Personal Data Protection Law
Law No. 6698 on the Protection of Personal Data (KVKK) imposes obligations on data controllers and data processors in the processing of personal data. As Ertan Law & Consultancy, in Bursa we support companies and institutions in the KVKK compliance process and assist data subjects in exercising their rights.
Our KVKK Compliance Services for Companies
- Personal data inventory: Determining which data is processed, for which purpose, with whom it is shared, and for how long.
- VERBİS: Assessment of the registration obligation, registration, and update processes.
- Information and explicit consent: Separate information texts for employees, customers, visitors, and business partners, and explicit consent texts where required. The information text and explicit consent serve different legal functions and must be drafted separately.
- Policies: Personal data processing and protection policy, retention and destruction policy, data security procedures.
- Contracts: Data processor contracts, confidentiality undertakings, and KVKK clauses in employment contracts.
- Employee data: Personnel files, camera records, attendance tracking systems, e-mail monitoring.
- Camera and digital monitoring: Workplace, site, and store cameras, the obligation to inform, and retention periods.
Changes Made with Law No. 7499
The amendments to the Law made in 2024 have re-regulated the conditions for processing special categories of personal data and the regime for transfer abroad. In transfer abroad, instruments such as an adequacy decision, standard contracts, binding corporate rules, and exceptional circumstances are used. The notification of standard contracts to the Authority is also part of the regulation. Compliance work must be carried out in accordance with this current framework.
Data Breach Management
Upon the detection of a data breach, notification must be made to the Board within seventy-two hours from the moment the breach is learned. Recording the breach, informing the affected persons, and taking technical measures must be carried out in a planned manner in the first hours. For this reason, it is important to prepare a breach response plan in advance.
For Data Subjects
Within the scope of Article 11 of the Law, application to the data controller, complaint to the Board and recourse to the judiciary if no response is received. We provide legal support in requests for the deletion, correction, and objection to processing of personal data. There are also statutory objection and litigation avenues against administrative fines.