Our Managing Partner, Erdem Mümtaz Hacıpaşaoğlu, delivered the session “KVKK & GDPR: Applied Legal Framework for Fintechs” on 21 January 2026, as part of the Finext 2025 cohort’s weekly training programme run by Dijitalpark Teknokent. Held online, the session took the startups in the programme through the two data protection regimes not in textbook order, but through their own business models.
Not Every Fintech Processes the Same Data
The session began from a misconception that recurs across the fintech ecosystem: that KVKK and GDPR compliance can be reduced to a single checklist that fits every startup. Mümtaz built the framework around the distinction between business models, working through the points at which payment service providers, electronic money institutions, lending and alternative finance platforms, insurance technologies, investment and wealth management applications, and structures operating through open banking diverge from one another. Which data is processed in which capacity, where the line between controller and processor shifts, where retention duties arising from financial regulation pull against data protection principles, and in which models cross-border transfer becomes unavoidable — these formed the spine of the session.
An Applied Framework
The session read the two regimes in parallel. A Turkish fintech opening to the European market, or taking users from Europe, can fall under both at once, and mapping where the two overlap and where they part company is considerably cheaper done in advance than corrected afterwards. Participants were given an applied framework for identifying which category their own product falls into, and at which stage of the product roadmap the obligations of that category need to be addressed.
Vircon Legal continues to advise financial technology ventures on regulatory compliance, data protection and corporate structuring.
