When choosing a data protection compliance consultant, judge them on whether compliance will actually reach your systems, not on how many documents they hand over. A good consultant writes the legal texts, but also maps your personal data, builds retention periods and access rights into your systems and rehearses the breach plan. The proposal should spell out deliverables, legal and technical expertise, a processing agreement and ongoing support.
Key takeaways
- Responsibility under KVKK, Türkiye's data protection law, cannot be outsourced: the consultant advises, but the company remains the accountable data controller.
- According to the KVKK Authority's 2025 Annual Report, the Board fined 876 data controllers in 2025, 594 of them over registry (VERBİS) obligations.
- The right consultant combines legal and IT expertise in the same project; a proposal that delivers only documents covers half the job.
- Compare proposals on deliverables, exclusions and post-project support rather than on price alone.
- If the consultant will see your personal data, the contract needs data processor clauses and a confidentiality obligation.
What does picking the wrong consultant cost?
The first cost is invisible. Management believes data protection is "done", yet nothing in the systems has changed. There is a privacy notice on the website and a policy pack in a shared folder, while former employees' accounts are still active and customer records have piled up for years without deletion. The gap tends to surface with the first complaint or the first breach.
The regulator's figures show this is not a theoretical risk. According to the KVKK Authority's 2025 Annual Report, the Board imposed administrative fines on 876 data controllers in 2025: 594 cases concerned registration and notification to the data controllers' registry, 142 arose from breach notifications and 140 from complaints. In the same year the Authority received 328 breach notifications and 12,512 complaints and notices.
Those numbers also explain why the choice of consultant matters. More than two thirds of the fined controllers (594 of 876) were penalised under the registration and notification duty, so most of the risk stems not from subtle points of law but from gaps in registration and process. A consultant who delivers paperwork without building the underlying processes will not close those gaps.
What should a good consultant actually deliver?
Compliance is not a one-off document pack but a chain of linked tasks, which we walk through in our KVKK compliance steps guide. Whoever you shortlist, look for a clear answer to each component below in their proposal.
| Component | What should be delivered | Question to ask the consultant |
|---|---|---|
| Gap analysis | A prioritised list of gaps with risk ratings | How do you rank your findings? |
| Personal data inventory | Processing activities per department and data flow diagrams | Do you build it from interviews alone or also by inspecting systems? |
| VERBİS | An assessment of the registration duty and, if required, the filing | Who keeps the registration up to date afterwards? |
| Policies and notices | Privacy notices, consent forms, retention and disposal policy | Are the texts written around our actual processes? |
| Technical measures | Access matrix, access logging, encryption, automated deletion | Will you implement these, or only recommend them? |
| Breach response plan | Roles, a 72-hour notification workflow and a drill | Do you test the plan against a scenario? |
| Training and upkeep | Role-based training and a periodic review schedule | How does support continue after the project ends? |
The inventory is the foundation; everything else depends on it. Knowing what a thorough one looks like helps you judge how deep a consultant really goes, so it is worth reading our guide to the KVKK personal data inventory. If you are unsure whether you need to register at all, start with the VERBİS registration guide.
Do you need legal or technical expertise?
You need both, and this is where most engagements fall short. Law-led firms write excellent notices but often leave you to work out how "records are kept for two years" should be enforced in a database. Technology-led firms set up logging but may skim over lawful bases and transparency duties.
Article 12 of KVKK requires the data controller to take "all necessary technical and organisational measures" to ensure an appropriate level of security. That wording makes it plain that half of compliance is technical. Check that lawyers and people who understand your systems and software will work on the project together, and if either side is subcontracted, ask for that to be stated in the proposal.
Where you need a formal legal opinion, for instance during a Board investigation or litigation, budget for a lawyer separately. If you want to widen the technical scope, planning the project alongside cyber security consultancy avoids having the same systems reviewed twice.
How do you choose a data protection compliance consultant?
The eight steps below let you compare proposals against the same yardstick. Working through them in order also stops you defaulting to the cheapest bid or the thickest binder.
- Define your own scope. Decide which departments, systems (ERP, HR, CRM, email, CCTV, access control) and sites are in scope before you talk to anyone.
- Ask for an itemised deliverables list. Request a line-by-line list covering each component in the table above, and push back on vague labels such as "full compliance package".
- Meet the team. Ask about the legal and technical background of the people who will do the work, and whether they are the same people who came to the sales meeting.
- Probe the method. Will the inventory be built from questionnaires only, or will systems and databases be examined too? An inventory without system review will have gaps.
- Pin down implementation. Will the consultant configure retention periods, automated deletion and access logging, or simply hand over a recommendations report?
- See a sample. Ask for an anonymised inventory or gap analysis from a past project; the depth of real output tells you more than a sales deck.
- Read the contract. Processor clauses, confidentiality, delivery dates and exclusions should all be in writing.
- Plan for continuity. Have periodic reviews, tracking of regulatory changes and availability during a breach written into the proposal.
If you already have a framework for vetting suppliers, the questions in our guides to supervising software contractors and third-party vendor security assessment adapt well to a data protection consultant.
What red flags should you watch for in a proposal?
Certain phrases reveal that a proposal only covers the visible part of compliance. The KVKK Authority does not publish a list of approved or accredited consultancies, so if a firm describes itself as "authorised by the Authority", ask what that claim rests on; even if one employee holds a personal certificate, it says nothing about the whole team that will do the work. Equally, promises of "full compliance" in a few weeks, or of a certain outcome, are not realistic.
Off-the-shelf templates are another warning sign. A privacy notice written for someone else will not reflect your data categories or lawful bases. A consultant who cannot explain the difference between explicit consent and a privacy notice may even create new risk by collecting consent you do not need.
Finally, listen to how technical questions are answered. If "How will we enforce the retention period?" is met with "It's in the policy", the implementation work will land on you. We explain how to make deletion actually happen in our data retention and disposal policy guide.
What should the consultancy contract include?
During the gap analysis and inventory, a consultant may see staff lists, customer records or screenshots of your systems. At that point they are processing personal data on your behalf. Under Article 12 of the law, a controller whose data is processed by another party on its behalf is jointly responsible with that party for the security measures.
The contract therefore needs processor terms: which data will be accessed and why, where it will be held, how it will be returned or deleted at the end of the project, and whether subcontractors are allowed. Sample clauses are set out in our data processing agreement guide.
It should also list deliverables, interim deadlines, exclusions and the terms of post-project support, including how quickly the consultant will step in if a breach occurs. Under a Board decision, a breach must be notified to the Board without delay and within 72 hours at the latest of becoming aware of it; how to handle those first hours is covered in data breach notification within 72 hours.
How can Digital Bridge help with KVKK compliance?
Digital Bridge has been building custom software since 2013, and we deliver data protection compliance consultancy with that engineering background. Our starting point is simple: compliance is achieved through systems, not just documents. A retention period written in a policy has to hold true in the database as well.
The work begins with a gap analysis of your systems, processes and existing documents, with findings ranked by priority. We then build the data inventory through departmental interviews and system review, prepare the VERBİS filing and policy set where required, and implement and test the technical measures: a role-based access matrix, access logging, deletion or anonymisation that runs when retention periods expire, and a breach response plan.
Picture a healthcare provider with three branches. It had its notices drafted years ago, yet no system enforces a retention period for appointment records or CCTV footage. The gap analysis puts those two areas at the top of the list; retention periods are configured, expired records are routed into automated deletion and access is logged. After the gap analysis we set out scope, phases and cost in a written proposal. Our other advisory services are listed on the consultancy page.
What is the next step?
Before speaking to any consultant, put together a two-page brief: which departments process personal data, which systems you use, the status of your VERBİS registration and any requests or complaints received in the past year. It lets you compare proposals on the same scope. More guides on the subject are collected on the security and data protection topic page.
If you would like an outside view of where you stand, read about our data protection compliance consultancy and request a gap analysis through the contact page. You can also call us on +90 850 346 41 09 or email info@digitalbridge.com.tr.