In short: companies within the scope of KVKK must prepare a personal data inventory, inform data subjects, obtain explicit consent where required, complete VERBİS registration, implement security measures, and notify the Board within 72 hours of a breach.
Law No. 6698 on the Protection of Personal Data imposes concrete obligations on every business that processes personal data. Non-compliance carries not only administrative fines but reputational damage and civil claims. The main headings are set out below.
1. Personal data inventory
An inventory showing what data is processed, for what purpose, on what lawful basis, to whom it is transferred and for how long it is retained is the foundation of compliance. Privacy notices prepared without an inventory rarely reflect the actual flow of data.
2. Notices and explicit consent
The controller must inform data subjects at every point of collection — website, job application, CCTV and so on — of its identity, the purpose of processing, the recipients of transfers, the method of collection and the data subject's rights. Explicit consent should be sought only where no other lawful basis applies, and must be freely given; making a service conditional on consent undermines its validity.
3. VERBİS registration
Data controllers exceeding the threshold values must register with the Data Controllers Registry (VERBİS) and keep their entries current. Breach of the registration obligation attracts one of the highest categories of fine.
4. Security measures
Technical measures such as access authorisation matrices, encryption, logging and penetration testing must be implemented alongside administrative measures including confidentiality agreements, policies, procedures and staff training. Data processing agreements must be signed with processors such as cloud and software suppliers.
5. Breach notification and data subject requests
Where a breach is discovered, notification must be made to the Board within 72 hours and affected individuals informed. Data subject requests must also be answered free of charge within 30 days, which calls for an internal response procedure.