Kodakod Team
If you have a contact form, you are processing personal data. From privacy notices and cookie management to cross-border transfers, VERBİS and retention periods, we cover the common mistakes and a 10-point checklist, based on the KVKK Authority's own sources.
In short: If your site has a contact form, newsletter sign-up, analytics tool or advertising pixel, you are processing personal data under KVKK — Turkey's Personal Data Protection Law No. 6698. At a minimum you need: a privacy notice specific to you, given at the moment you collect the data; explicit consent, obtained in advance through an active choice, for non-essential cookies; retention periods and a deletion routine; appropriate security measures; and a legal basis for data sent abroad that meets the rules changed in 2024. This article is a technical checklist, not legal advice; have a lawyer do the final review of your texts.
What causes companies the most trouble with KVKK is not the legislation itself but second-hand assumptions. Below we have collected the misconceptions we hear most often while working on websites, and what the official sources say about each one. At the end there is a checklist table you can use to review your own site.
Our sources: the current text of Law No. 6698, the Personal Data Protection Authority's Guide on Cookie Practices (Çerez Uygulamaları Hakkında Rehber; first published June 2022, the current version on kvkk.gov.tr is dated July 2025), the Communiqué on the Duty to Inform, and the Regulation on Transfers of Personal Data Abroad published on 10 July 2024. All of them are published in Turkish.
"We don't process personal data"
This is the most common and riskiest assumption. The law defines personal data as "any information relating to an identified or identifiable natural person", and processing covers every operation from obtaining data to storing and transferring it. If you have a contact form, newsletter sign-ups, visitor statistics or a comment section, you are processing personal data.
Personal data is not just an identity number; besides name, email and phone, information that makes a person indirectly identifiable — such as an IP address or cookie identifiers under certain conditions — can fall within scope. The Cookie Guide itself mentions IP masking as an example measure for reducing identification risk in analytics tools.
"We found a privacy notice online and put it up, so we're covered"
A template does not show that you are compliant; it shows that you have not taken the matter seriously. Under Article 10 of the law, when you obtain the data you must state: the identity of the data controller, the purpose of processing, to whom and for what purpose the data may be transferred, the method and legal basis of collection, and the person's rights under Article 11. A notice describing another company's operations does not legitimise yours.
The Cookie Guide stresses two points: the notice must be easy to access, and a complex "Privacy Notice" covering many other topics does not count as fulfilling the duty to inform. If processing relies on explicit consent, the notice and the consent must be obtained separately.
"We added a cookie banner, so we're fine"
There are two separate errors here. First: "by continuing to use the site you accept cookies" is not consent. The Cookie Guide states that explicit consent must be obtained through an active, affirmative action and that simply entering a site does not mean consent — and it shows exactly this sentence as a "bad example".
Second, and more often missed: cookies that require explicit consent — advertising and behavioural targeting cookies first among them — must not run before the user consents. The Guide requires consent to be obtained before cookies are placed, and those cookies to be switched off by default in the preferences panel. On most sites, tracking code has already executed while the banner is still on screen.
The Guide's example of good practice: a panel on entry; "Accept", "Reject" and "Preferences" buttons that are equal in colour, size and font; and a choice that is easy to withdraw and not asked again on every visit. If the accept button is large and colourful while the reject option hides behind a menu, the setup is flawed.
One nuance: the Guide considers that first-party analytics cookies limited to measuring the site's own traffic, producing anonymous statistics, not tracking across sites and not passing data to third parties may not require explicit consent. This is a narrow exception; whether common analytics tools that send data to another company fall within it should be assessed with a lawyer for your specific setup.
"If a customer wrote to us, we can email them"
For campaign announcements, in most cases no. Commercial electronic messages are also governed by Law No. 6563 on the Regulation of Electronic Commerce, and under Article 6 they may only be sent with the recipient's prior consent. The same article sets two exceptions: a recipient who has given their contact details does not need to consent separately to messages about changes to, use of or maintenance of goods or services they have obtained; and messages may be sent to tradespeople and merchants without prior consent.
The practical rule: collecting data in order to reply and obtaining permission for commercial messages are two different things and should be handled separately in the form. The second must be entirely optional, and the checkbox must not arrive pre-ticked.
"There's no harm in keeping the data, we might need it"
The law says precisely the opposite: under Article 4, data is kept only as long as the legislation requires or the purpose needs; under Article 7, once the reason for processing ends, it is deleted, destroyed or anonymised. A quote request from three years ago still sitting in your database cannot be defended with "we might need it."
Set a retention period for each data type, put it in writing, and build a deletion mechanism for records that reach it. A system that does not clear itself will eventually fall out of compliance.
"Our site is on HTTPS, security is handled"
HTTPS is necessary but not sufficient. Article 12 of the law requires "all necessary technical and administrative measures" to prevent unlawful access and to safeguard data, and states that you are jointly responsible with the suppliers that process data on your behalf (hosting, email, CRM). The minimum measures we expect on a website: an encrypted connection, strong and preferably two-factor authentication, restricted admin panel access, separation of privileges, up-to-date software and tested backups.
Two frequently missed details: the country where backups are held falls within scope too, because backups contain personal data as well. And if data is obtained by unauthorised parties, Article 12 requires you to notify the people concerned and the Board as soon as possible; decide who makes that notification before an incident happens.
"We use Google Analytics, so that's Google's responsibility"
Every external script you add to a site carries visitor data to another company, and responsibility sits with the site owner. The Cookie Guide states that with third-party cookies, both the site owner and the third party are responsible for informing users and obtaining consent. These tools must be named in your privacy notice, and if data is transferred abroad, that must be addressed separately.
This is also the most common source of non-compliance we encounter in practice: tracking scripts added over the years that nobody remembers any more. If you cannot produce a list of the third-party tools running on your site, that is the first job.
Transfers abroad: what changed in 2024?
If your server, email service, form tool or analytics provider is outside Turkey, you may be transferring data abroad. Article 9 of the law was amended by Law No. 7499, and the new provisions took effect on 1 June 2024. The system is tiered:
- Adequacy decision: a decision by the Board, published in the Official Gazette, covering the destination country, sector or international organisation.
- Appropriate safeguards: if there is no adequacy decision, a safeguard such as standard contractual clauses, binding corporate rules approved by the Board, or a written undertaking with the Board's permission. Standard contracts must be notified to the Authority within five business days of signing; a separate administrative fine for failing to do so was added to the law.
- Incidental transfers: if neither exists and the transfer is not regular, a limited set of cases — for example, explicit consent from a person informed of the possible risks, or necessity for performing a contract with that person.
The practical consequence: treating the regular, daily transfers of an analytics or marketing tool as "incidental" and relying solely on explicit consent does not appear consistent with the new system. Clarify with your lawyer which tool transfers data on which basis.
Do we need to register with VERBİS?
Article 16 of the law requires registration with the Data Controllers' Registry (VERBİS), but the Board may grant exemptions. According to the Authority's announcement, under Board decision 2023/1154, data controllers with fewer than 50 employees per year and an annual balance-sheet total below TRY 100 million, whose main activity is not processing special categories of personal data, are exempt from registration. Decision 2025/1572 extended the exemption to controllers whose main activity is processing special-category data but who have fewer than 10 employees and a balance-sheet total below TRY 10 million.
Because exemptions can be updated by Board decisions, check the current position on the "Exemptions from Registration" page of kvkk.gov.tr. A VERBİS exemption does not exempt you from the duties to inform, secure data, apply retention rules and answer requests.
"You handle this once and it's done"
Compliance is not a document exercise but a living part of your site. Every new form, integration and marketing tool puts the list back on the agenda. Under Article 13, requests from visitors exercising their rights must be concluded within thirty days at the latest and, as a rule, free of charge; it should be clear which channel requests come through and who answers them.
Checklist
| Check | How to test it | Basis |
|---|---|---|
| Every form has a notice specific to that form | List your forms; check that purpose, legal basis, transfers and rights are stated | Law Art. 10, Communiqué on the Duty to Inform |
| Explicit consent is separate from the notice and optional | Check whether checkboxes are pre-ticked or bundled with the notice | Law Arts. 3 and 5, Communiqué on the Duty to Inform |
| Non-essential cookies do not run before consent | In a private window, without touching the panel, inspect cookies and network requests in developer tools | Cookie Guide |
| Accept, reject and preferences are equal; consent can be withdrawn | Check that rejecting takes one click and that a persistent link reopens the panel | Cookie Guide |
| Commercial message consent is a separate option | Collect contact consent and campaign consent in separate boxes | Law No. 6563 Art. 6 |
| Retention periods and a deletion routine exist | Look at the date of the oldest form record in your database | Law Arts. 4 and 7 |
| An up-to-date list of third-party scripts exists | Scan the tag manager and page source and list each tool with its purpose | Law Arts. 10 and 12, Cookie Guide |
| The basis for transfers abroad is clear | Check the location and contracts of your server, email, CRM and analytics providers | Law Art. 9, Transfers Abroad Regulation |
| The admin panel is protected | Check for two-factor authentication, separation of privileges, current versions and tested backups | Law Art. 12 |
| A request channel and owner are defined | Send a test request to the address in your privacy notice | Law Arts. 11 and 13 |
Our role and the lawyer's role
Drafting the legal texts and deciding which legal basis to rely on is a lawyer's job; this article is not a substitute for legal advice. Ours is making sure your site actually delivers on the promises those texts make: cookies that genuinely run only after consent, forms linked to the right notice, old records that are genuinely deleted. We build this foundation from the start in our corporate website and e-commerce projects; if you are planning to add an AI assistant or chatbot to your site, the same questions apply there.
Related reading: Responsible AI: Data Security, Hallucination, and KVKK Compliance, 8 common mistakes when launching an e-commerce site and our WhatsApp chatbot setup guide.
If you would like to review these items on your own site, we can look at the technical side together.
Frequently asked questions
Yes. KVKK applies to any natural or legal person processing personal data, regardless of size. Size can only be a reason for exemption from certain obligations such as VERBİS registration; the duties to inform, secure data, apply retention rules and answer requests apply to everyone.
The Cookie Guide considers that first-party analytics cookies that only measure the site's own traffic, produce anonymous statistics, do not track across sites and do not pass data to third parties may not require explicit consent. Tools that do not meet these conditions need prior explicit consent; have a lawyer assess your setup.
No, but under Article 9, in force since 1 June 2024, you need a basis: an adequacy decision, an appropriate safeguard such as standard contractual clauses, or in limited cases an incidental transfer. If you sign a standard contract, it must be notified to the Authority within five business days.
Under Article 13 of the law, the request must be concluded as soon as possible depending on its nature, and within thirty days at the latest, as a rule free of charge. To avoid missing the deadline, state in your privacy notice which channel (for example, an email address) requests should be sent to, and log every request with its date.
No. The Cookie Guide of Turkey's data protection authority (KVKK) states that explicit consent must be obtained through an active, affirmative action, that simply entering a site is not consent, and shows exactly this sentence as a bad example. Consent-based cookies such as advertising and targeting cookies must not run before approval and must be off by default in the preferences panel, with Accept, Reject and Preferences offered with equal prominence.
