Poroy Law Firm

TR / EN

Data Protection (KVKK)

Processing data, assuming responsibility.

Every organisation that processes personal data is at the same time bound to protect it.

Overview

With Law No. 6698 in force, processing personal data has ceased to be a purely technical activity and has become a process that gives rise directly to legal responsibility. An information obligation left incomplete, or a data breach notified late, can result in substantial administrative fines and reputational loss.

The firm treats KVKK compliance not as a one-off drafting exercise but as a continuing process built into how the organisation operates. The aim is both to protect the client from the sanctions of the Personal Data Protection Board and to make data security part of its corporate standing.

Scope

Matters
handled.

  • Conduct of compliance projects and preparation of the personal data inventory
  • Drafting of information notices, explicit consent statements and privacy policies
  • Registration with the data controllers' registry (VERBİS) and follow-up
  • Notification of the Board and of data subjects in the event of a breach
  • Responding to data subject requests and establishing internal procedures
  • Determination and implementation of administrative and technical measures
  • Contract and authorisation processes for transfers of data abroad
  • Comparative KVKK and GDPR compliance advice
  • Actions for the annulment of decisions of the Personal Data Protection Board

Points to Note

What matters
in practice.

The points that most affect the outcome in this area, and are most often overlooked.

The breach notification period

Once a data breach becomes known, the Board must in principle be notified without delay, within 72 hours. Missing that period is in itself a separate ground for sanction.

The limits of consent

Explicit consent is not the basis for every processing activity and may be withdrawn at any time. Where possible, relying on the other lawful grounds for processing is the safer course.

Transfers abroad

Personal data may be transferred abroad only where the conditions in the Law are met. Cloud services and foreign servers often create a transfer that is easily overlooked.

Other practice areas

Commercial and Corporate Law Incorporation, share transfers, contracts and shareholder disputes. Employment Law Contracts, termination procedures, reinstatement and wage claims. Law of Obligations Contracts, default, tort, unjust enrichment and compensation disputes. Real Estate & Tenancy Law Title, condominium, lease, eviction and expropriation disputes. Enforcement & Insolvency Law Debt recovery, attachment, objection annulment, composition and bankruptcy. Administrative Law Annulment and full-remedy actions; zoning, disciplinary, tender and tax disputes. Criminal Law Defence counsel in investigation and prosecution; custody, detention and appeal proceedings. Family Law Divorce, custody, maintenance and matrimonial property disputes: advice and litigation. Consumer Law Defective goods, distance sales and withdrawal disputes: arbitration panels and litigation. Insurance Law Motor, fire and life insurance claims: arbitration and litigation. Information Technology Law Personality rights online, content removal, cyber offences and e-commerce disputes. Trademark & Patent Law Trademark infringement, unfair competition, counterfeit goods and industrial property disputes. Sports Law Athlete and club contracts, transfers, disciplinary matters and arbitration disputes.

Do you have a matter
in this area?

You may request an initial meeting by telephone or email, and bring the relevant documents with you.

Request a meeting