Step-by-step conveyancing and procedure stages

Data audit and gap assessment

We map what personal data you hold, where it flows and where it goes abroad, and measure it against KVKK (and the GDPR where it also applies) to find the gaps.

Obligation mapping

We set out exactly what KVKK requires of you — registration, notices, lawful bases, transfers, security — with a prioritised, fixed-fee plan.

VERBİS registration and policies

We register you on VERBİS and draft your Turkish-law information notices, consent texts, data-processing and retention policies.

Lawful transfer mechanisms

We put the right cross-border route in place — adequacy, SCCs or another safeguard — and file the five-day SCC notification with the Board.

Breach and request procedures

We build your 72-hour breach-response plan and data-subject-request workflow, with templates your team can actually use.

Board representation

If a complaint or investigation arises, we represent you before the KVKK Board and manage the response and any fine.

Ongoing compliance and training

We keep your programme current as the rules evolve and train your staff so compliance holds in practice.

Critical statutory deadlines and calendar windows

KVKK clocks worth knowing

72 hours~~Notifying the Board of a personal data breach — Art. 12(5) KVKK, read as 72 hours from becoming aware by Board Decision No. 2019/10 (24 January 2019); affected individuals are notified as well~~

5 business days~~Notifying signed standard contractual clauses (SCCs) to the Board after a cross-border transfer is put in place — 2024 transfer regime (Law No. 7499 and the Transfer Regulation of 10 July 2024)~~

What to get in order

Before an inspection, a complaint or a new transfer goes live, these are the things worth having ready. Most are cheap to fix in advance and expensive to fix afterwards.

Map what personal data you hold, where it flows inside the business and where it leaves Türkiye — including cloud providers and parent-company systems.
Check your VERBİS position: whether you must register under Article 16, whether an exemption or threshold applies, and whether an existing entry is still current.
Identify the lawful basis for each processing activity under Articles 5 and 6 rather than defaulting to consent — and check that any consent you do rely on meets the açık rıza standard.
Have a Turkish-language information notice (aydınlatma metni) that says who you are, what you process and why.
Confirm the route for every cross-border transfer — adequacy, appropriate safeguards or an exception — and diarise the five-business-day SCC notification to the Board.
Prepare an incident-response plan that can produce a Board notification within 72 hours of becoming aware, plus a data-subject-request workflow with templates so requests are answered within the statutory period and refusals come with reasons.
If you are acting from abroad, arrange a notarised and apostilled power of attorney (or sign at a Turkish consulate), with translation.

KVKK & Data Protection Compliance in Türkiye: Audit Stages, VERBİS & Board Defense