GDPR and KVKK Essentials

The GDPR (EU General Data Protection Regulation, 2018) and Turkey's KVKK (Kanun No. 6698, 2016) are the two frameworks this lesson covers. KVKK was heavily modeled on the EU approach, so the core principles align closely.

Both regulate how personal data is processed and grant strong rights to individuals, backed by significant penalties.

Both laws define core roles:

• Data subject (KVKK: ilgili kisi): the person the data is about
• Controller (KVKK: veri sorumlusu): decides why and how data is processed
• Processor (KVKK: veri isleyen): processes on the controller's behalf

The controller carries primary accountability, even when work is outsourced to a processor.

GDPR Article 5 sets out principles KVKK mirrors:

• Lawfulness, fairness, transparency
• Purpose limitation: use data only for stated purposes
• Data minimization: collect only what is needed
• Accuracy
• Storage limitation: keep no longer than necessary
• Integrity and confidentiality (security)
• Accountability: be able to demonstrate compliance

You cannot process personal data without a lawful basis. GDPR Article 6 lists six:

• Consent
• Contract
• Legal obligation
• Vital interests
• Public task
• Legitimate interests

KVKK has a comparable set. Consent is only one option, and often not the best one, because it can be withdrawn at any time.

When you do rely on consent, it must be:

• Freely given
• Specific to a purpose
• Informed
• Unambiguous, by clear affirmative action

Pre-ticked boxes, bundled consent, and silence are not valid. Withdrawing consent must be as easy as giving it.

Individuals hold enforceable rights:

• Access: a copy of their data
• Rectification: correct inaccuracies
• Erasure (right to be forgotten)
• Restriction of processing
• Portability: receive data in a machine-readable format
• Objection, including to profiling

Requests typically must be answered within a fixed window (GDPR: one month).

Accountability requires documentation. Controllers maintain a Record of Processing Activities (RoPA) describing what data is processed, why, where it goes, and how long it is kept.

In Turkey, controllers above thresholds must register with VERBIS, the data controllers registry. These records are the first thing a regulator asks for.

Sending personal data outside the EU/EEA (or out of Turkey) is restricted. Mechanisms include:

• Adequacy decisions (the destination offers equivalent protection)
• Standard Contractual Clauses (SCCs)
• Explicit consent for the specific transfer

KVKK historically required KVKK Board approval or explicit consent for cross-border transfers, so check current rules before moving data abroad.

Enforcement bodies:

• EU: national Data Protection Authorities; GDPR fines up to 20 million euro or 4% of global annual turnover
• Turkey: the KVKK Board (Kurul), with administrative fines and the power to order processing to stop

Beyond fines, regulators can mandate corrective action and publicize violations.

Some organizations must appoint a Data Protection Officer (DPO), for example public authorities or those doing large-scale monitoring or special-category processing under GDPR.

The DPO advises on compliance, monitors it, and acts as the contact point for the regulator and data subjects. They must operate independently.

When a controller uses a processor (a SaaS vendor, cloud host, or subcontractor), a written data processing agreement (DPA) is mandatory. It binds the processor to:

• Process only on documented instructions
• Ensure confidentiality and security
• Engage sub-processors only with authorization
• Assist with data subject requests and breach reporting

Choosing a non-compliant vendor does not transfer the controller's accountability.

Test your understanding of lawful basis.

You covered GDPR and KVKK essentials:

• Controller vs processor roles and accountability
• The core principles, especially purpose limitation and minimization
• Six lawful bases; consent must be freely given and withdrawable
• Data subject rights (access, erasure, portability, objection)
• RoPA/VERBIS records and restricted international transfers
• Regulators, heavy fines, and the DPO role

Next: classifying and minimizing the data you hold.