A technical checklist for a KVKK-compliant website and software
Türkiye's Law No. 6698 requires anyone processing personal data to inform people, have a lawful basis, collect only what is needed and keep it secure. For a website that means privacy notices on forms, not asking for unnecessary fields, cookie consent, HTTPS, separated access rights, logging and a retention period. If data goes to servers abroad, the transfer regime that took effect in 2024 applies. This article is a technical checklist, not legal advice.
- Data you never collect is data you never have to protect
- A privacy notice is not the same as consent
- Security measures must be written down and actually applied
- Cross-border transfers have their own rules
What counts as personal data?
Under Law No. 6698, personal data is any information relating to an identified or identifiable natural person: name, phone, email, IP address, location, an employee check-in record. A contact form on a website is, by itself, a data processing activity.
The minimum list for a website
- Privacy notice: who processes what data, for which purpose and on which lawful basis, how long it is kept and who it is shared with — reachable from the form itself.
- Consent only where needed: data necessary to perform a contract does not require consent. Consent is for extra purposes such as marketing, in a separate, unticked box.
- Data minimisation: don't ask for a national ID number in a quote form. A field you don't need is a field you are liable for.
- Cookies: non-essential cookies (analytics, advertising) need consent and must not run before it.
- Secure transport: HTTPS everywhere, and form data should not travel as plain email.
- Retention and deletion: decide how long submissions are kept, and actually delete them when the time comes.
Technical measures in the software
The Authority collects the expected technical and administrative measures in its published guidance at kvkk.gov.tr. The gaps we see most often are these:
- Separated permissions: not every user should see every record. Role-based authorisation is what decides how big a leak becomes.
- Logging: who saw or changed which record, and when? Without a trail you cannot even scope an incident.
- Encryption: passwords stored irreversibly, backups encrypted too.
- Updates: scan dependencies for known vulnerabilities. Supply chain now has its own entry in the OWASP 2025 list.
- Test data: never use real customer data in a test environment.
Transfers abroad
If your server or SaaS provider is abroad, data is being transferred abroad. Article 9 of the law was amended by Law No. 7499 and the new regime took effect on 1 June 2024, with the implementing regulation published on 10 July 2024. The Authority's transfers page explains the order of adequacy decisions, appropriate safeguards and exceptions. In practice it means standard contracts with the provider and the required notification.
Common mistakes
- Copying a privacy notice from another site and changing the company name.
- Pre-ticking the consent box.
- Loading advertising and analytics tags before consent.
- Letting form submissions pile up in an inbox for years.
- Giving every panel user admin rights.
Compliance is a design job, not a paperwork job: half of it is done the moment you decide which data you will never collect.
This article is general information, not legal advice. Work with your lawyer on your own processes.
Sources
- Turkish Data Protection Authority, kvkk.gov.tr
- Turkish Data Protection Authority, Transfers abroad
- OWASP, OWASP Top 10:2025
Frequently asked questions
Does a small business have obligations too?
Yes. Obligations follow whether you process personal data, not company size, though some duties such as registry entries have thresholds.
Is using Google Analytics a problem?
Analytics cookies are not strictly necessary cookies, so they must not run before consent, and where the data goes has to be assessed.
Is receiving form data by email enough?
It works, but it isn't good. Retention, access rights and deletion cannot be managed in an inbox.
What if there is a breach?
The law expects notification to the Authority and affected people as soon as possible after it is discovered — which is why logging and being able to scope an incident quickly matters.
