Does having KVKK documents at your company mean that you are fully compliant with the Turkish Personal Data Protection Law?
When the Personal Data Protection Law (KVKK) is mentioned, many companies think of a privacy notice on their website or signed employee documents.
The compliance process is, however, much broader.
A company may face legal, technical and organisational obligations when processing the personal data of employees, customers, job applicants, suppliers and visitors.
What are the main issues companies should consider under the KVKK?
1. Identify the personal data the company processes
The first step in a compliance review is to identify which personal data is processed within the company.
This may include employees’ identity and contact information, personnel files, bank accounts and medical reports; customers’ telephone and email details; CCTV images, visitor records and CVs received with job applications.
It is important to establish not only what is collected, but why it is collected, where it is stored, who can access it, to whom it is transferred and how long it is retained.
2. Prepare company-specific privacy notices
Changing the company name on a standard KVKK text found online is not always sufficient.
A construction company, hotel, vehicle rental business, restaurant and e-commerce company may process different personal data through different procedures.
The necessary notices for employees, applicants, customers, visitors and other data subject groups should therefore be prepared by reference to the company’s actual activities.
3. Distinguish when explicit consent is required
One significant mistake is attempting to obtain explicit consent for every processing activity.
Explicit consent is not the only legal basis for processing personal data under the KVKK. Consent may not be required where another statutory processing condition applies.
The company’s activities should therefore be examined individually to identify the legal basis for each operation.
The obligation to inform must also be distinguished from the requirement to obtain explicit consent.
4. Review employee data and personnel files
Human resources is one of the areas in which companies process the most personal data. Identity document copies, personnel files, bank information, medical documents, criminal records, leave documents and performance records may all be held within a company.
It is not appropriate to retain all these documents indefinitely or make them accessible to everyone in the organisation.
The purpose of obtaining each document, its retention period and authorised access should be determined.
5. Review camera and audio recordings
Workplace camera systems are commonly used for security.
Their presence does not mean that a company may record images or sound without limits.
The purpose of the cameras, their fields of view, recording retention periods and authorised users should be assessed.
Audio recording in particular is a separate processing activity that requires its own assessment and may create significant proportionality risks.
6. Review relationships with suppliers, subcontractors and service providers
Companies do not necessarily process personal data solely within their own organisation.
They may share personal data with accountants, human resources companies, software providers, call centres, subcontractors or other service providers.
In such cases, each party’s role must be determined and the necessary KVKK provisions, confidentiality obligations and contractual data security arrangements put in place.
7. Provide KVKK training to employees
Employee awareness is one of the most important elements of compliance.
Even if all contracts and documents are complete, an email sent to the wrong recipient, an unattended personnel file or customer information shared with an unauthorised person can create a data security problem.
Employees should be made aware in particular of:
- personal data protection;
- sharing data through email and WhatsApp;
- not sharing customer information with third parties;
- protecting personnel files;
- strong passwords and access security;
- storing company documents on personal devices;
- avoiding uncontrolled uploads of customer, employee or company documents to artificial intelligence applications.
Awareness in these areas is important.
Our law office therefore also provides KVKK awareness and compliance training tailored to companies’ activities and employees’ duties.
8. Determine retention periods
The lawful collection of personal data does not mean that it may be retained indefinitely. Deletion, destruction or anonymisation procedures must be assessed when the reason for processing ceases to exist.
Companies should therefore review their physical and digital archives periodically.
9. Check the VERBİS registration obligation
The same conclusion should not be applied automatically to every company.
Whether a company must register with the Data Controllers’ Registry (VERBİS) must be assessed separately under current legislation and decisions of the Personal Data Protection Board.
Where registration is required, the personal data processing inventory and VERBİS declarations should accurately reflect the company’s actual processing activities.
10. Update compliance arrangements regularly
KVKK compliance is not a process that ends once documents have been prepared and never needs to be reviewed again.
A new employee monitoring system, a change to cameras, a new subcontractor, a redesigned website, an overseas service provider or AI applications introduced into business processes may all create new processing activities.
Companies’ KVKK procedures should therefore be reassessed periodically.
Have you reviewed your company’s KVKK procedures?
Compliance involves more than obtaining signatures on a few standard texts.
The company’s current operations must be examined, risks identified and legal documentation aligned with actual practice.
Our law office provides legal advice to companies on:
KVKK compliance and current-state reviews; company-specific privacy notices and explicit consent texts; KVKK provisions in employee and supplier contracts; updating existing agreements; reviewing personnel and camera procedures; assessing retention and disposal processes; website KVKK and privacy texts; and employee training.
Even where a company has previously undertaken compliance work, checking periodically whether the documents reflect current operations is important for identifying legal risks and potential data breaches in advance.
The KVKK concerns not only documents to be prepared, but a personal data protection system that must be applied continuously within the company.