Practice Areas
Data Protection (KVKK)
Identifying data controller obligations, VERBİS registration, privacy notices and consent texts, and managing data breach procedures.
Obligations under Law No. 6698 amount to far more than preparing a set of documents. A compliance project begins by mapping the organisation's data processing activities and establishing the legal basis for each one.
In the event of a breach, making the notifications to the Authority and to data subjects within the statutory period is among the factors weighed when assessing the risk of administrative sanction.
Scope of Services
- Preparation of the personal data processing inventory
- VERBİS registration and update procedures
- Drafting privacy notices and explicit consent statements
- Establishing retention and destruction policies
- Data transfer agreements and assessment of international transfers
- Responding to data subject requests
- Data breach notification and management of Authority proceedings
Frequently Asked Questions
- Which data controllers must register with VERBİS?
- The registration obligation is determined by criteria set by the Authority, such as employee numbers, annual financial balance sheet and field of activity. Subject to specified exemptions, data controllers must register with VERBİS and keep their information current.
- What is the data breach notification deadline?
- The data controller must notify the Authority without delay and in any event within seventy-two hours of becoming aware of the breach. Notification to affected data subjects must be made within the shortest reasonable time.
The explanations on this page are for general information only and do not constitute legal opinion. Every dispute must be assessed on its own facts.
All practice areas