End-to-end compliance with Turkish data protection law.

Personal data means any information relating to an identified or identifiable natural person — for example a name, national ID number, telephone number, e-mail address, IP address or location data.

The Personal Data Protection Law No. 6698 seeks to protect people’s fundamental rights and freedoms — above all the right to privacy — when their personal data is processed. Its purpose is to protect the people the data relates to, rather than the data itself.

VERBİS (the Data Controllers’ Registry Information System) is the public registry kept by the Personal Data Protection Authority, in which data controllers subject to the registration obligation register and declare their data processing activities.

As a rule, all data controllers are subject to the registration obligation; however, the Personal Data Protection Board exempts certain data controllers based on criteria such as headcount and annual balance-sheet total. Data controllers whose main activity is processing special categories of personal data may be required to register regardless of these thresholds. Because the current thresholds are set by Board decisions, we recommend that your company’s position be assessed individually.

Article 18 of the KVKK provides for administrative fines where the obligations relating to transparency, data security, compliance with Board decisions, and VERBİS registration and notification are breached. Fine amounts are updated every year in line with the revaluation rate. Certain acts involving personal data may also constitute criminal offences under the Turkish Criminal Code.

A project usually begins with a gap analysis. A data inventory is then prepared, privacy notices, consent forms and policies are drafted, technical and organisational measures are defined and, where required, VERBİS registration is completed. Staff training and periodic reviews form part of the programme so that compliance is maintained.