The Law on the Protection of Personal Data No. 6698, which entered into force in 2016, introduced a new regime in the field of personal data and additional obligations for companies. These obligations include preparing data inventories, complying with the duty to inform, obtaining explicit consent where required, ensuring data security, responding to applications, complying with the decisions of the Personal Data Protection Board and registering with the Data Controllers Registry. In this respect, Aksan Law Firm has been advising clients in their compliance with personal data protection legislation since the law came into force.
- Identifying (and, where necessary, establishing) the company departments involved in KVKK compliance, holding KVKK-focused meetings with them, identifying needs and gaps and shaping compliance actions accordingly;
- Training company personnel on the obligations brought by KVKK and arranging refresher trainings for new joiners at regular intervals;
- Preparing a data inventory by department for personal data already stored or to be stored, and updating it on a regular basis;
- Building, on the basis of the data inventory, a systematic data management framework within the company and producing the related compliance set (information notices, data processing policies, privacy policy, cookie policy, explicit consent texts, e-commerce communication consents, etc.) and updating these documents regularly;
- Reviewing all contracts to which the company is or will be a party from a KVKK perspective and, where necessary, negotiating and revising them;
- Carrying out the company's registration with the Data Controllers' Registry ("VERBİS");
- Active support in responding to KVKK and GDPR-related applications from third parties;
- Communicating Personal Data Protection Authority decisions and announcements to the company team in real time, defining new corporate policies in the event of legislative changes and ensuring necessary actions are implemented.
