Every KVKK compliance folder we open in diligence contains a document called the “personal data retention and destruction policy”. Most of them were generated from a template the week before the VERBİS registration, list retention periods nobody has checked against the company’s systems, and have never triggered a single deletion. That is the wrong way round. The Regulation on the Deletion, Destruction or Anonymisation of Personal Data (Official Gazette 28 October 2017, No. 30224, amended 28 April 2019, No. 30758), issued under Article 7 of the Personal Data Protection Law No. 6698 (KVKK), does not ask for a document; it asks for a working cycle in which data whose processing conditions have all lapsed is deleted, destroyed or anonymised, on a schedule the company itself commits to and can prove it kept. This article explains who must have the policy, what it must contain, how the retention table is built from the processing inventory, the six-month and three-month clocks, what happens when a data subject asks, and how the three-year record of destruction operations becomes the evidence an auditor or the Board will ask for. It pairs with our guides on data subject requests and anonymisation.
Who must have a policy, and who must delete anyway
Article 5(1) of the Regulation obliges data controllers who are required to register with the Data Controllers’ Registry under Article 16 of the KVKK to prepare a personal data retention and destruction policy consistent with their personal data processing inventory. The two documents are therefore linked by design: the inventory lists each processing activity with its purpose, legal basis, data categories, recipients and maximum retention period, and the policy is the rulebook that turns those periods into deletion events. Article 5(2) adds a warning that is routinely ignored: having a policy does not mean the data is being retained or destroyed lawfully. And Article 5(3) closes the escape route for controllers below the registration thresholds: a company that is not obliged to prepare a policy is still obliged, under the Law and the Regulation, to retain, delete, destroy or anonymise personal data in accordance with them. A ten-person SaaS company exempt from VERBİS still has to delete; it simply has a different deadline, which we come to below.
What the policy must contain
Article 6 sets the minimum content, and each item maps to a question a regulator or buyer will ask. The policy must state its purpose; the recording media it covers (the databases, SaaS tools, file servers, e-mail, paper archives and backups where personal data actually lives, which is the first place templates go wrong by listing generic “electronic media”); definitions of the legal and technical terms used; the legal, technical or other reasons that require retention and destruction, meaning the statutes that impose minimum retention (tax and commercial books under the Tax Procedure Law and the Commercial Code, labour and social security records, the Law No. 5651 traffic logs, sector rules) and the purposes that end; the technical and organisational measures taken to store data securely and prevent unlawful processing and access; the technical and organisational measures taken to destroy data lawfully; the titles, units and job descriptions of the people involved in retention and destruction; a table showing retention and destruction periods; the periodic destruction intervals; and, if the policy has been updated, the changes made. Two of these deserve their own sections.
The retention table
The table is the heart of the policy and the part that must be derived from the company’s real processing rather than copied. For each process or data category it states the retention period and the destruction period. The retention period is the maximum time for which the data is needed for the purpose, or the minimum a statute imposes, whichever is longer; the destruction period is the first periodic destruction after that. A practical build runs process by process: customer account data for the life of the contract plus the limitation period for contractual claims under the Code of Obligations; invoices and accounting records for the periods the Tax Procedure Law and the Commercial Code prescribe; job applicants’ CVs for a short, stated period after the position is filled unless consent to a talent pool is obtained; employee files for the periods labour and social security legislation require after termination; CCTV footage for days or weeks, not years; server and access logs for the statutory period where Law No. 5651 applies. Where the Board has spoken (for example in its decisions on CCTV proportionality and on biometric data), the table should follow the decision. The table must then be implemented in the systems: a retention period that the CRM cannot enforce and nobody runs manually is a promise the policy makes and the company breaks.
Deletion, destruction and anonymisation are three different operations
Article 7(1) states the trigger: when all of the processing conditions in Articles 5 and 6 of the Law have ceased to exist, the data must be deleted, destroyed or anonymised, either by the controller of its own motion or on the data subject’s request. The three methods are defined separately. Deletion (Article 8) makes the data inaccessible and unusable in any way for the relevant users; the data may physically persist, but no one who could use it can reach it, which is why access-rights management is part of deletion. Destruction (Article 9) makes the data inaccessible, irretrievable and unusable by anyone, in any way, which for storage media means secure wiping or physical destruction. Anonymisation (Article 10) renders the data incapable of being linked to an identified or identifiable natural person even when matched with other data, and Article 10(2) makes clear that the test is whether the controller, the recipient or recipient groups could reverse it using techniques appropriate to the recording medium and field of activity; pseudonymised analytics tables are not anonymous. Under Article 7(5) the controller chooses the appropriate method when acting of its own motion, unless the Board decides otherwise, and must explain its reasons when choosing a method in response to a data subject’s request. Article 7(4) requires the methods used to be explained in the policy and procedures.
The clocks: six months, three months, thirty days
Article 11 sets the schedule for destruction on the controller’s own motion. A controller that has prepared a policy deletes, destroys or anonymises the data in the first periodic destruction following the date on which the obligation arose (Article 11(1)); the interval between periodic destructions is set in the policy and may in no case exceed six months (Article 11(2)). A controller that is not obliged to prepare a policy must act within three months of the date on which the obligation arose (Article 11(3)); this is the deadline the small company exempt from VERBİS actually lives under, and it is shorter, not longer, than the policy-holder’s. The Board may shorten these periods where irreparable harm would otherwise arise and the unlawfulness is clear (Article 11(4)). Article 12 governs requests: where a data subject asks under Articles 11 and 13 of the Law for deletion or destruction and all processing conditions have lapsed, the controller deletes, destroys or anonymises the data and concludes the request within thirty days at the latest, informing the data subject; where the data has been transferred to third parties, the controller notifies them and ensures they act under the Regulation; and where the processing conditions have not all lapsed, the request may be refused with reasons under Article 13(3) of the Law, the refusal being communicated in writing or electronically within thirty days. The thirty-day clock is the same one that governs all data subject requests, so the deletion workflow should be a branch of the request-handling procedure, not a separate document.
The record that proves it happened
Article 7(3) requires all deletion, destruction and anonymisation operations to be recorded, and the records to be kept for at least three years, without prejudice to other legal obligations. This is the evidence layer. A destruction log should record, for each periodic destruction and each request-driven operation, the date, the data categories and recording media concerned, the method used, the person who performed and the person who approved it, and any exception (data retained because a statutory period or a pending dispute required it, with the reason). Article 7(2) ties every operation to the general principles of Article 4 of the Law, the technical and organisational measures of Article 12, the Board’s decisions and the policy itself, so a destruction that departs from the policy is itself a breach even if the data was in fact deleted. Together with the inventory, the VERBİS entry, the privacy notices and the request log, the destruction log is what a KVKK compliance audit or a buyer’s diligence team reads; a company that can show four or five dated periodic destructions a year has a compliance programme, and one that can show only the policy has a document.
Our backups keep everything for a year. Is that a breach?
Not in itself, if the policy names backups as a recording medium, sets their retention period, and ensures that restored data is re-deleted. The Board expects backups to be within the cycle, not outside it. Indefinite backup retention with no deletion path is a breach.
Can we anonymise instead of deleting to keep analytics?
Yes, if the result meets Article 10: unlinkable even when matched with other data available to you or the recipients. Aggregated statistics usually qualify; user-level tables with a hashed identifier do not. Record the method and the assessment.
We are below the VERBİS thresholds. Do we need the policy at all?
Not the policy, but the deletion. Article 11(3) gives you three months from the date the obligation arises, with no periodic-destruction cushion, and Article 7(3) still requires the three-year record. Most companies find that a short policy is easier than tracking individual three-month deadlines.
Related: VERBİS · processing inventory · anonymisation · data processing agreements.
Sources. Personal Data Protection Law No. 6698 (Articles 4–7, 11–13, 16); Regulation on the Deletion, Destruction or Anonymisation of Personal Data (Official Gazette 28 October 2017, No. 30224; amended 28 April 2019, No. 30758), Articles 5–12; Personal Data Protection Authority, guidance on deletion, destruction and anonymisation. Statute links open the official Turkish texts.
This article is provided for general information only and does not constitute legal advice. Please seek legal support for an assessment of any specific matter.
Author
More from Vircon Insights
When the Model Decides About a Person: Hiring, Performance and KVKK Article 11
October 7, 2026AI in the Workplace: The Use Policy, the Limits of Monitoring and Automation-Driven Restructuring
October 6, 2026The Share Ledger: The Legal Version of Your Turkish Cap Table (TCC 499)
October 6, 2026Feeding Company Data to a Model: KVKK Basis, Transfer Abroad and the Trade Secret You Just Uploaded
October 5, 2026Privileged Shares in a Turkish Joint-Stock Company: How Liquidation Preference and Investor Vetoes Are Actually Built
October 5, 2026The Data Processing Agreement Under KVKK: How It Differs from GDPR Article 28 and What to Put in the Annexes
October 2, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →US Company Formations & Flip-Ups
Delaware C-Corp, flip-up structures, SAFE/convertible notes, 83(b).
View service →