A contact form, field-task photograph, customer-call transcript or username in a maintenance record raises the same questions: why is this information collected, who can access it and when is it deleted? Personal data protection does not end with publishing a notice. Processes, contracts, software settings and daily practice must work together.
This guide was reviewed against official Authority sources on 21 October 2026, including the 2024 amendments and Decision 2026/347 on separating privacy notices from consent. It provides general information; a specific operation requires assessment of its circumstances, sector rules and data flows. It is neither a product privacy notice nor a compliance certificate.
The opening questions explain the fundamentals, followed by field applications, cloud and AI use. The final sections cover request deadlines, incident handling and evidence to ask for during procurement. Source links lead to the official material supporting each explanation.
1. What is KVKK, and what counts as personal data?
Law No. 6698 regulates processing of information relating to identified or identifiable individuals. Names, phone numbers and identity numbers are obvious examples, but the scope is broader. Accounts, device identifiers, locations, IP addresses and timestamps may identify someone when combined with other records. Information does not have to be secret or intimate to qualify as personal data.
This distinction matters in engineering systems. An inverter power reading may say nothing about a person, while the operator name, shift record or intervention history stored beside it may contain personal data. Inventory work should therefore extend beyond the primary database to support tickets, exported files, screenshots and application logs.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗
2. Are small businesses and paper records covered?
The law is not limited to large companies or online retailers. It can apply to individuals and legal entities processing personal data wholly or partly by automated means, or manually as part of a filing system. Structured customer files and employee folders may therefore be covered. Statutory exceptions must be assessed against the actual nature of the activity.
Start with the activity rather than company size: are visitor records kept, employee details processed or customer documents retained? An exemption from VERBIS registration does not settle these questions. A small team still needs suitable access controls, notices, retention rules and a request channel. Downloading a template does not make those operational decisions.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗KVKK — Sicile Kayıt İstisnaları ↗
3. How do controllers and processors differ?
A controller determines the purposes and means of processing; a processor processes data on the controller's behalf under its authorization. Hosting data under a customer's instructions is different from deciding to use customer information for one's own marketing. Roles follow the actual decisions being made, rather than merely the labels written in a contract.
An organization can have different roles for different operations. A software supplier may process customer records on instructions while acting as controller for its own employees. Define purposes, instructions, access, subprocessors and deletion responsibilities for each flow. Combining customer operational records with supplier billing or security records under a single vague description makes request and incident handling harder.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗
4. Is explicit consent required for every operation?
No. Article 5 provides conditions other than explicit consent, including express statutory provisions, legal obligations, necessity for establishing or performing a contract, and establishing, exercising or protecting a right. Legitimate interests require assessment without infringing the person's fundamental rights and freedoms. The appropriate condition must be identified for the particular data and purpose.
A billing record needed to provide a service and a profile used for an unrelated advertising campaign serve different purposes. One blanket checkbox can misleadingly present necessary processing as optional. Define the purpose, minimize the fields and map the legal basis to the notice. Where consent is the basis, it must be specific, informed and freely given.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗KVKK — 2026/347: Aydınlatma ve Açık Rızanın Ayrılması ↗
5. Does acknowledging a privacy notice constitute consent?
A privacy notice fulfils the controller's duty to inform; consent expresses a person's choice about specific processing. Board Decision 2026/347 of 18 February 2026 emphasizes their separate treatment. They can appear on the same page, but require distinct headings, texts and declarations. Providing information is not conditional on obtaining approval.
In the interface, distinguish acknowledgement, contractual acceptance and optional permissions. A preselected checkbox or a single action accepting unrelated purposes does not establish a sound record. Where another processing condition applies, explain it instead of adding an unnecessary consent statement. Recording the notice version and choice timestamp helps establish what the user was shown.
Section references: KVKK — 2026/347: Aydınlatma ve Açık Rızanın Ayrılması ↗
6. What should a useful privacy notice explain?
Under Article 10, a notice explains the controller and any representative, processing purposes, recipients and transfer purposes, collection method and legal basis, and the individual's rights. It should describe the actual operation. Pasting one corporate text into every form can hide differences between support requests and job applications.
A concise contextual explanation linked to further detail can make a layered notice practical. On mobile, the link must remain visible and readable, with information available before submission. When notices change, retaining traceable versions, updating the relevant flows and checking the actual supplier list are useful governance practices.
Section references: KVKK — Aydınlatma Yükümlülüğü ↗KVKK — 2026/347: Aydınlatma ve Açık Rızanın Ayrılması ↗
7. What are special categories of personal data?
Health, biometric and genetic information and the other categories listed in Article 6 receive special protection. The processing conditions were revised in 2024. Older descriptions distinguishing health data from other sensitive categories should not replace the current provision. Explicit consent is not the only possible condition, but an applicable condition in the amended article must actually be satisfied.
A support caller may disclose health information, or an incident photograph may show an injury. The form's name does not determine the category; the actual content does. Remove unnecessary fields, restrict access, apply the required additional safeguards and prevent uncontrolled copying into test environments.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗KVKK — Özel Nitelikli Kişisel Verilerin İşlenmesi Rehberi ↗
8. How should employee location and field-task records be handled?
Recording where a task occurred and continuously tracking an employee are different operations. Assess purpose, necessity and proportionality separately. If a one-time location confirms a visit, continuous background tracking requires a stronger justification. The employment relationship also calls for scrutiny of whether consent is genuinely freely given.
Specify when location is collected, its precision, off-duty behaviour, who can see it and its retention period. Showing a supervisor only relevant tasks provides better control than opening the entire history to everyone. When assessing field-operation solutions such as Atlas, consider the product description, applicable notice and actual configuration together; choosing a product does not complete the legal assessment.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗
9. Are images and voice recordings automatically biometric data?
Not every photograph or recording automatically constitutes biometric data. Face or voice templates created through specific technical processing for unique identification or authentication require a different assessment. An ordinary recording can nevertheless contain personal data. A security purpose does not automatically justify recording every place and every detail.
Design camera angles, masking, viewing permissions and retention together. Capturing audio alongside video requires a separate necessity and proportionality assessment. Remote inspection and confined-space surveying systems should also account for workers and visitors in view. There may be technical alternatives between collecting required surface geometry and retaining a full recording of the surroundings.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗KVKK — İş Yerlerinde Güvenlik Kamerası Sistemi Kullanımı ↗
10. Does transcription or summarization create additional processing?
Transcribing audio, separating speakers, analysing sentiment and generating recommendations are distinct processing steps. The assessment supporting the original recording is not unlimited authorization for every subsequent use. Review changes in purposes, recipients, categories and storage locations. An inaccurate summary can also create incorrect information about a person.
In call analytics, raw audio, transcripts, summaries and quality scores can have different access rules. Identify outputs requiring human verification and propagate corrections to search indexes and reports. When evaluating use cases around ManageCallAI or Medya Zekası, ask about source traceability, authorization and correction of derived records as well as model performance.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗
11. Can personal data be sent to an AI service?
Using AI does not remove data protection obligations. Identify the information, purpose, legal basis, provider role and transfer conditions. Check training use, logging, human review access and subprocessors. A free consumer interface and a service governed by an enterprise contract may have different conditions.
Send only necessary data, remove unnecessary identifiers and prefer synthetic test cases. With RAG or MCP, the model should not retrieve documents the user cannot access. Tool calls, caches and evaluation datasets can create additional copies. Hosting a specialized model internally may reduce some transfer risks, but does not automatically solve access, retention or output-accuracy issues.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗KVKK — Kişisel Verilerin Yurt Dışına Aktarılması Rehberi ↗
12. Is hosting in Türkiye sufficient?
The server country matters, but does not describe the entire flow. Application logs, error trackers, email services, notifications, backups and remote support may involve other countries. The primary database location alone cannot establish the residency of the whole system. Domestic hosting also does not remove other KVKK duties.
Map each flow and record storage, processing, access and deletion behaviour. Compare contractual regions against service settings and subprocessor lists. Our related article on data residency, Firebase, Cloudflare and IoT expands this technical review. During procurement, ask for evidence identifying where each data category is processed rather than relying on a broad domestic-cloud label.
Section references: KVKK — Kişisel Verilerin Yurt Dışına Aktarılması Rehberi ↗
13. How should international transfers be assessed after the 2024 changes?
Amended Article 9 provides routes involving adequacy decisions, appropriate safeguards and specified occasional transfers. Assess the processing condition under Article 5 or 6 and then the applicable transfer route. Routine cloud use should not automatically be treated as an occasional transfer. Review access from abroad and onward transfers as well as data-centre addresses.
Standard contracts are one safeguard mechanism and are not interchangeable with an ordinary supplier agreement. Select the appropriate text and party roles, complete the annexes for the actual flow and account for notification to the Authority within five working days of signing. New subprocessors or analytics services can require reassessing the transfer map.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗KVKK — Kişisel Verilerin Yurt Dışına Aktarılması Rehberi ↗KVKK — Standart Sözleşme Bildirim Modülü ↗
14. Does encryption or removing names make data anonymous?
No. Encryption is a security measure; reversible encrypted data does not automatically stop being personal data. Replacing a name with a code is not anonymization if other records can restore the link. Anonymization requires that the information cannot be associated with an identifiable individual even through matching with other data. This matters particularly for research and AI training datasets.
A rare task location, exact timestamp and occupation may identify someone in combination. Do not stop at deleting the name column. Consider context, externally available information and re-identification possibilities. Depending on the analysis, reducing time or location precision, combining small groups or sharing only aggregate results may be useful technical options.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗KVKK — Silme, Yok Etme ve Anonim Hale Getirme ↗
15. How long should personal data be retained?
There is no universal retention period for every category. Assess statutory periods and the time required by the processing purpose. Invoices, applications, camera footage, call audio and security logs serve different needs. Possible future usefulness does not by itself justify indefinite retention. Define the event that starts the retention clock.
Implementation must cover file stores, exports, search indexes, report copies and backups, not just database timestamps. Distinguish records subject to legal retention from unnecessary operational copies. Scheduled jobs, visibility into failed deletion and documented exceptions turn a written policy into an executable process.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗KVKK — Silme, Yok Etme ve Anonim Hale Getirme ↗
16. Must everything be deleted immediately after a request?
Verify the requester appropriately and establish the request's scope. Where the reasons requiring processing have ended, erasure, destruction or anonymization duties arise. A valid legal obligation or necessary retention for protecting a right may mean unconditional deletion of every record is inappropriate. Explain any refusal or partial fulfilment.
Closing an account and deleting data are not equivalent. Information may remain in support files, vector indexes or report archives. Backup restoration should not silently return deleted records to active use. Track the request, actions taken and required notifications to recipients, then provide a clear response.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗KVKK — Silme, Yok Etme ve Anonim Hale Getirme ↗
17. What rights can individuals exercise?
Article 11 includes rights to learn whether data is processed, request information, learn the purposes and whether use matches them, and know domestic or foreign recipients. Individuals can request correction and, where the conditions apply, erasure or destruction, including notification of these actions to recipients.
Individuals can also object to an adverse result arising exclusively from automated analysis and seek compensation for damage from unlawful processing. Traceable inputs, correction mechanisms and suitable review processes are therefore important for scoring or AI evaluations. Request interfaces should avoid collecting additional information unrelated to handling the request.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗
18. What are the response and complaint deadlines?
The controller must resolve a request as soon as its nature permits and within 30 days at the latest. The controller request process generally comes first. Rejection, an inadequate response or failure to respond in time can open the complaint route to the Board. Preserve the request receipt and response-awareness dates.
The complaint deadline is 30 days after learning the response and, in all cases, 60 days after the initial request. With no response, the complaint follows expiry of the response period within that original 60-day limit; a late reply does not restart the outer limit. Organizations should use a tracked workflow rather than let requests disappear into a general support queue.
Section references: KVKK — 2019/9: Başvuru ve Şikâyet Süreleri ↗
19. What does the 72-hour breach rule mean?
First assess whether the event falls within Article 12(5), concerning processed personal data being obtained unlawfully by others. Under Decision 2019/10, the controller must notify the Board without delay and within 72 hours of becoming aware. Any justified delay must be explained; waiting for every detail to be finalized should not halt notification.
Notification to affected individuals is separate and should follow in the shortest reasonable time after they are identified. Processors must inform controllers without delay. While containing access, technical teams should preserve evidence and a timeline and establish who and what data were affected. Named owners and rehearsals make the process operational.
Section references: KVKK — 2019/10: Veri İhlali Bildirimi ↗
20. Does a VERBIS exemption remove all KVKK obligations?
No. Registration in the Data Controllers Registry is separate from the law's general duties. An exempt organization can still have notice, security, lawful-processing and request-handling obligations. Check current exemption decisions and conditions at the official source instead of assuming thresholds in an old advisory article remain current.
Reassess when the organization grows, changes its main activity or introduces new sensitive-data processes. The technical inventory and registry disclosures should remain consistent. Completing registration does not establish that every system is secure or every operation lawful. Assign ownership and responsibility for inventory updates.
Section references: KVKK — Sicile Kayıt İstisnaları ↗6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗
21. Does every cookie require consent?
Assess cookies by purpose and processing condition. Functions necessary for a service explicitly requested by the user should not be grouped with advertising, tracking or unrelated analytics. Cookies requiring consent should not run before that choice. Being first-party or short-lived does not by itself establish an exemption.
The preference panel must do more than look correct. Rejecting optional cookies should actually block those tags, and changed choices should affect execution. Recheck network requests and storage after adding analytics scripts. A tag sending information abroad also raises transfer questions; a checkbox does not replace that assessment.
Section references: KVKK — Çerez Uygulamaları Hakkında Rehber ↗KVKK — Kişisel Verilerin Yurt Dışına Aktarılması Rehberi ↗
22. Can publicly accessible personal data be used freely?
Search-engine visibility is not unlimited permission to collect and reuse information. Consider whether the individual made it public and for what purpose; publication by someone else is not equivalent. Accuracy, proportionality and the general principles still matter. Using a publicly listed professional contact for unrelated profiling requires a separate assessment.
Media monitoring and search systems benefit from source links, publication dates and correction or removal tracking. An inaccurate older version can survive in indexes and AI summaries. Preserve provenance and propagate updates to derived outputs. Copyright and platform terms also require consideration separately from personal data protection.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗
23. Is a certificate or a compliance-labelled product enough?
Security certificates can provide evidence about a defined scope and audit period, but are not blanket permission for every processing activity. A product marketed as compliant does not determine your legal basis, retention periods or supplier relationships. Evaluate available controls together with how your organization operates them.
Ask evidence-based questions: how is access revoked when a user leaves, are administrator actions traceable, who can export records and who sees failed deletion jobs? Gökbilge Tech's security and trust and product pages provide starting points for a discussion. Define features, responsibilities and acceptance criteria for the specific project.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗
24. Are administrative fines the only consequence?
The law refers to Turkish Criminal Code provisions as well as administrative sanctions. Depending on the circumstances, compensation claims, contractual consequences and implementation of Board decisions may also arise. Administrative fine amounts change over time, so an old figure should not be treated as a fixed budget item; consult the Authority's table for the relevant year.
Operational cost also includes investigation, disruption, customer communication, correcting records and revisiting contracts. Plan prevention around continuity and trust as well as potential penalties. Which sanctions apply remains a matter for the competent authorities assessing the particular facts.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗KVKK — İdari Para Cezası Tutarları ↗
25. What evidence should procurement teams request?
Write the use case first: which people, data, purposes, countries and user roles are involved? Assess the supplier's presentation against that scenario. A demonstration of the happy path is not enough. Discuss unauthorized access, departing users, corrections, exports and deletion across the lifecycle.
The following checks do not replace legal advice; they make technical discussions and acceptance plans concrete. Legal, security and operations teams should work from the same flow map. When defining a solution with Gökbilge Tech as an independent software and hardware house, cover the chain from devices to central services, integrations and reporting, rather than only application screens.
| Topic | Question | Evidence |
|---|---|---|
| Data flow | Where does each category go? | Service, country, recipient and subprocessor map |
| Authorization | Are role boundaries enforced? | Role matrix and denied-access demonstration |
| Retention and deletion | How are copies and backups handled? | Retention schedule, job records and restoration procedure |
| AI | Where are inputs and outputs retained? | Training-use, logging and human-access terms |
| Incidents and requests | Who acts, and within what deadlines? | Ownership, escalation and exercise evidence |
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗
26. How can a field-photo-to-AI-report workflow be designed?
Consider a technician uploading a maintenance photograph, a central team reviewing it and AI preparing a report draft. Ask first whether people need to appear. If not, use framing, cropping or masking to reduce the data. Attach only necessary task and device information, authorize access to the relevant record rather than the whole customer archive, and limit location precision to the purpose.
Then review the analysis service's data flow and transfer conditions and have a human verify the output. Define separate retention decisions for raw photographs, reports and logs. Test how a correction propagates to reports and search indexes. Data protection becomes a shared design input for devices, pipelines, permissions and operating procedures, instead of text added after implementation.
Section references: 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗KVKK — Kişisel Verilerin Yurt Dışına Aktarılması Rehberi ↗
Technical references
- 6698 — Personal Data Protection Law (official English translation; Turkish text prevails) ↗
- KVKK — Aydınlatma Yükümlülüğü ↗
- KVKK — 2026/347: Aydınlatma ve Açık Rızanın Ayrılması ↗
- KVKK — Özel Nitelikli Kişisel Verilerin İşlenmesi Rehberi ↗
- KVKK — Kişisel Verilerin Yurt Dışına Aktarılması Rehberi ↗
- KVKK — Standart Sözleşme Bildirim Modülü ↗
- KVKK — Çerez Uygulamaları Hakkında Rehber ↗
- KVKK — İş Yerlerinde Güvenlik Kamerası Sistemi Kullanımı ↗
- KVKK — Silme, Yok Etme ve Anonim Hale Getirme ↗
- KVKK — 2019/9: Başvuru ve Şikâyet Süreleri ↗
- KVKK — 2019/10: Veri İhlali Bildirimi ↗
- KVKK — Sicile Kayıt İstisnaları ↗
- KVKK — İdari Para Cezası Tutarları ↗
Want to apply this approach to your system?
Discuss your technical requirements →