Data Protection & Privacy
We manage companies' KVKK and GDPR compliance processes; we prepare data inventories, privacy notices, handle data breach notifications and represent clients before the Turkish Data Protection Authority.
View service detailsCoverage Map
8 topics
- A KVKK Compliance Roadmap for Companies
- Data Breach NotificationIn Preparation
Data breach notification is the notification a data controller must make to the Board and affected data subjects when personal data has been unlawfully acquired. It must be made without delay and within the statutory period.
- VERBIS RegistrationIn Preparation
VERBIS registration is the obligation of data controllers meeting the statutory criteria to register with the system by declaring their personal-data processing inventory. Non-compliance may result in an administrative fine.
- Drafting Privacy NoticesIn Preparation
Drafting privacy notices is the process of preparing the document that informs the data subject of the purpose, legal basis and rights relating to processing. An incomplete or overly generic notice may amount to a failure to fulfil the duty to inform.
- Explicit Consent ProcessesIn Preparation
Explicit consent processes govern how a data subject's informed and freely given consent to the processing of their personal data is obtained. For consent to be valid, it must relate to a specific matter and be given free of pressure.
- Complaint to the Data Protection BoardIn Preparation
A complaint to the Data Protection Board is the administrative application filed with the Board when a request to the data controller is refused or not answered within the statutory period. The Board examines the complaint and may order various measures, including an administrative fine.
- Controller–Processor AgreementsIn Preparation
Controller–processor agreements are contracts setting out the mutual obligations of the parties authorised to process personal data. These agreements should contain clear provisions on data security measures and the allocation of liability.
- Right to Erasure RequestsIn Preparation
Right-to-erasure requests are applications by which a data subject, under certain conditions, asks for their personal data to be deleted or removed from search results. This right is not absolute and is weighed against values such as freedom of expression and the public interest in each case.
Frequently Asked in This Area
How much can the administrative fine be for a KVKK violation?
Violations such as breaching the duty to inform, failing to take data security measures, or non-compliance with Board decisions can attract administrative fines up to the statutory ceiling; the amounts are updated annually.
Learn moreWhat is the difference between a data controller and a data processor?
The data controller is the party that determines the purposes and methods of processing personal data; the data processor is the third party that processes data on the controller's instructions. Each has distinct obligations, which should be clarified by contract.
Learn moreHow can I request the deletion of my personal data?
You may apply to the data controller in writing, or through the methods specified by the Board, requesting deletion, destruction or anonymisation; the data controller must respond to the request within 30 days at the latest.
Learn moreWhat can I do if a company uses my personal data without permission?
You may first apply to the data controller with your request, and if you receive no response or an unsatisfactory one, you may file a complaint with the Data Protection Board.
Learn moreWhat happens if I withdraw my consent?
Withdrawing consent does not render processing carried out before that point unlawful, but the data controller must stop consent-based processing from that moment onward.
Learn moreThe information on this page is provided for general informational purposes only and does not constitute legal advice. Always consult a lawyer about your specific situation.