Turkey and abroad; we respond to your request within one business day.