Data Processing Agreements and Policies

Companies rarely process personal data on their own: payroll services, cloud infrastructure, call centres, couriers and software suppliers all have access to it. Setting up these relationships with the right agreements is the data controller’s main tool for managing its responsibility under the KVKK. We draft your data processing agreements, review agreements sent by your suppliers and customers from a KVKK perspective, and prepare confidentiality and data protection agreements with your employees as well as your internal policies.

What is a data processing agreement?

A data processor is a natural or legal person that processes personal data on behalf of the data controller, under the authority the controller gives it. A data processing agreement sets out the purpose for which, and the instructions under which, data will be processed in that relationship. It also determines the security measures to be taken, the use of sub-processors, the obligation to notify data breaches, audit rights and the return or destruction of data when the agreement ends.

Under Article 12 of the KVKK, where data is processed by another party on its behalf, the data controller is jointly responsible with the data processor for taking security measures. The agreement is how that responsibility is managed and, where necessary, how the company proves that measures were taken.

Data controller or data processor?

The same company may be a data controller in one relationship and a data processor in another. Getting the role right determines which party provides the privacy notice, who answers data subject requests and who notifies the Board of a data breach. A service provider that processes data only on your instructions and for your purposes is usually a data processor. A business partner that also uses the data for its own purposes is a separate data controller, and that relationship calls for a different contractual structure.

Scope

Drafting or reviewing data processor–data controller agreements
Reviewing agreements sent by suppliers or customers in the context of the KVKK
Drafting and reviewing confidentiality and data protection agreements with employees
Preparing the personal data retention and destruction policy, the policy on the protection of special categories of personal data and internal KVKK policies

How We Work

Listing suppliers and business partners and identifying the parties’ roles in each relationship
Reviewing existing agreements from a KVKK perspective and reporting gaps
Preparing a data processing agreement template and protocols to be added to existing agreements
Negotiation support on agreements received from the other side
Preparing internal policies and communicating them to employees

Team

Ali Gül Founding Partner

Buse Yüceer Associate

Burcu Kulotu Associate

Frequently Asked Questions

Is it mandatory to sign a separate agreement with a data processor?

The KVKK does not require a separate document called a "data processing agreement". However, the data controller is jointly responsible with the data processor for the security measures the processor must take. In practice, a written agreement is how that responsibility is managed and proved; the Board's Personal Data Security Guide also lists adding data security provisions to agreements with data processors among the administrative measures.

Is it enough to add a clause to the existing service agreement?

In most cases, yes; an additional protocol or clause is sufficient instead of a separate agreement. What matters is the content, not the title of the document: the purpose of processing and instructions, security measures, use of sub-processors, breach notification, audit rights and the return or destruction of data at the end of the agreement.

What changes if our supplier is abroad?

In addition to the data processing agreement, one of the conditions for transfers abroad under Article 9 of the KVKK must also be met. In practice, this usually means signing the standard contract published by the Board and notifying it to the Authority within five business days of signature.

Which internal policies are mandatory?

Data controllers required to register with VERBİS must prepare a personal data retention and destruction policy. Under a Board decision, companies processing special categories of personal data are also expected to adopt a policy and procedure specific to that data. Other policies are not a legal requirement, but they document the company's compliance with the duty to take technical and administrative measures under the KVKK.

Would you like to discuss this service? Schedule a meeting with us — the first meeting is free of charge.

Schedule a meeting