KVKK

What is KVKK?

KVKK is the Turkish abbreviation for Law No. 6698 on the Protection of Personal Data, published in the Official Gazette on 7 April 2016. Any information that identifies a person, or makes them identifiable, is personal data: a name, phone number, email or IP address. The law sets out when such data may be processed, how it must be protected and what rights people have. The Personal Data Protection Authority oversees it.

Here is an everyday case. Your website has a contact form where visitors type their name, phone number and message. That is processing personal data. The form should link to a privacy notice explaining who collects the data, for what purpose, who it may be shared with and what rights the person has. If the site uses advertising or analytics cookies, visitors must agree before those cookies run. Strictly necessary cookies are handled separately.

What should a website pay attention to?

The duty to inform and explicit consent are not the same thing. Informing is needed whenever data is collected. Explicit consent is required only when none of the other legal grounds in the law apply, and it must be freely given and specific. That is why the privacy notice and the consent text are kept separate. Under the Authority's guide on cookies, non-essential cookies should not run until the visitor agrees. Data should travel encrypted over SSL, with restricted access, and not be kept longer than needed. Transfers to services abroad and registration with VERBİS, the data controllers registry, have their own rules.

The wording of the texts depends on your business, so ask your legal adviser for the details. We build the technical side: the cookie consent tool, the privacy link under forms, encrypted connections and secure storage. More in KVKK-compliant website and on our web design page.