Practice Areas
Data Protection Law Advisory
Legal support ranging from a business's compliance obligations as data controller to a data subject's rights of application and complaint, under Data Protection Law No. 6698 (KVKK).
Last updated: · Prepared by: Av. Barış Kaymaz
Data protection law, within the framework of Data Protection Law No. 6698 (KVKK), governs the rights of individuals whose personal data is processed (data subjects) and the obligations of the organizations that process that data (data controllers). The law draws significant inspiration from the EU's General Data Protection Regulation (GDPR).
As business processes become increasingly digital, nearly every organization processes employee, customer or supplier data. Conducting these processing activities in line with KVKK reduces the risk of administrative sanctions and helps protect institutional reputation.
Data Controller Obligations
Under KVKK Art. 10, a data controller must inform data subjects — before processing begins — of the controller's identity, the purpose of processing, data transfers and their rights. Data controllers exceeding certain thresholds must also register with the Data Controllers' Registry (VERBİS).
Explicit Consent and Processing Conditions
As a rule, personal data may only be processed with the data subject's explicit consent or on one of the other legal grounds listed in KVKK Art. 5. Special categories of personal data, such as health or biometric data, are subject to stricter conditions and, as a rule, may only be processed with explicit consent or in the exceptional cases set out by law.
Breach Notification and Administrative Sanctions
If personal data is unlawfully obtained by others, the data controller must notify both the data subject and the Personal Data Protection Board as soon as possible. Violations of KVKK can result in administrative fines depending on the nature of the breach, which is why having an incident-response plan prepared in advance matters.
Data Subject Applications and Board Complaints
Under KVKK Art. 11, a data subject has rights such as learning whether their data is being processed and requesting its correction or deletion. If an application to the data controller is rejected, found insufficient, or not answered within the statutory period, a complaint can be filed with the Personal Data Protection Board.
Services in This Area
- Preparing data controller compliance documents (privacy notices, consent forms)
- Advisory on VERBİS registration and data inventory work
- Preparing data processing inventories and retention/destruction policies
- Representation in data breach notification and Board proceedings
- Advisory on responding to data subject applications
- Handling complaints before, and appeals of administrative fines from, the Personal Data Protection Board