Phone: 0 (552) 380 25 25 | Weekdays 10:00–18:00 · Technical support 24/7
Data protection compliance consultancy helps organisations in Turkey meet KVKK, and GDPR where it applies, in their systems as well as their documents. We compile the personal data inventory, prepare VERBİS registration if you are required to register and a retention and disposal policy, apply technical safeguards such as access logging and automatic disposal, and write the breach response plan.
In many organisations, data protection work ends once a privacy notice is on the website and a few consent forms are signed. An auditor will ask different questions: which system holds the personal data, how long it is kept, who can access it, and whether that access is logged.
This service is for organisations in Turkey that process customer, employee, patient, student or visitor data, including international companies that need to meet both KVKK (Turkey's Personal Data Protection Law) and GDPR. Alongside the legal documents, we build the technical side: we compile the data inventory, enforce retention periods in software, switch on access logging and write down exactly what happens if there is a breach.
One inventory showing which system holds which personal data, for what purpose, on what legal basis and for how long.
Where you are required to register, we prepare the VERBİS filing. Retention and disposal policy, privacy notices and consent forms are written around how you actually work.
Role-based permissions, encryption, access logging and backups, with access restrictions applied at both database and application level.
A process and the tooling to answer "what do you hold about me?", so one person's data can be found across every system.
Retention periods are configured per data type. Expired records are deleted or anonymised automatically instead of waiting for someone to remember.
Unusual access is monitored with anomaly detection. With a 72-hour window to notify the regulator, who does what and in which order is agreed in advance.
Systems, processes and existing documents are reviewed, and gaps are ranked by risk and significance.
Processing activities are recorded through departmental interviews, and data flows are mapped.
Policies and notices are drafted while technical safeguards are applied to your systems and tested in parallel.
Staff receive practical training, and a periodic review schedule with named owners is put in place.
A policy that says data is kept for two years, next to a database holding nine years of records, is not compliance. It is documented non-compliance. So we write the documents to match what the systems do, and change the systems to match the documents. We apply the same thinking in our own SmartPass access control product: card numbers are never stored in plain text, and records past their retention period are anonymised.
KVKK, Turkey's Personal Data Protection Law, requires you to know which system holds personal data, why, and for how long. In practice that means a data inventory, a retention and disposal policy, privacy notices and VERBİS registration where required, plus technical safeguards such as permission matrices, encryption, access logging and automatic disposal, and a written breach response plan.
No. An auditor asks which system holds personal data, how long it is kept, who can access it and whether that access is logged. A policy saying data is kept for two years next to a database holding nine years of records is documented non-compliance. We write the documents to match the systems, and change the systems to match the documents.
Yes. If you are required to register, we prepare the VERBİS filing. The retention and disposal policy, privacy notices and consent forms are written around your organisation's real processes, based on a data inventory and data flow maps built from department interviews. For international companies, GDPR requirements are considered alongside KVKK where relevant.
Role-based permission matrices, encryption, access logging and backup routines, with access restrictions at database and application level. Retention periods are defined in the systems by data type, and records past their retention period enter a deletion or anonymisation workflow instead of waiting for someone to remember. Unusual access can be monitored with anomaly detection.
Who does what, and in which order, from detecting the breach to notifying the regulator within the 72-hour window, should be written down in advance. Our data protection work includes that response plan and monitoring to spot unusual access early. Staff receive hands-on training, and a periodic review schedule with named owners is set.
Have a different question? Ask Us