Data protection sits at the core of how technology companies build, ship, and scale. We advise startups and international companies, across software, SaaS, gaming, e-commerce, fintech, and consumer technology, on the full data lifecycle: collection, processing, disclosure, and cross-border transfer.
Beyond documentation, we operationalise compliance: privacy policies and notices that reflect actual data flows, internal authorisation matrices, vendor and data-processing-agreement management, and incident-response support: including coordination of forensic investigations when things go wrong.
Our privacy & cybersecurity work includes, among others:
- Data protection (KVKK & GDPR) programmes and gap analyses
- In-house authorisation matrices and access governance
- Regulatory compliance reviews and audits
- IT and internet-related matters
- E-commerce transactions and platform terms
- Advertising, marketing, and social-media compliance
- Next-generation e-payment systems
How an engagement usually runs
Most data-protection engagements start with a mapping exercise: which personal data the company holds, where it comes from, which systems and vendors touch it, and on which legal basis each processing activity rests. That map becomes the backbone of everything that follows, from the VERBİS registration and the record of processing activities to the privacy notices and the retention schedule. For companies that also serve European users, we run the KVKK and GDPR analysis side by side so that a single set of documents satisfies both regimes wherever the two allow it.
After the programme is in place, the work turns to keeping it alive: reviewing new vendors and data-processing agreements, handling data-subject requests, preparing for cross-border transfers under the standard contracts and, when an incident happens, running the breach-notification clock with the Board and the affected individuals. Our KVKK & GDPR Compliance and KVKK Audit pages describe these two phases in more detail, and the KVKK Compliance Guide is written for founders who want to understand the framework before they call us.
Security duties a Turkish company actually carries
- KVKK security duty. Article 12 of Law No. 6698 requires the technical and administrative measures needed to keep personal data secure. The Board’s published decisions show what that means in practice: fines for never commissioning a penetration test, for leaving test findings unresolved, for predictable passwords and for flat networks that let an attack spread (Ransomware and Unauthorised Access).
- Breach notification. The Board must be notified within 72 hours of becoming aware of a breach (Board Decision 2019/10), with a preliminary notification if not all facts are known, and affected people informed as soon as possible (A Data-Breach Response Plan).
- Cybersecurity Law. The Cybersecurity Law No. 7545, in force since 19 March 2025, puts the Cybersecurity Presidency at the centre of the system. Fifteen sectors were designated critical infrastructure on 5 May 2026, and Law No. 7590 (31 July 2026) lets the Presidency order urgent measures that operators, access, hosting and content providers and data centres must implement within two hours (From the ICTA to the Cybersecurity Presidency).
- Selling into Europe. Since 11 September 2026, manufacturers of software and connected products on the EU market must report actively exploited vulnerabilities and severe incidents within 24 hours under the Cyber Resilience Act, including manufacturers outside the EU (The EU Cyber Resilience Act Reporting Clock).
Questions clients ask us
What technical measures does the KVKK Board expect?
The decisions are consistent: regular penetration testing and remediation of what it finds, strong and unique credentials, access control and logging, network segmentation, and encryption where data leaves controlled systems. In one decision the absence of any penetration test was the decisive factor in a TRY 1.5 million fine; in others, cost-free measures that were not taken led to significant fines.
Who is liable when our software vendor or host is breached?
The data controller, in most cases. The Board expects controllers to supervise their processors in practice, not only by contract: a security undertaking in the agreement is not enough on its own, and audit rights should actually be used (Service Provider Related Breaches).
How quickly must we notify a data breach?
Within 72 hours of becoming aware of it, to the KVKK Board; if not everything is known, a preliminary notification is made and completed later, with the reasons for any delay explained. Affected individuals are informed as soon as possible. Where GDPR also applies, the European supervisory authority’s 72-hour clock runs in parallel (Breach Notification: Five Decisions).
Does the Cybersecurity Law apply to our company?
The Law sets the framework for everyone operating in Türkiye’s cyberspace, but the heavier obligations depend on the sector: critical infrastructure operators, electronic communications operators, access, hosting and content providers and data centres carry the most direct duties, including the two-hour window for urgent measures. A SaaS or e-commerce company should check where its hosting and service providers sit, because their obligations flow into its contracts.
We sell software to European customers. What changes for us?
GDPR applies if you offer goods or services to people in the EU, and the Cyber Resilience Act’s 24-hour reporting duty already applies to software and connected products on the EU market. Contracts with European enterprise customers increasingly add their own incident-reporting and audit clauses, which should be aligned with your KVKK breach procedure so the same incident does not run three different clocks.
Reading
- Authentication, Email and Physical Access: The Security Standard in Five Decisions
- Will Insurance Pay When the Model Is Wrong? E&O, Cyber and Product Liability
Sources. Law No. 6698 on the Protection of Personal Data (KVKK) and Regulation (EU) 2016/679 (GDPR). Statute links open the official consolidated Turkish texts on mevzuat.gov.tr.
Other Practice Areas
The team you will work with in this area
Click a name for the profile.
