Data Protection (KVKK)

Companies operating in Turkey must process the personal data of their employees, customers and business partners in accordance with the Turkish Personal Data Protection Law (KVKK). In foreign-owned companies, group policies are often based on the EU General Data Protection Regulation; however, as Turkish law provides for its own rules, in particular on cross-border data transfers and registration, these policies need to be adapted separately for the Turkish subsidiary. We handle these matters together with our advice in IP and IT law, employment law and compliance.

KVKK Compliance Projects

A compliance project starts with a data inventory recording which personal data the company processes and for which purposes. On this basis, the registration with the Data Controllers’ Registry (VERBIS), privacy notices and consent texts as well as a retention and deletion policy are prepared, and recommendations are made to close existing gaps. Experience shows that such documents are only effective if they fit the company’s actual day-to-day operations.

Cross-Border Data Transfers

Centrally managed HR systems, cloud services and group reporting frequently involve a transfer of personal data abroad. We advise on determining the transfer mechanisms permitted under Turkish law and on preparing the necessary agreements and notifications. This also includes reviewing data processing agreements with group companies and service providers.

Employee Data

Recruitment, performance reviews, video surveillance and the monitoring of business e-mail accounts lie at the intersection of employment law and data protection. We advise employers on these matters together with our employment law practice and assist in preparing internal policies and privacy notices for employees.

Data Breaches and Requests

In the event of a data breach, the assessment of the incident and the timely preparation of notifications to the Turkish Personal Data Protection Authority and to the data subjects are decisive. We support companies in responding to requests from data subjects and in complaint and review proceedings before the Authority. Information on setting up whistleblowing channels in compliance with data protection law can be found on the White-Collar Crime / Compliance page.