Question 1

What exactly does the KVKK regulate?

Accepted Answer

Law no. 6698 on the Protection of Personal Data sets out the conditions under which personal data may be processed, how it must be protected, and the rights people hold over their own data. The law draws no distinction by sector; it covers every natural and legal person that processes personal data. What changes is the weight of the obligation: where the data is of a special category, the expectations rise with it.

Question 2

Which organisations are covered?

Accepted Answer

Anyone who processes personal data. Even if an organisation holds no customer data, employee data falls within scope, so in practice almost nothing stays outside the obligation. Registration with VERBİS is a separate matter, and criteria apply to it.

Question 3

What is the difference between a data controller and a data processor?

Accepted Answer

By the law's definition, the controller determines the purposes and means of processing and is responsible for establishing and managing the data filing system. The processor handles data on the controller's behalf, under the authority granted by the controller. Your cloud provider or payroll firm is usually a processor. That does not transfer responsibility; the relationship has to be set out in a contract.

Question 4

What counts as special category personal data?

Accepted Answer

The categories the law lists separately: race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal convictions and security measures, along with biometric and genetic data. The grounds for processing these are narrower and the security measures expected are heavier.

Question 5

Who has to register with VERBİS?

Accepted Answer

The main groups are controllers with more than 50 employees a year, those whose principal activity is processing special category data, public institutions, and controllers not established in Türkiye. Numeric thresholds such as the annual balance sheet total, and the list of exemptions, are updated by Board decisions, so we do not print a figure here; kvkk.gov.tr is the source to rely on. The pre-check tool on our legislation page is there to give you a sense of it, not a definitive answer.

Question 6

Where should compliance work start?

Accepted Answer

With the data inventory. Until you know which unit processes which data for which purpose, a privacy notice cannot be written correctly and retention periods cannot be set. Projects that start with the document set usually get rewritten on the second pass.

Question 7

Why does everything hang off the data inventory?

Accepted Answer

The privacy notice rests on the purposes in the inventory, the retention policy on its data categories, and the answer to a data subject request on the storage locations it records. Without an inventory all of these are written from guesswork, and the gap shows at the first audit or the first request.

Question 8

How long does a compliance project take?

Accepted Answer

It depends on the size of the organisation, the number of systems and the current state. What determines the timeline is not writing documents but getting the inventory right and putting the controls into operation. In the first conversation we look at your situation and produce a concrete schedule.

Question 9

We are a small business — are we still obliged?

Accepted Answer

KVKK obligations depend on whether you process personal data, not on company size. For VERBIS registration, criteria such as employee count and balance sheet do come in. We can look at your situation together.

Question 10

We already work with a consultant — would you take over?

Accepted Answer

We can. Before taking over we assess the current state: the inventory, the document set, and how much of the controls actually operate. Starting from scratch is not always necessary.

Question 11

Are the privacy notice and explicit consent the same thing?

Accepted Answer

No. The notice is an obligation in every case: you tell the person who you are, why you process the data, who you share it with and what rights they have. Explicit consent is only one of the grounds for processing. Taking consent does not mean the notice has been given; the two texts are needed separately.

Question 12

Do we need explicit consent for every kind of processing?

Accepted Answer

No, quite the opposite. The law sets out grounds besides consent: an explicit provision in law, the establishment or performance of a contract, compliance with a legal obligation, the establishment of a right, and legitimate interest among them. Where one of these applies, consent is not sought. Relying on consent unnecessarily increases risk, because consent can always be withdrawn.

Question 13

Do we have to ask for consent for cookies?

Accepted Answer

For cookies that are not strictly necessary for the site to work, consent has to be taken beforehand and it has to be provable afterwards. In practice the missing half is usually the proof: the banner is shown, but no record says who consented to what and when. HEM Cookie exists to keep exactly that record.

Question 14

What happens if someone withdraws consent?

Accepted Answer

Consent can be withdrawn at any time. From that moment the processing based on it stops, and unless another legal ground applies the data is deleted, destroyed or anonymised. Withdrawing is expected to be at least as easy as giving consent was.

Question 15

Which technical measures are expected?

Accepted Answer

The law does not enumerate them; it speaks of all technical and administrative measures needed to ensure an appropriate level of security. In the field that comes down to access rights defined by role, a record of who accessed what, backups with restore testing, encryption in transit and at rest, contracts with processors and staff training. The measure is the nature of the data: expectations rise for special category data.

Question 16

What comes first when there is a data breach?

Accepted Answer

Open a record and write down the moment of discovery, then stop the spread and establish the scope. Notification to the Board is made as soon as possible; how that period is applied is set by Board decisions, so check the current position on kvkk.gov.tr. Where the breach carries risk, the people affected are informed as well. The important part is that this flow is prepared in advance rather than written during the incident.

Question 17

Are we required to keep access records?

Accepted Answer

The law gives no list of records as such, but being unable to show who accessed which data and when also means being unable to evidence the measures you took. It is among the first things asked for in an audit or a breach investigation. An authorisation matrix and periodic access reviews work as a pair.

Question 18

Are we responsible for the supplier that holds our data?

Accepted Answer

Your status as controller does not pass to the supplier. Where the supplier acts as a processor, your contract needs data processing provisions, the supplier has to be able to show the measures it takes, and it has to be obliged to notify you in the event of a breach. The supplier assessment checklist on our resources page was written for that conversation.

Question 19

What rights do people hold over their own data?

Accepted Answer

The law lists these: to learn whether their data is processed, to request information if it has been, to learn the purpose of processing and whether the data is used accordingly, to know the third parties it has been transferred to in the country or abroad, to request correction where it is incomplete or inaccurate, to request erasure or destruction where the conditions are met, to request that these actions be notified to the third parties the data was transferred to, to object to a result reached against them solely through automated analysis, and to claim compensation for damage caused by unlawful processing.

Question 20

How quickly must we answer a data subject request?

Accepted Answer

As soon as possible given the nature of the request, and within thirty days at the latest. The answer is free of charge as a rule; where the process carries a cost, the fee in the tariff set by the Board may be charged. The way to stay inside the period is to define the intake channel in advance and log every request that arrives.

Question 21

Where does a person go if our answer never comes?

Accepted Answer

If the request is refused, the answer is found insufficient, or no answer arrives in time, the person can complain to the Board. They have thirty days from learning the response, and in any case sixty days from the date of their request. Leaving a request unanswered does not close the file; it moves it to the Board.

Question 22

How long may we keep the data?

Accepted Answer

Where legislation prescribes a period for that data, that period applies. Where it does not, the purpose sets the period: once the purpose is gone, so is the basis for keeping the data. This is why retention periods are written per data category, each with its own justification next to it.

Question 23

How is data disposed of once the period ends?

Accepted Answer

There are three routes: deletion, destruction and anonymisation. Which one applies depends on the medium the data sits in and the purpose it served. What matters is that disposal stops being something someone remembers to do and becomes a periodic schedule, with each disposal recorded.

Question 24

Why do you deliver compliance, software and data protection together?

Accepted Answer

Because the three are connected. A compliance report sits on a shelf without the software to run it; software is no help in an audit unless the technical measure can be proven. When they are split across suppliers, the gaps between them land on the organisation.

Question 25

How does pricing work?

Accepted Answer

Price follows scope: how many systems, how many units, which standard, whether a product is used. We do not publish a price list, because a figure given without seeing the scope misleads one of us. The initial assessment is free.

Question 26

Can we take consulting without buying your products?

Accepted Answer

Yes. Consulting and products are bought separately. The products make the work easier but are not required; there are setups we can run with the tools you already have.

Question 27

Where is our data kept in your products?

Accepted Answer

Depending on your deployment choice, on your own infrastructure or in a data centre located in Türkiye. The hosting decision is written into the contract.

Question 28

Do you guarantee we will get the ISO 27001 certificate?

Accepted Answer

We do not issue the certificate; certification comes from an independent body's audit. Our commitment is to build a system that is ready for that audit and to close the gaps beforehand through internal audit.

Question 29

What is the contract model?

Accepted Answer

We work either project-based or as periodic support. In both models the deliverables and the schedule are written into the contract.

Question 30

Do the AI tools on this site store our data?

Accepted Answer

In the assessment tool your answers are used to produce the report. The assistant chat is stored only in your browser, is deleted automatically after 30 days, and you can clear it at any time. In both tools the output is generated by AI and is not legal advice.

Frequently asked questions

Core concepts

The compliance process

Notice and explicit consent

Data security and breaches

Rights, retention and disposal

Working with HEM Bilişim

See where you stand in 20 minutes