With the enactment of the Personal Data Protection Law No. 6698 in 2016, a new regulatory framework has been established in the field of personal data, imposing additional obligations on companies. These obligations primarily include preparing company data inventories, fulfilling the obligation to inform, obtaining explicit consent from individuals when necessary, ensuring data security, responding to applications, complying with the decisions of the Personal Data Protection Board, and registering with the data controllers’ registry. Aksan Law Firm has provided legal consultancy services to numerous companies in their compliance processes with personal data protection legislation since the law came into effect.

Our services include:

• • Identifying (or establishing if necessary) the organizational departments related to the Personal Data Protection Law (KVKK) within the company, holding KVKK-focused meetings with these departments, identifying requirements and deficiencies, and shaping KVKK compliance actions accordingly,
  • Providing training on the obligations brought by the KVKK to company employees and organizing new training sessions at regular intervals for new staff,
  • Creating a data inventory for each department concerning the currently recorded or to-be-recorded personal data and regularly updating these data inventories,
  • Establishing a systematic data management discipline within the company based on the prepared data inventory and preparing a compliance document set (information notice, data processing policies, privacy policy, cookie policy, explicit consent texts, electronic commercial communication permission, etc.), and regularly updating the documents within this set,
  • Reviewing and, if necessary, negotiating and revising all contract texts the company is or will be a party to, in terms of KVKK compliance,
  • Carrying out the registration procedures of the company with the data controllers’ registry (VERBIS),
  • Actively supporting the company in responding to applications from third parties regarding KVKK and GDPR,
  • Keeping the company’s authorized team updated with the decisions or announcements issued by the Personal Data Protection Authority related to KVKK, determining new company policies in the event of regulatory changes, and ensuring necessary actions are taken within the company.