Data Protection (KVKK) Lawyer

Customer records, employee files, patient information, camera footage and website forms: today almost every business processes personal data every day, whether it realises it or not. As a KVKK lawyer in Mersin, I provide legal support both to companies and institutions that want to comply with the Law on the Protection of Personal Data No. 6698 (KVKK) and to individuals whose personal data has been unlawfully processed, shared or obtained. For a data controller (veri sorumlusu), the aim is to remedy the gaps that create a risk of sanctions before a breach occurs; for a person whose data has been breached, the aim is to use the application and complaint routes provided by the law in the right order and within the time limits.

In Which Matters Does a KVKK Lawyer Provide Support?

• KVKK compliance work with a data inventory, a personal data processing policy and retention and destruction procedures
• Assessing the VERBİS registration obligation and completing the registration
• Preparing privacy notices (aydınlatma metni) and explicit consent (açık rıza) texts
• Lawful management of employee data and workplace camera recordings
• Cookie policy and website compliance
• Data processor agreements and transfers of data abroad
• Notifying the Personal Data Protection Board (Kurul) and the data subjects when a data breach occurs
• Responding to applications from data subjects and defending against complaints made to the Board
• Applications, complaints and compensation claims on behalf of individuals whose data has been processed unlawfully

What Is Personal Data, and Who Does the KVKK Cover?

Personal data is any information relating to an identified or identifiable natural person. Name, ID number, telephone number, address, bank details, IP address, location and camera footage are just a few examples. Information such as health data, biometric and genetic data, criminal convictions, religion and trade union membership is considered special category personal data (özel nitelikli kişisel veri) and is subject to stricter rules.

The law treats the person who determines the purposes and means of processing data as the data controller. The KVKK therefore concerns not only large companies but also every employer with staff, businesses collecting forms through a website, e-commerce sites, healthcare institutions, schools, associations and the managements of residential complexes. The concept of data processing covers every operation, from obtaining data to recording, storing, transferring and deleting it.

The Data Controller’s Basic Obligations

Personal data must be processed lawfully and in accordance with the rules of good faith, for specific and legitimate purposes, in a way that is relevant, limited and proportionate to the purpose, and kept only for as long as necessary. Every processing activity must be based on a legal ground listed in the law: being expressly provided for by law, the establishment or performance of a contract, the fulfilment of a legal obligation, the establishment or protection of a right, the legitimate interest of the data controller and, if none of these applies, explicit consent. Data for which the ground for processing no longer exists must be deleted, destroyed or anonymised.

The data controller must also take the necessary technical and administrative measures for data security. Steps such as preparing a data inventory, setting access permissions and preparing a retention and destruction policy are planned together as part of the KVKK compliance process.

The Duty to Inform and Explicit Consent

When obtaining data, the data controller must inform the data subject of its identity, the purpose for which the data will be processed, to whom and for what purpose it may be transferred, the method of collection and the legal ground, and the rights arising from the law. This obligation also applies where explicit consent is not required. Privacy notices should be prepared according to the business’s actual data flow; generic texts taken from another business are often incomplete or misleading.

Explicit consent, on the other hand, is consent relating to a specific matter, based on information and given freely. Common mistakes are asking for consent when another legal ground already exists, embedding the consent statement in the privacy notice, or making the service conditional on consent being given. When setting up explicit consent processes, it should first be determined which processing really requires consent; simply adding a tick box is not enough.

VERBİS Registration

Registration with the Data Controllers’ Registry Information System (Veri Sorumluları Sicil Bilgi Sistemi, VERBİS) is the general rule of the law. The Personal Data Protection Board has exempted certain data controllers from this obligation based on criteria such as number of employees, annual balance sheet total and main field of activity. Since these criteria have changed over time through Board decisions, the registration obligation should be assessed separately according to the current decisions. Once registration has been made, the registry must also be updated whenever the information changes. For details, please see the VERBİS page.

Data Processors and Transfers Abroad

Companies that provide accounting, payroll, software, cloud, courier or call centre services often process personal data on behalf of a company. The data controller is jointly responsible with these data processors (veri işleyen) for data security measures. Data processor agreements that set out for what purpose and within what limits the data will be processed, the security obligations, the use of sub-processors and the return or deletion of the data when the contract ends prevent disputes over responsibility.

Servers and software located abroad, or sharing with foreign business partners, may count as a transfer of data abroad. Under the amendment made in 2024, transfers can be made to countries for which the Board has issued an adequacy decision; where there is no adequacy decision, with appropriate safeguards such as standard contracts or binding corporate rules; and where these are not available either, in the occasional cases listed in the law. A standard contract must be notified to the Personal Data Protection Authority (Kurum) within five working days of its signing.

Employee Data and Camera Recordings

The employer processes a large amount of data, such as personnel files, payroll, leave and performance records, medical reports and the results of pre-employment medical examinations. Since health data is special category data, access to it must be limited to authorised persons. Monitoring of corporate e-mail and computers, vehicle tracking systems and biometric entry-exit systems are assessed under the principle of proportionality, and employees must be informed in advance. For details, please see the employee data protection page.

Security cameras process personal data because they record images. Information must be provided in the areas where cameras are located, recordings must be kept for a period limited to the purpose, and access to the recordings must be limited to authorised persons. Placing cameras in areas where the protection of private life comes first, such as toilets and changing rooms, is incompatible with the principle of proportionality.

Websites and Cookie Compliance

Contact forms, membership systems, analytics tools and advertising technologies collect personal data through a website. For analytics and marketing cookies, other than the cookies strictly necessary for the site to function, the user’s explicit consent is required; these cookies should not run before the user gives consent, and the option to reject should be offered as easily as the option to accept. As part of cookie and website compliance, the tools used on the site are reviewed one by one and the cookie policy is prepared accordingly.

Data Breaches and Sanctions

If personal data is obtained by unauthorised persons, lost or unlawfully shared, the data controller must notify the data subjects and the Board as soon as possible. By a Board decision, the time limit for notifying the Board has been set at 72 hours from becoming aware of the breach. Data breach management covers detecting the incident, identifying the affected persons and data types, making the notifications and taking measures to prevent it from happening again.

Breaches of the duty to inform, of the obligations relating to data security, of Board decisions and of the VERBİS registration and notification obligation are subject to administrative fines under the law. The fine amounts are updated every year according to the revaluation rate (yeniden değerleme oranı). In addition, data subjects may claim compensation, and criminal liability may arise under the Turkish Criminal Code (TCK) for unlawfully recording personal data, giving it to others or obtaining it. Where a data leak results from a cyber attack, you can also see the IT law page for proceedings relating to cybercrime.

Rights of Individuals Whose Data Has Been Breached

Everyone has the right to learn whether data about them is being processed; to request information if it has been processed; to learn the purpose of the processing and the third parties to whom the data has been transferred; to request the correction of incomplete or inaccurate data and its deletion; to object to a result against them arising from analysis by automated systems; and to claim compensation for damage suffered because of unlawful processing.

To exercise these rights, an application is first made to the data controller in writing or by other methods determined by the Board. The data controller must conclude the application as soon as possible and within 30 days at the latest, as a rule free of charge. If the application is rejected, the answer is found insufficient or no answer is given in time, a complaint can be made to the Board within 30 days of learning of the answer and, in any case, within 60 days of the application date. Those whose personality rights have been violated also retain the right to claim material and non-material damages under the general provisions.

KVKK Compliance and Data Protection in Mersin

In Mersin, personal data is processed intensively: hospitals, clinics and laboratories process health data; hotels on the coast and accommodation facilities in holiday areas process guests’ identity details; logistics, customs and foreign trade companies operating around the Port of Mersin and the Mersin Free Zone process data shared with business partners abroad; e-commerce businesses process customer and order data; and schools and courses process information about students and parents. In these businesses, compliance work is shaped by the specific data flow of the sector.

A person whose data has been processed unlawfully can also file a compensation lawsuit based on tort (haksız fiil) in the court of their own place of residence; someone living in Mersin can file this lawsuit in the civil courts of first instance (asliye hukuk mahkemesi) in Mersin. For those living in districts such as Tarsus, Erdemli, Silifke, Mut and Anamur, the courts of that district have jurisdiction. For acts that constitute a crime, a complaint can be filed with the Chief Public Prosecutor’s Office (Cumhuriyet başsavcılığı). Since complaints to the Board can be submitted in writing, there is no need to travel to Ankara; for those living in another city, the process can be conducted from here with a power of attorney.

Frequently Asked Questions