KVKK compliance is not completed by one document or tool. Legal basis, data minimisation, transparency, security and data-subject rights must be managed together. This framework is an operational starting point and does not replace legal review for the organisation's sector, scale and data flows.
1. Build an inventory; assess VERBIS scope separately
Create a processing inventory covering data category, subject group, purpose, legal basis, recipient, system, retention and safeguards. Assess VERBIS obligations and exemptions separately against workforce, balance sheet, activity and current Board decisions; not every organisation or individual data item is automatically filed.
2. Match notices to actual data flows
- Data controller identity (company + contact)
- Data items (email, phone, IP, etc.)
- Processing purpose (order, marketing, accounting, etc.)
- Legal basis (contract, explicit consent, legal obligation)
- Recipients (third-party processors, cross-border)
- Transfer recipients and purposes
- Collection method and legal basis
- Data-subject rights under Article 11 of KVKK
3. Explicit Consent: Marketing Communications
Assess KVKK together with Türkiye's commercial-electronic-message rules. Separate processing necessary for the contract from marketing preferences and, where required, obtain freely given, specific and informed consent. Record the source, time and withdrawal of consent in an auditable way.
4. Cookie Banner: Per-Category Consent
Do not activate non-essential analytics or marketing cookies before obtaining the appropriate preference. Explain purpose, provider, duration and cross-border transfer, and make rejection and later preference changes accessible. Category design must reflect the site's actual cookie inventory.
5. Document the cross-border transfer mechanism
Cross-border transfer is not limited to explicit consent. Assess the legal basis together with adequacy decisions, appropriate safeguards such as the Authority's standard contracts, binding corporate rules or approved undertakings, and occasional-transfer conditions under current law. Record sub-processors, countries, data categories and notification/authorisation steps.
6. Prepare a breach decision tree
Not every security event is a personal-data breach. Document data types, subject groups, likely consequences, controls and time of awareness. Security and legal teams assess notification without delay using the Board's current timing, method and form. Check current administrative fines in the Authority's annually published table.
7. Employee Data: Separate Disclosure
Separate employee processing by purpose and legal basis across payroll, personnel files, access logs, CCTV and any biometrics. Delivery of the notice should be provable; a signature does not automatically mean consent. Set retention per data type against employment, social-security, tax, limitation and litigation duties rather than one blanket number.
8. Data-Processor Contracts
Supplier roles are not automatically identical; determine whether each is a controller, processor or independent controller from the actual service. Align instructions, confidentiality, security, sub-processing, breach support, return/deletion and audit clauses with the service scope.
9. Access-Request Response Process
Assign primary and backup owners to verify identity, log requests, route them to system owners and respond within the legal period. A deletion request is not automatically granted; statutory retention duties and other exceptions must be assessed. Keep only the process record needed for accountability.
10. Reassess risk when processing changes
Reassess inventory and risk when adding software, data categories, suppliers, AI use or a new purpose. Review frequency should follow risk; Turkish law does not imply an identically titled DPO or mandatory annual report for every company. Define decision owners and approval records through the organisation's governance.
11. Training: Employee Awareness
Training should reflect the data and risks each role encounters: HR, sales, support, developers and administrators do not need the same scenarios. Retain attendance and assessment evidence for an appropriate accountability period, and update content after incidents or process changes.
KVKK compliance is an ongoing governance discipline. AIOR can support technical inventory, security controls, records and incident workflows; legal classification, VERBIS obligations and transfer mechanisms remain subject to approval by the controller and its legal counsel.
